asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Give the bingo photos their own bucket
All checks were successful
Deploy storage stack / deploy (push) Successful in 20s
Details

Browse source 
The datacenter bingo photos sat under bingo/ in asxpio-invoices, next to
the invoice PDFs, guarded only by a prefix policy. Move them to a
datacenterbingo-photos bucket: asxpio's user gets read-write for the
admin's uploads, the bingo user read-only on the whole bucket.

Existing objects are mirrored over with their keys unchanged, so the
database rows stay valid. Both users keep their old access until the
apps are switched and the old prefix is removed.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 04:07:41 +04:00
commit 61e93b64c8
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
SECRETS.md
View file

@ -64,7 +64,9 @@ can connect.
These are read-only:
- Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
the `asxpio` DB, and `default_transaction_read_only`.
- The MinIO user may only `GetObject` under `asxpio-invoices/bingo/`.
- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
(and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
asxpio's user has read-write on that bucket for the admin's uploads.
The same values go on the **datacenterbingo repo**.

24
init/minio-bootstrap.sh
View file

@ -58,26 +58,40 @@ EOF
|| mc admin policy update local "${name}" "/tmp/${name}.json"
}
# $3: one or more policy names, space-separated.
ensure_user() {
access="$1"
secret="$2"
policy="$3"
policies="$3"
if mc admin user info local "${access}" >/dev/null 2>&1; then
# Rotate secret to match desired state.
mc admin user remove local "${access}" >/dev/null
fi
mc admin user add local "${access}" "${secret}"
mc admin policy attach local "${policy}" --user "${access}" 2>/dev/null || true
# shellcheck disable=SC2086 # word-split the policy list on purpose
mc admin policy attach local ${policies} --user "${access}" 2>/dev/null || true
}
ensure_bucket "asxpio-invoices"
write_policy "asxpio-invoices-rw" "asxpio-invoices"
ensure_user "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw"
# datacenterbingo serves the card photos asxpio's admin uploads under bingo/.
# Datacenter bingo photos: uploaded and resized by asxpio's admin, served by
# datacenterbingo. Keys keep their bingo/ prefix, so DB rows stay valid.
ensure_bucket "datacenterbingo-photos"
write_policy "datacenterbingo-photos-rw" "datacenterbingo-photos"
write_ro_prefix_policy "datacenterbingo-photos-ro" "datacenterbingo-photos" ""
# Migration from asxpio-invoices/bingo/: copy whatever is missing. Remove
# this (and the old bingo-ro policy below) once the old prefix is deleted.
if mc ls "local/asxpio-invoices/bingo/" 2>/dev/null | grep -q .; then
mc mirror --quiet "local/asxpio-invoices/bingo" "local/datacenterbingo-photos/bingo"
fi
ensure_user "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw datacenterbingo-photos-rw"
if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "asxpio-invoices-bingo-ro"
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro asxpio-invoices-bingo-ro"
else
echo "minio-init: BINGO_S3_* unset, skipping bingo user"
fi