CloWM S3Proxy Service
Description
Openstack is shipping with an integrated UI to access the Object Store provided by Ceph. Unfortunately, this UI does not allow fine-grained control who can access a bucket or object. You can either make it accessible for everyone or nobody, but Ceph can do this and much more. 👎 This is the backend for a new UI which can leverage the additional powerful functionality provided by Ceph in a user-friendly manner. 👍
| Feature | Openstack Integration | New UI |
|---|---|---|
| Create / Delete Buckets UI | ✅ | ✅ |
| Create / Delete Buckets CLI | ✅ | ❌ |
| Upload / Download Objects | ✅ | ✅ |
| Fine-grained Access Control | ❌ | ✅ |
Concept
Environment Variables
Mandatory / Recommended Variables
| Variable | Default | Value | Description |
|---|---|---|---|
DB_HOST |
unset | <db hostname / IP> | IP or Hostname Adress of DB |
DB_PORT |
3306 | Number | Port of the database |
DB_USER |
unset | <db username> | Username of the database user |
DB_PASSWORD |
unset | <db password> | Password of the database user |
DB_DATABASE |
unset | <db name> | Name of the database |
OBJECT_GATEWAY_URI |
unset | HTTP URL | HTTP URL of the Ceph Object Gateway |
CEPH_ACCESS_KEY |
unset | <access key> | Ceph access key with admin privileges |
CEPH_SECRET_KEY |
unset | <secret key> | Ceph secret key with admin privileges |
CEPH_USERNAME |
unset | <ceph username> | Username in Ceph of the backend user |
PUBLIC_KEY_VALUE / PUBLIC_KEY_FILE
|
randomly generated | Public Key / Path to Public Key | Public part of RSA Key in PEM format to verify JWTs |
AUTHZ_ENDPOINT |
unset | HTTP URL | HTTP URL to ask the Auth Service for Authorization |
Optional Variables
| Variable | Default | Value | Description |
|---|---|---|---|
API_PREFIX |
/api |
URL path | Prefix before every URL path |
BACKEND_CORS_ORIGINS |
[] |
json formatted list of urls | List of valid CORS origins |
SQLALCHEMY_VERBOSE_LOGGER |
false |
<"true"|"false"> |
Enables verbose SQL output. Should be false in production |
Getting started
This service depends on multiple other services. See DEVELOPING.md how to set these up for developing on your local machine.