mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
ec7d4c9042
SeaweedFS 4.49 (seaweedfs/seaweedfs#11592) authorizes a PutObject that carries x-amz-acl as s3:PutObjectAcl as well. The consumer identities only held Read/Write/List/Tagging, so every app that sends an ACL on upload (Nextcloud, Fider and Pixelfed with private, Mastodon, PeerTube, BookWyrm and Baserow with public-read) got AccessDenied after the 4.48 -> 4.51 bump in #1226. Main run 40401200083 failed Fider#0, BookWyrm#0, Baserow#0, Pixelfed#0 and Nextcloud#0/#4/#8 on it. Add WriteAcp to the s3.json identities and to the sidecar s3.configure grant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.0 KiB
Django/Jinja
29 lines
1.0 KiB
Django/Jinja
{% set identities = [] %}
|
|
{% set _ = identities.append({
|
|
"name": "admin",
|
|
"credentials": [{"accessKey": SEAWEEDFS_ADMIN_ACCESS_KEY, "secretKey": SEAWEEDFS_ADMIN_SECRET_KEY}],
|
|
"actions": ["Admin", "Read", "Write", "List", "Tagging"]
|
|
}) %}
|
|
{% set anonymous_actions = [] %}
|
|
{% for role in lookup('objstore_consumers', 'seaweedfs') %}
|
|
{% set objstore = lookup('objstore', role) %}
|
|
{% set _ = identities.append({
|
|
"name": role,
|
|
"credentials": [{"accessKey": objstore.access_key, "secretKey": objstore.secret_key}],
|
|
"actions": [
|
|
"Read:" ~ objstore.bucket,
|
|
"Write:" ~ objstore.bucket,
|
|
"WriteAcp:" ~ objstore.bucket,
|
|
"List:" ~ objstore.bucket,
|
|
"Tagging:" ~ objstore.bucket
|
|
]
|
|
}) %}
|
|
{% if objstore.public %}
|
|
{% set _ = anonymous_actions.append("Read:" ~ objstore.bucket) %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% if anonymous_actions %}
|
|
{% set _ = identities.append({"name": "anonymous", "actions": anonymous_actions}) %}
|
|
{% endif %}
|
|
{{ {"identities": identities} | to_nice_json }}
|