git.iko.soy/urbit.org
on master help sign in
move all s3 endpoints to subdomain, explains public access on bucket, other tweaks
da23144Tom Snelling
content/using/running/minio.md+26−28
compare with master
unifiedsplit
@@ -46,28 +46,26 @@ docker run -d \
46 -v /mnt/data:/data \
46 -v /mnt/data:/data \
47 -e "MINIO_ROOT_USER=<username>" \
47 -e "MINIO_ROOT_USER=<username>" \
48 -e "MINIO_ROOT_PASSWORD=<password>" \
48 -e "MINIO_ROOT_PASSWORD=<password>" \
49− -e "MINIO_DOMAIN=example.com" \
49+ -e "MINIO_DOMAIN=s3.example.com" \
50+ -e "MINIO_SERVER_URL=https://s3.example.com" \
50 minio/minio server /data --console-address ":9001"
51 minio/minio server /data --console-address ":9001"
51```
52```
52
53
53−Ports 9000 and 9001 are exposed to give access to the MinIO admin interface and MinIO S3 admin respectively. `/mnt/data` is the path where your uploaded data will be stored on your host machine — you can change this as necessary.
54+Ports 9000 and 9001 are exposed to give access to the MinIO S3 interface and MinIO web admin respectively. `/mnt/data` is the path where your uploaded data will be stored on your host machine — you can change this as necessary.
54
55
55−Be sure to add the `MINIO_DOMAIN` environment variable; this tells MinIO to accept virtual host style URLs (`BUCKET.example.com` rather than `example.com/BUCKET`), which are required for compatibility with Urbit.
56+Be sure to add the `MINIO_DOMAIN` environment variable; this tells MinIO to accept virtual host style URLs (`BUCKET.s3.example.com` rather than `s3.example.com/BUCKET`), which are required for compatibility with Urbit.
56
57
57−Your username and password can be anything of your choosing — make sure they're secure! You could use your `@p` and `+code` for an easy to remember solution, or even just generate some random alphanumeric strings using a Unix tool, e.g.
58+Your username and password can be anything of your choosing — make sure they're secure! Your username must be at least 4 characters long and your password at least 8 characters long.
58−
59−```
60−tr -dc A-Z0-9 </dev/urandom | head -c 24 ; echo ''
61−```
62
59
63### Create DNS records
60### Create DNS records
64
61
65−Now, you'll need to point your own domain at your MinIO installation. Via your domain's DNS settings (usually configured on the registrar you bought your domain through), create two `A` records:
62+Now, you'll need to point your own domain at your MinIO installation. Via your domain's DNS settings (usually configured on the registrar you bought your domain through), create three `A` records:
66
63
67−- `s3.example.com`, and
64+- `s3.example.com`,
65+- `console.s3.example.com`, and
68- `BUCKET.example.com` where BUCKET is a bucket name of your choosing — 'media' or 'uploads' are good examples
66- `BUCKET.example.com` where BUCKET is a bucket name of your choosing — 'media' or 'uploads' are good examples
69
67
70−Both should point at the IP address of your host machine. If you are hosting on your own hardware, this could require port-forwarding via your router so that your host machine is reachable from outside of your home network, and possibly using a dynamic DNS service to update your DNS records if your home IP is not static.
68+All 3 should point at the IP address of your host machine. If you are hosting on your own hardware, this could require port-forwarding via your router so that your host machine is reachable from outside of your home network, and possibly using a dynamic DNS service to update your DNS records if your home IP is not static.
71
69
72DNS records can take a little while to propagate, so don't worry if you type your new URL into your browser and don't see anything yet.
70DNS records can take a little while to propagate, so don't worry if you type your new URL into your browser and don't see anything yet.
73
71
@@ -82,17 +80,11 @@ To install caddy, follow the instructions [here](https://caddyserver.com/docs/in
82Caddy handles TLS automatically, so we don't need to worry about setting that up. All we need to do is create a Caddyfile that looks something like this:
80Caddy handles TLS automatically, so we don't need to worry about setting that up. All we need to do is create a Caddyfile that looks something like this:
83
81
84```
82```
85−s3.example.com {
83+console.s3.example.com {
86− reverse_proxy localhost:9001 {
84+ reverse_proxy localhost:9001
87− header_up X-Forwarded-Host {host}
88− header_up Host {host}
89− }
90}
85}
91−BUCKET.example.com {
86+s3.example.com BUCKET.s3.example.com {
92− reverse_proxy localhost:9000 {
87+ reverse_proxy localhost:9000
93− header_up X-Forwarded-Host {host}
94− header_up Host {host}
95− }
96}
88}
97```
89```
98
90
@@ -100,13 +92,15 @@ Remember to replace BUCKET with your chosen bucket name, and then run `caddy sta
100
92
101### Create an S3 bucket
93### Create an S3 bucket
102
94
103−Navigate to your MinIO admin endpoint (`https://s3.example.com`) in a browser and sign in using the username and password you entered in step 1.
95+Navigate to your MinIO admin endpoint (`https://console.s3.example.com`) in a browser and sign in using the username and password you entered in step 1.
104
96
105Choose 'buckets' from the left-hand menu, and then 'create bucket' at the top of the page. Enter your bucket name (this MUST match the name in your DNS record, e.g. 'media').
97Choose 'buckets' from the left-hand menu, and then 'create bucket' at the top of the page. Enter your bucket name (this MUST match the name in your DNS record, e.g. 'media').
106
98
99+Then, you need to ensure your bucket is readable to the public, so that others can see your uploaded media. To do this, click 'manage' on your newly created bucket, and then navigate to 'access rules'. Click 'add access rule', enter `*` as the prefix and set access to `readonly`.
100+
107### Configure your ship
101### Configure your ship
108
102
109−Head over to Landscape and navigate to the S3 storage setup page at System preferences > Remote Storage, and enter your domain (with protocol) under endpoint, e.g. `https://example.com`. Enter your username and password from step 1 under access key and secret, and then enter the name of the bucket. When the bucket name is combined with the endpoint, you get your bucket URL e.g. `https://media.example.com`.
103+Head over to Landscape and navigate to the S3 storage setup page at System preferences > Remote Storage, and enter your domain (with protocol) under endpoint, e.g. `https://s3.example.com`. Enter your username and password from step 1 under access key and secret, and then enter the name of the bucket. When the bucket name is combined with the endpoint, you get your bucket URL e.g. `https://media.s3.example.com`.
110
104
111You can also configure these settings through dojo as shown [here](/using/os/s3).
105You can also configure these settings through dojo as shown [here](/using/os/s3).
112
106
@@ -114,18 +108,20 @@ You can also configure these settings through dojo as shown [here](/using/os/s3)
114
108
115You should now be able to upload content using your self-hosted MinIO installation.
109You should now be able to upload content using your self-hosted MinIO installation.
116
110
111+Once your S3 config is added, you should see a paperclip icon next to the message input in your chats. Media can be uploaded and posted by clicking here.
112+
117## Troubleshooting
113## Troubleshooting
118
114
119Landscape chat will fail silently if it cannot connect to your S3 endpoint to upload media. To get an idea of what's going wrong, open the network tab of your browser dev tools, and observe the request when you try and upload media. You should see a failed request, hopefully with an error code or reason for failure.
115Landscape chat will fail silently if it cannot connect to your S3 endpoint to upload media. To get an idea of what's going wrong, open the network tab of your browser dev tools, and observe the request when you try and upload media. You should see a failed request, hopefully with an error code or reason for failure.
120
116
121- If you see a `mixed-content` error, this means that not every part of the set up is using TLS. Most browsers will refuse to load non-HTTPS content from a secure page.
117- If you see a `mixed-content` error, this means that not every part of the set up is using TLS. Most browsers will refuse to load non-HTTPS content from a secure page.
122- If you see a `502 Bad Gateway` error, caddy is unable to reach your MinIO installation. Check MinIO is running and your `reverse_proxy` URLs are correct.
118- If you see a `502 Bad Gateway` error, caddy is unable to reach your MinIO installation. Check MinIO is running and your `reverse_proxy` URLs are correct.
123−- If you get a `Permission denied` error, it's likely that your bucket endpoint is incorrect. Ensure your Caddyfile includes the `header_up` options, and that you passed the `MINIO_DOMAIN` variable when running MinIO - otherwise it will default to using the path URL format, which Urbit does not support.
119+- If you get a `Permission denied` error, it's likely that your bucket endpoint is incorrect. Ensure that you passed the `MINIO_DOMAIN` variable when running MinIO - otherwise it will default to using the path URL format, which Urbit does not support.
124
120
125A good way to test your setup is to `curl` your S3 bucket endpoint (not your root S3 endpoint) and see what response you get. For example, if we have a bucket named 'media':
121A good way to test your setup is to `curl` your S3 bucket endpoint (not your root S3 endpoint) and see what response you get. For example, if we have a bucket named 'media':
126
122
127```
123```
128−curl https://media.example.com
124+curl https://media.s3.example.com
129```
125```
130
126
131You should get an XML response listing the contents of your bucket.
127You should get an XML response listing the contents of your bucket.
@@ -137,7 +133,9 @@ You may wonder how it's possible to run Urbit alongside our MinIO set up if they
137For example, you could have 3 domains:
133For example, you could have 3 domains:
138
134
139- `ship-name.example.com` - proxy to port 8080 where Urbit is running,
135- `ship-name.example.com` - proxy to port 8080 where Urbit is running,
140−- `s3.example.com` - proxy to port 9001 where your MinIO admin is running, and
136+- `console.s3.example.com` - proxy to port 9001 where your MinIO admin is running, and
141−- `media.example.com` - proxy to port 9000 where your MinIO bucket is accessible
137+- `media.s3.example.com` - proxy to port 9000 where your MinIO bucket is accessible
138+
139+Currently, there is no way to specify the HTTP port Landscape runs on (unless you are running the `urbit-king` binary), but if 80 is not available at start-up it will try 8080 next. So start caddy first, and when you boot your ship it should detect that port 80 is in use and use 8080 instead.
142
140
143−Currently, there is no way to specify the HTTP port Landscape runs on, but if 80 is not available at start-up it will try 8080 next. So start caddy first, and when you boot your ship it should detect that port 80 is in use and use 8080 instead.
141+If you are running the `urbit-king` binary, then you can specify the HTTP port with the `--http-port` option.