TessariDBDocs
  • 0.34.2-betalatest
  • 0.34.1-beta
  • 0.34.0-beta
  • 0.33.4-beta
  • 0.33.3-beta
  • 0.33.2-beta
  • 0.33.1-beta
  • 0.33.0-beta
  • 0.32.0-beta

Running it

The server beside the TessariDB node that holds its metadata, from one compose file — and the first bucket with the AWS CLI.

The server's repository carries a Dockerfile that builds an image holding only the tessaridb-s3 server, and a compose.yaml that runs it beside the TessariDB node holding its metadata.

git clone https://github.com/tessaridb/tessaridb-s3
cd tessaridb-s3
cp .env.example .env        # set every value in it
docker compose up -d --wait

Every value in .env is required and none has a default worth keeping: the database owner, the server's own database password, the S3 root key and secret, and the 64-hex-digit key users' secrets are sealed under (openssl rand -hex 32).

What the compose file does:

  • The database (tessaridb/tessaridb:0.34.2-beta) declares its owner from .env on first start and is reachable only from the S3 server, over the compose network.
  • A one-shot s3-account step signs in as that owner once to declare the namespace, the database and the server's own account. The server then signs in as s3, an editor of s3.meta that is refused anything outside it.
  • S3 is published on 127.0.0.1:9100 and the console on 127.0.0.1:9101. Both keep their data in named volumes, and the server runs as a non-root user.

[!WARNING] Put a TLS-terminating proxy in front of S3 and the console before exposing either. Without TLS a console sign-in sends a secret across the network in the clear.

The first bucket

export AWS_ACCESS_KEY_ID=<S3_ROOT_ACCESS_KEY from .env>
export AWS_SECRET_ACCESS_KEY=<S3_ROOT_SECRET_KEY from .env>
export AWS_DEFAULT_REGION=us-east-1

aws --endpoint-url http://127.0.0.1:9100 s3 mb s3://first
aws --endpoint-url http://127.0.0.1:9100 s3 cp ./photo.jpg s3://first/2026/
aws --endpoint-url http://127.0.0.1:9100 s3 ls s3://first --recursive

Requests must be signed for the server's region (TESSARIDB_S3_REGION, us-east-1 by default). Anonymous requests are refused. Path-style addressing always works; <bucket>.<domain> addressing works for the domains listed in TESSARIDB_S3_DOMAINS.

Stopping

SIGINT or SIGTERM stops the server after the grace period (TESSARIDB_S3_SHUTDOWN_GRACE_SECS, 30 seconds by default); requests in flight are given that long to finish.

Running it — TessariDB