asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Drop the bingo photo migration from minio-init
All checks were successful
Deploy storage stack / deploy (push) Successful in 18s
Details

Browse source 
All photos are in datacenterbingo-photos and both apps use it, so stop
mirroring from asxpio-invoices/bingo/ and take away the bingo user's
read access there.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 04:25:20 +04:00
commit c849e253f9
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 5 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
SECRETS.md
View file

@ -64,8 +64,7 @@ can connect.
These are read-only:
- Role `bingo` gets SELECT on `bingo_datacenters` and `bingo_incidents` in
the `asxpio` DB, and `default_transaction_read_only`.
- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket
(and, until the migration is cleaned up, under `asxpio-invoices/bingo/`).
- The MinIO user may only `GetObject` in the `datacenterbingo-photos` bucket.
asxpio's user has read-write on that bucket for the admin's uploads.
The same values go on the **datacenterbingo repo**.

13
init/minio-bootstrap.sh
View file

@ -81,20 +81,15 @@ ensure_bucket "datacenterbingo-photos"
write_policy "datacenterbingo-photos-rw" "datacenterbingo-photos"
write_ro_prefix_policy "datacenterbingo-photos-ro" "datacenterbingo-photos" ""
# Migration from asxpio-invoices/bingo/: copy whatever is missing. Remove
# this (and the old bingo-ro policy below) once the old prefix is deleted.
# (The mc image has no grep; test the listing with plain sh.)
if [ -n "$(mc ls "local/asxpio-invoices/bingo/" 2>/dev/null)" ]; then
mc mirror --quiet "local/asxpio-invoices/bingo" "local/datacenterbingo-photos/bingo"
fi
ensure_user "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}" "asxpio-invoices-rw datacenterbingo-photos-rw"
if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
write_ro_prefix_policy "asxpio-invoices-bingo-ro" "asxpio-invoices" "bingo/"
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro asxpio-invoices-bingo-ro"
ensure_user "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}" "datacenterbingo-photos-ro"
else
echo "minio-init: BINGO_S3_* unset, skipping bingo user"
fi
# Leftover from before the photos had their own bucket.
mc admin policy remove local "asxpio-invoices-bingo-ro" >/dev/null 2>&1 || true
echo "minio-init: done"