Cloudflare R2

R2 has no egress fees, and every download reads from the bucket.

Create the buckets

In the Cloudflare dashboard, under R2 Object Storage, create two buckets, for example relic-artifacts and relic-temporary, with the same location hint or jurisdiction. Leave public access and custom domains off.

This Wrangler command creates the artifacts bucket:

npx wrangler r2 bucket create relic-artifacts

This command creates the temporary bucket:

npx wrangler r2 bucket create relic-temporary

Lifecycle rules

API token

Under R2 Object Storage → Manage API tokens, create a token with Object Read & Write permission on both buckets. Its Access Key ID and Secret Access Key, shown once, are Relic's key pair.

Settings

RELIC_OBJECT_STORAGE_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
RELIC_OBJECT_STORAGE_REGION=auto
RELIC_OBJECT_STORAGE_ARTIFACTS_BUCKET=relic-artifacts
RELIC_OBJECT_STORAGE_TEMPORARY_BUCKET=relic-temporary
RELIC_OBJECT_STORAGE_ACCESS_KEY=<access-key-id>
RELIC_OBJECT_STORAGE_SECRET_KEY=<secret-access-key>

<account-id> is on the R2 overview page. Buckets in a jurisdiction use its endpoint, such as https://<account-id>.eu.r2.cloudflarestorage.com.

Helm:

seaweedfs:
  enabled: false
existingCredentialsSecret: relic          # holds the S3 key pair, adminPassword and encryptionKey
objectStorage:
  endpoint: https://<account-id>.r2.cloudflarestorage.com
  region: auto
  artifactsBucket: relic-artifacts
  temporaryBucket: relic-temporary

Gotchas

• Region. R2 signs with auto; it also accepts the default us-east-1.
• Path-style URLs. R2 supports the path-style requests Relic sends.
• One token for both buckets. A token scoped to one bucket makes every upload fail.
• Checksums. Upload a file of a few hundred megabytes after setup. If it fails with a checksum error, set RELIC_OBJECT_STORAGE_CHECKSUM to when_required (objectStorage.checksum in the Helm chart).
• Latency. Run Relic close to the buckets' location.