openvibers/openvibe.media Commits
S3 docs: the surface answers at s3.openvibe.network (s3.openvibe.media has no DNS record yet; the aws and rclone examples failed to resolve) (#151)
Changes
@@@ -60,7 +60,7 @@ key ([Tenancy & auth](#tenancy--auth)).|---|---|---|---|| `media.resource.read` | first-party | `GET /api/v1/resources`, `GET /api/v1/resources/:ovrn` | the authority resource index ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.108.0; the route enforces it (a Network service token holding it, loopback, audience `openvibe.media`) || `media.resource.control` | first-party | `POST /api/v1/resources/control` | `delete` a person's (or their project's) object: the soft delete, restorable until its retention ends ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.169.0 |--| `media.object.s3` | public (an access key) | the S3 surface at `s3.openvibe.media` ([docs/s3.md](docs/s3.md)) | PutObject, GetObject, HeadObject, DeleteObject(s), ListObjects(V2), ListBuckets, HeadBucket, presigned GET/PUT; a bucket is a zone |++| `media.object.s3` | public (an access key) | the S3 surface at `s3.openvibe.network` (`s3.openvibe.media` once its DNS record exists; [docs/s3.md](docs/s3.md)) | PutObject, GetObject, HeadObject, DeleteObject(s), ListObjects(V2), ListBuckets, HeadBucket, presigned GET/PUT; a bucket is a zone || `media.access_key.manage` | first-party | `POST/GET/DELETE /api/v1/projects/:project/access-keys` | S3 access keys for a project admin, the secret shown once (Zone's console, Services) || `media.zone.provision` | first-party (Zone) | `PUT/GET /internal/zones/:id` | OpenVibe.Zone's zone records, applied by revision; usage and deletion progress |@@@ -594,7 +594,7 @@ counts its viewer for the day, identifying no one (see Storage tiering).## S3 surface and zones--Media answers a subset of S3 at `https://s3.openvibe.media` (ADR-031). Each bucket is a zone of a project environment, and zones are managed by OpenVibe.Zone. Media issues and verifies the `ovk_` access keys, and every object stays an ordinary Media object.++Media answers a subset of S3 at `https://s3.openvibe.network` (ADR-031; `https://s3.openvibe.media` once that name's DNS record exists). Each bucket is a zone of a project environment, and zones are managed by OpenVibe.Zone. Media issues and verifies the `ovk_` access keys, and every object stays an ordinary Media object.See [docs/s3.md](docs/s3.md) for the operations, the rules and the tests.@@@ -1,7 +1,8 @@# The S3 surface and zones--OpenVibe.Media answers a subset of the Amazon S3 API at `https://s3.openvibe.media`, path style--(`/<bucket>/<key>`). The design is ADR-031 in OpenVibe.Contracts, with its two amendments. A **bucket is a zone**:++OpenVibe.Media answers a subset of the Amazon S3 API at `https://s3.openvibe.network`, path style++(`/<bucket>/<key>`). Its intended name, `https://s3.openvibe.media`, has no DNS record yet: nginx already answers both++names, and OpenVibe.Zone's pages show the `.network` one through `ZONE_S3_ENDPOINT`. The design is ADR-031 in OpenVibe.Contracts, with its two amendments. A **bucket is a zone**:a named object zone of one project environment. Zones are made and deleted only through OpenVibe.Zone(https://openvibe.zone).@@@ -84,7 +85,7 @@ names no zone of its key (`NoSuchBucket`, a bad signature) counts nowhere.```shaws configure set aws_access_key_id ovk_… # issued on openvibe.zoneaws configure set aws_secret_access_key … # shown once--aws --endpoint-url https://s3.openvibe.media s3 ls s3://assets/--rclone config create oz s3 provider Other endpoint https://s3.openvibe.media access_key_id ovk_… secret_access_key … \++aws --endpoint-url https://s3.openvibe.network s3 ls s3://assets/++rclone config create oz s3 provider Other endpoint https://s3.openvibe.network access_key_id ovk_… secret_access_key … \no_check_bucket true```
@@ -60,7 +60,7 @@ key ([Tenancy & auth](#tenancy--auth)).
@@ -60,7 +60,7 @@ key ([Tenancy & auth](#tenancy--auth)).
|---|---|---|---|
|---|---|---|---|
| `media.resource.read` | first-party | `GET /api/v1/resources`, `GET /api/v1/resources/:ovrn` | the authority resource index ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.108.0; the route enforces it (a Network service token holding it, loopback, audience `openvibe.media`) |
| `media.resource.read` | first-party | `GET /api/v1/resources`, `GET /api/v1/resources/:ovrn` | the authority resource index ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.108.0; the route enforces it (a Network service token holding it, loopback, audience `openvibe.media`) |
| `media.resource.control` | first-party | `POST /api/v1/resources/control` | `delete` a person's (or their project's) object: the soft delete, restorable until its retention ends ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.169.0 |
| `media.resource.control` | first-party | `POST /api/v1/resources/control` | `delete` a person's (or their project's) object: the soft delete, restorable until its retention ends ([Resource index](#resource-index-apiv1resources-first-party)). Active in openvibe-contracts since 0.169.0 |
-| `media.object.s3` | public (an access key) | the S3 surface at `s3.openvibe.media` ([docs/s3.md](docs/s3.md)) | PutObject, GetObject, HeadObject, DeleteObject(s), ListObjects(V2), ListBuckets, HeadBucket, presigned GET/PUT; a bucket is a zone |
+| `media.object.s3` | public (an access key) | the S3 surface at `s3.openvibe.network` (`s3.openvibe.media` once its DNS record exists; [docs/s3.md](docs/s3.md)) | PutObject, GetObject, HeadObject, DeleteObject(s), ListObjects(V2), ListBuckets, HeadBucket, presigned GET/PUT; a bucket is a zone |
| `media.access_key.manage` | first-party | `POST/GET/DELETE /api/v1/projects/:project/access-keys` | S3 access keys for a project admin, the secret shown once (Zone's console, Services) |
| `media.access_key.manage` | first-party | `POST/GET/DELETE /api/v1/projects/:project/access-keys` | S3 access keys for a project admin, the secret shown once (Zone's console, Services) |
| `media.zone.provision` | first-party (Zone) | `PUT/GET /internal/zones/:id` | OpenVibe.Zone's zone records, applied by revision; usage and deletion progress |
| `media.zone.provision` | first-party (Zone) | `PUT/GET /internal/zones/:id` | OpenVibe.Zone's zone records, applied by revision; usage and deletion progress |
@@ -594,7 +594,7 @@ counts its viewer for the day, identifying no one (see Storage tiering).
@@ -594,7 +594,7 @@ counts its viewer for the day, identifying no one (see Storage tiering).
## S3 surface and zones
## S3 surface and zones
-Media answers a subset of S3 at `https://s3.openvibe.media` (ADR-031). Each bucket is a zone of a project environment, and zones are managed by OpenVibe.Zone. Media issues and verifies the `ovk_` access keys, and every object stays an ordinary Media object.
+Media answers a subset of S3 at `https://s3.openvibe.network` (ADR-031; `https://s3.openvibe.media` once that name's DNS record exists). Each bucket is a zone of a project environment, and zones are managed by OpenVibe.Zone. Media issues and verifies the `ovk_` access keys, and every object stays an ordinary Media object.
See [docs/s3.md](docs/s3.md) for the operations, the rules and the tests.
See [docs/s3.md](docs/s3.md) for the operations, the rules and the tests.
@@ -1,7 +1,8 @@
@@ -1,7 +1,8 @@
# The S3 surface and zones
# The S3 surface and zones
-OpenVibe.Media answers a subset of the Amazon S3 API at `https://s3.openvibe.media`, path style
-(`/<bucket>/<key>`). The design is ADR-031 in OpenVibe.Contracts, with its two amendments. A **bucket is a zone**:
+OpenVibe.Media answers a subset of the Amazon S3 API at `https://s3.openvibe.network`, path style
+(`/<bucket>/<key>`). Its intended name, `https://s3.openvibe.media`, has no DNS record yet: nginx already answers both
+names, and OpenVibe.Zone's pages show the `.network` one through `ZONE_S3_ENDPOINT`. The design is ADR-031 in OpenVibe.Contracts, with its two amendments. A **bucket is a zone**:
a named object zone of one project environment. Zones are made and deleted only through OpenVibe.Zone
a named object zone of one project environment. Zones are made and deleted only through OpenVibe.Zone
(https://openvibe.zone).
(https://openvibe.zone).
@@ -84,7 +85,7 @@ names no zone of its key (`NoSuchBucket`, a bad signature) counts nowhere.
@@ -84,7 +85,7 @@ names no zone of its key (`NoSuchBucket`, a bad signature) counts nowhere.
```sh
```sh
aws configure set aws_access_key_id ovk_… # issued on openvibe.zone
aws configure set aws_access_key_id ovk_… # issued on openvibe.zone
aws configure set aws_secret_access_key … # shown once
aws configure set aws_secret_access_key … # shown once
-aws --endpoint-url https://s3.openvibe.media s3 ls s3://assets/
-rclone config create oz s3 provider Other endpoint https://s3.openvibe.media access_key_id ovk_… secret_access_key … \
+aws --endpoint-url https://s3.openvibe.network s3 ls s3://assets/
+rclone config create oz s3 provider Other endpoint https://s3.openvibe.network access_key_id ovk_… secret_access_key … \
no_check_bucket true
no_check_bucket true
```
```