mirror of
https://github.com/hanzoai/s3.git
synced 2026-10-30 14:59:09 +00:00
zeekayandHanzo Dev
af0f387bbe
The binary is s3 and the product is Hanzo S3; the rest of the tree now says so too. - Environment: WEED_* and SEAWEEDFS_* are S3_*, no aliases. fla9's flag prefix is S3, matching viper's existing "s3" prefix, so the S3_S3_SSE_* names mini.go exports are the ones viper reads (WEED_S3_SSE_KEK was never seen once viper moved to "s3"). - Java and Hadoop: packages, fs.hanzofs.* keys and the hanzofs:// scheme under the hanzofs namespace the protos already declare; classes take a neutral Filer prefix and file names match them again (the earlier pass left Seas3*.java holding Seaweed* classes). Client, hdfs3, examples, s3copier, random_access and the Spark tests compile. - Helm chart: helpers are hanzo.*, values live under global.s3; the chart renders and lints, which it did not before. - Terraform: the s3.service.tftpl reference matches the file; 12/12 render tests pass. Config paths point at /etc/hanzo, which the binary reads. - loadtest.pb.go regenerated from loadtest.proto. - Upstream logo, sponsor images and unreferenced diagrams removed from note/. Kept: NOTICE attribution, LICENSE, the erasure-coding fixture s3/storage/erasure_coding/1.dat (test bytes), and unmaintained/ and third_party/ (vendored). No on-disk format, wire protocol or metadata key changed. Co-authored-by: Hanzo Dev <[email protected]>
54 lines
1.4 KiB
Plaintext
54 lines
1.4 KiB
Plaintext
# Hanzo S3 security.toml rendered by the Terraform core module.
|
|
# Rendered when enable_security OR any non-default JWT signing option is set.
|
|
# Presence of this file does NOT imply mTLS: the [grpc] TLS block is emitted
|
|
# only under enable_security; a JWT-only config carries [jwt.*] and no TLS.
|
|
|
|
%{ if enable_security ~}
|
|
[grpc]
|
|
ca = "${cert_dir}/ca/tls.crt"
|
|
# Peer-identity authorization: without an allow-list, mTLS collapses to
|
|
# "trusted the CA" with no authZ. Set allowed_wildcard_domain / commonNames.
|
|
%{ if allowed_wildcard_domain != "" ~}
|
|
allowed_wildcard_domain = "${allowed_wildcard_domain}"
|
|
%{ endif ~}
|
|
|
|
[grpc.master]
|
|
cert = "${cert_dir}/master/tls.crt"
|
|
key = "${cert_dir}/master/tls.key"
|
|
%{ if allowed_common_names != "" ~}
|
|
allowed_commonNames = "${allowed_common_names}"
|
|
%{ endif ~}
|
|
|
|
[grpc.volume]
|
|
cert = "${cert_dir}/volume/tls.crt"
|
|
key = "${cert_dir}/volume/tls.key"
|
|
|
|
[grpc.filer]
|
|
cert = "${cert_dir}/filer/tls.crt"
|
|
key = "${cert_dir}/filer/tls.key"
|
|
|
|
[grpc.client]
|
|
cert = "${cert_dir}/client/tls.crt"
|
|
key = "${cert_dir}/client/tls.key"
|
|
%{ endif ~}
|
|
%{ if jwt_signing_key != "" ~}
|
|
|
|
[jwt.signing]
|
|
key = "${jwt_signing_key}"
|
|
%{ endif ~}
|
|
%{ if jwt_signing_read_key != "" ~}
|
|
|
|
[jwt.signing.read]
|
|
key = "${jwt_signing_read_key}"
|
|
%{ endif ~}
|
|
%{ if jwt_filer_signing_key != "" ~}
|
|
|
|
[jwt.filer_signing]
|
|
key = "${jwt_filer_signing_key}"
|
|
%{ endif ~}
|
|
%{ if jwt_filer_signing_read_key != "" ~}
|
|
|
|
[jwt.filer_signing.read]
|
|
key = "${jwt_filer_signing_read_key}"
|
|
%{ endif ~}
|