Storage

MinIO

A self-hosted MinIO deployment as object storage.

Relic is not tested against MinIO: test an upload and a download first.

Create the buckets, policy and user

This command creates the artifacts bucket:

mc mb local/relic-artifacts

This command creates the temporary bucket:

mc mb local/relic-temporary

This command expires objects in the temporary bucket after one day:

mc ilm rule add --expire-days 1 local/relic-temporary

Save this policy as relic-policy.json (local is the mc alias):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::relic-artifacts", "arn:aws:s3:::relic-temporary"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": ["arn:aws:s3:::relic-artifacts/*", "arn:aws:s3:::relic-temporary/*"]
    }
  ]
}

This command creates the policy relic:

mc admin policy create local relic relic-policy.json

This command creates the user relic, whose name is the access key:

mc admin user add local relic '<secret-key>'

This command attaches the policy to the user:

mc admin policy attach local relic --user relic

Settings

RELIC_OBJECT_STORAGE_ENDPOINT=https://minio.example.com:9000
RELIC_OBJECT_STORAGE_ARTIFACTS_BUCKET=relic-artifacts
RELIC_OBJECT_STORAGE_TEMPORARY_BUCKET=relic-temporary
RELIC_OBJECT_STORAGE_ACCESS_KEY=relic
RELIC_OBJECT_STORAGE_SECRET_KEY=<secret-key>

If the server sets MINIO_SITE_REGION, set RELIC_OBJECT_STORAGE_REGION to the same value.

Helm:

seaweedfs:
  enabled: false
existingCredentialsSecret: relic          # holds the S3 key pair, adminPassword and encryptionKey
objectStorage:
  endpoint: https://minio.example.com:9000
  artifactsBucket: relic-artifacts
  temporaryBucket: relic-temporary

Gotchas

TLS. A certificate from a private CA fails verification. Use a publicly trusted certificate, or plain HTTP on a private network.
Versioning. Leave it off on the artifacts bucket, or expire noncurrent versions with mc ilm.
Old releases may reject the SDK's checksums. Upgrade MinIO, or set RELIC_OBJECT_STORAGE_CHECKSUM to when_required (objectStorage.checksum in the Helm chart).

Edit this pageorReport an issue

Cloudflare R2

Cloudflare R2 as object storage, through its S3-compatible API.

Google Cloud Storage

Google Cloud Storage as object storage, with workload identity or a service account key.