asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Give the bingo photos their own bucket
All checks were successful
Deploy storage stack / deploy (push) Successful in 20s
Details

Browse source 
The datacenter bingo photos sat under bingo/ in asxpio-invoices, next to
the invoice PDFs, guarded only by a prefix policy. Move them to a
datacenterbingo-photos bucket: asxpio's user gets read-write for the
admin's uploads, the bingo user read-only on the whole bucket.

Existing objects are mirrored over with their keys unchanged, so the
database rows stay valid. Both users keep their old access until the
apps are switched and the old prefix is removed.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 04:07:41 +04:00
commit 61e93b64c8
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
SECRETS.md
View file

@ -64,7 +64,9 @@ can connect.
These are read-only:
- Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
the `asxpio` DB, and `default_transaction_read_only`.
- The MinIO user may only `GetObject` under `asxpio-invoices/bingo/`.
- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
(and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
asxpio's user has read-write on that bucket for the admin's uploads.
The same values go on the **datacenterbingo repo**.