file-provider-s3

Registers itself as the "s3" provider for file-foundation and owns the per-tenant config keys (bucket, region, endpoint, forcePathStyle, accessKeyId) and the encrypted s3.secretAccessKey secret. Compatible with any S3-compatible object store (AWS S3, Hetzner Object Storage); set credentials via the admin UI or a seed handler before the first file operation.

How it fits

What this feature needs to run (Requires, top) and the write commands it provides (Provides, bottom).

flowchart TB
  n_file_provider_s3["file-provider-s3"]
  subgraph how_reqs["Requires"]
    n_config["config"]
    n_secrets["secrets"]
    n_file_foundation["file-foundation"]
  end
  n_config --> n_file_provider_s3
  n_secrets --> n_file_provider_s3
  n_file_foundation --> n_file_provider_s3

Dependencies

• Requires: config, secrets, file-foundation
• Activation: always on (not toggleable)

Configuration

Per-tenant config keys, set via the tenant-admin UI or a seed. 🔒 = encrypted at rest.

Key	Type	Default	Scope	Who can write	Who can read
access-key-id	text	""	tenant	TenantAdmin, SystemAdmin	TenantAdmin, SystemAdmin
bucket	text	""	tenant	TenantAdmin, SystemAdmin	TenantAdmin, SystemAdmin
endpoint	text	""	tenant	TenantAdmin, SystemAdmin	TenantAdmin, SystemAdmin
force-path-style	boolean	false	tenant	TenantAdmin, SystemAdmin	all
region	text	""	tenant	TenantAdmin, SystemAdmin	TenantAdmin, SystemAdmin

Secrets

Secret	Scope	Hint
file-provider-s3:secret:s3-secret-access-key	tenant	Private half of the S3 key pair. Hetzner calls it ‘Secret Key’, AWS calls it ‘Secret Access Key’.

Extensions & cross-feature APIs

• Registers extension: fileProvider → s3