computer-playbook/roles/web-app-minio

MinIO

Description

MinIO is an S3-compatible object storage service for files, media, backups, and AI artifacts, self-hosted for performance and control.

Overview

Applications that speak “S3” (Pixelfed, Mastodon, Nextcloud, Flowise, etc.) store and retrieve objects from MinIO buckets using familiar SDKs and CLIs. Admins manage buckets, users, and access policies through a browser console while keeping everything on-prem.

Cosmos

The diagram places MinIO in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph deps [Dependencies]
        dep_svc_ai_ollama["svc-ai-ollama 🐳🐝"]
        dep_svc_bkp_volume_2_local["svc-bkp-volume-2-local 💻"]
        dep_svc_db_openldap["svc-db-openldap 🐳🐝"]
        dep_svc_net_tor["svc-net-tor 🐳🐝"]
        dep_web_app_dashboard["web-app-dashboard 🐳🐝"]
        dep_web_app_keycloak["web-app-keycloak 🐳🐝"]
        dep_web_app_matomo["web-app-matomo 🐳🐝"]
        dep_web_app_prometheus["web-app-prometheus 🐳🐝"]
        dep_web_svc_css["web-svc-css 💻"]
        dep_web_svc_logout["web-svc-logout 🐳🐝"]
    end
    subgraph role [web-app-minio 🐳🐝]
        svc_sso["sso"]
        svc_ldap["ldap"]
        svc_logout["logout"]
        svc_dashboard["dashboard"]
        svc_matomo["matomo"]
        svc_minio["minio"]
        svc_redis["redis"]
        svc_css["css"]
        svc_javascript["javascript"]
        svc_ollama["ollama"]
        svc_prometheus["prometheus"]
        svc_tor["tor"]
        svc_api["api"]
        svc_console["console"]
        svc_client["client"]
        svc_container_backup["container_backup"]
    end
    dep_svc_ai_ollama -. "0..1" .-> svc_ollama
    dep_svc_bkp_volume_2_local -. "0..1" .-> svc_container_backup
    dep_svc_db_openldap -. "0..1" .-> svc_ldap
    dep_svc_net_tor -. "0..1" .-> svc_tor
    dep_web_app_dashboard -. "0..1" .-> svc_dashboard
    dep_web_app_keycloak -. "0..1" .-> svc_sso
    dep_web_app_matomo -. "0..1" .-> svc_matomo
    dep_web_app_prometheus -. "0..1" .-> svc_prometheus
    dep_web_svc_css -. "0..1" .-> svc_css
    dep_web_svc_logout -. "0..1" .-> svc_logout

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

• S3-compatible API for broad app compatibility
• Buckets, users, access keys, and fine-grained policies
• Optional versioning, lifecycle rules, and object lock
• Presigned URLs for secure, time-limited uploads/downloads
• Ideal for AI stacks: datasets, embeddings, and artifacts

Quick Setup

Development

Clone, set up the workstation, and deploy MinIO onto the local stack:

git clone https://github.com/infinito-nexus/core.git
cd core
make onboard
make compose-deploy mode=reinstall apps=web-app-minio full_cycle=false

Production

Run the published image to provision the inventory and deploy MinIO to a managed server (the mounted volume persists the inventory):

APP=web-app-minio
HOST=<your-server>
DOMAIN=<your-domain>
TLS_MODE=self_signed
SSH_PUBLIC_KEY="<your-ssh-public-key>"

docker run --rm -it \
  -v "$PWD/inventories:/etc/infinito.nexus/inventories" \
  -e APP="$APP" -e HOST="$HOST" -e DOMAIN="$DOMAIN" -e TLS_MODE="$TLS_MODE" -e SSH_PUBLIC_KEY="$SSH_PUBLIC_KEY" \
  ghcr.io/infinito-nexus/core/debian bash -c '
    INVENTORY=/etc/infinito.nexus/inventories/production
    infinito administration inventory provision "$INVENTORY" \
      --inventory-file "$INVENTORY/devices.yml" \
      --host "$HOST" \
      --include "$APP" \
      --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}" &&
    infinito administration deploy dedicated "$INVENTORY/devices.yml" \
      --password-file "$INVENTORY/.password" \
      --diff -vv'

Further Resources

• MinIO: www.min.io
• AWS S3 (API background): aws.amazon.com/s3

Persona contract opt-outs

This role declares PERSONA_ADMINISTRATOR_BLOCKED and PERSONA_BIBER_BLOCKED in templates/playwright.env.j2 for two different reasons. The MinIO Console version pinned here never renders an SSO button — /api/v1/login answers redirectRules: null however the identity provider is registered server-side — so there is no in-page OIDC entry point for the shared helper to click. Biber is blocked because the only MinIO policy the role creates is the administrator RBAC group path (MINIO_OIDC_POLICY_NAME in vars/main.yml, attached in tasks/02_ldap.yml) and MinIO has no self-service signup, so biber maps to no policy and has no authenticated surface at either tier.

The administrator journey is covered bespoke in files/playwright/playwright.spec.js: the integrated OIDC path is proven at the STS AssumeRoleWithWebIdentity tier, and the LDAP variant additionally drives the Console form login and logout. The path back to the generic administrator persona is a Console build that surfaces the configured IdP on its login form.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).