MinIO after archival: a private S3 lab from pinned source

Inside the disposable container · terminal

import os,subprocess,socket,ssl,time,urllib.request
from pathlib import Path
r=Path('/srv/academy-minio')
assert not (r/'run/server.pid').exists()
for port in (19000,19001):
    with socket.socket() as s: s.bind(('127.0.0.1',port))
env={**os.environ,'MINIO_ROOT_USER_FILE':str(r/'private/root-user'),
     'MINIO_ROOT_PASSWORD_FILE':str(r/'private/root-password'),
     'MINIO_BROWSER_REDIRECT_URL':'https://127.0.0.1:19001',
     'MINIO_UPDATE':'off'}
# Never enable shell tracing, dump env, or print credentials.
with (r/'run/server.log').open('xb') as log:
    p=subprocess.Popen([str(r/'bin/minio'),'server',str(r/'data'),
        '--address','127.0.0.1:19000','--console-address','127.0.0.1:19001',
        '--certs-dir',str(r/'certs')],env=env,stdin=subprocess.DEVNULL,
        stdout=log,stderr=log,start_new_session=True)
with (r/'run/server.pid').open('x',encoding='utf-8') as f: f.write(str(p.pid))
ctx=ssl.create_default_context(cafile=str(r/'certs/public.crt'))
for attempt in range(60):
    if p.poll() is not None: raise RuntimeError('Server exited; inspect private log locally')
    try:
        with urllib.request.urlopen('https://127.0.0.1:19000/minio/health/ready',context=ctx,timeout=2) as q:
            assert q.status==200
        break
    except OSError: time.sleep(1)
else: raise RuntimeError('Ready probe timed out')
print('S3 API ready with verified TLS; separate loopback console')

Inside the disposable container · terminal

package main

import (
 "context"
 "crypto/tls"
 "crypto/x509"
 "encoding/json"
 "fmt"
 "net/http"
 "os"
 "path/filepath"

 "github.com/minio/madmin-go/v3"
 "github.com/minio/minio-go/v7"
 "github.com/minio/minio-go/v7/pkg/credentials"
)

func must(err error) { if err != nil { panic(err) } }
func main() {
 r := "/srv/academy-minio"
 read := func(n string) string { b,e:=os.ReadFile(filepath.Join(r,n));must(e);return string(b) }
 roots:=x509.NewCertPool()
 if !roots.AppendCertsFromPEM([]byte(read("certs/public.crt"))) { panic("CA rejected") }
 transport:=&http.Transport{TLSClientConfig:&tls.Config{RootCAs:roots,MinVersion:tls.VersionTLS12}}
 endpoint:="127.0.0.1:19000"
 root,secret:=read("private/root-user"),read("private/root-password")
 app,appSecret:=read("private/app-user"),read("private/app-password")
 admin,e:=madmin.New(endpoint,root,secret,true);must(e);admin.SetCustomTransport(transport)
 s3,e:=minio.New(endpoint,&minio.Options{Creds:credentials.NewStaticV4(root,secret,""),Secure:true,Transport:transport});must(e)
 ctx:=context.Background()
 // Refuse existing names rather than changing an existing bucket or account.
 for _,bucket:=range []string{"academy-objects","academy-objects-outside"} {
  exists,e:=s3.BucketExists(ctx,bucket);must(e);if exists { panic("Bucket exists; stop") }
 }
 users,e:=admin.ListUsers(ctx);must(e);if _,ok:=users[app];ok {panic("Account exists; stop")}
 for _,bucket:=range []string{"academy-objects","academy-objects-outside"} {must(s3.MakeBucket(ctx,bucket,minio.MakeBucketOptions{}))}
 policy:=map[string]interface{}{"Version":"2012-10-17","Statement":[]interface{}{
  map[string]interface{}{"Effect":"Allow","Action":[]string{"s3:ListBucket","s3:GetBucketLocation"},"Resource":[]string{"arn:aws:s3:::academy-objects"}},
  map[string]interface{}{"Effect":"Allow","Action":[]string{"s3:PutObject","s3:GetObject"},"Resource":[]string{"arn:aws:s3:::academy-objects/*"}},
 }}
 body,e:=json.Marshal(policy);must(e)
 must(admin.AddCannedPolicy(ctx,"academy-objects-rw",body))
 must(admin.AddUser(ctx,app,appSecret))
 _,e=admin.AttachPolicy(ctx,madmin.PolicyAssociationReq{User:app,Policies:[]string{"academy-objects-rw"}});must(e)
 fmt.Println("Two new private buckets and one bucket-scoped application identity created")
}