feat(forgejo): serve attachments and LFS from RustFS

sean commented

2026-09-09 18:30:41 +00:00

Owner

Stage 3, bucket three of five, consumer side. The mirror copied all 1,208 objects on its first pass with nothing differing, so this is the flip. Endpoint and credential move together; the word minio stays because Forgejo's driver is named that upstream. New class guard tests/object-store-consumers.sh covers every repointed consumer, four controls each confirmed red. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-09 18:30:41 +00:00

feat(forgejo): serve attachments and LFS from RustFS

binjovi/ci Binjovi completed the frozen plan

Details

1c1a37e845

Stage 3, bucket three of five, consumer side. The mirror copied all 1,208
objects on its first pass with nothing differing and nothing missing, so this
is the flip.

USER DATA. Attachments, avatars, release assets, LFS objects and packages --
everything Forgejo does not keep in PostgreSQL. The MinIO bucket stays
untouched as the rollback, which matters more here than anywhere else in this
migration: a lost log chunk is an inconvenience, a lost attachment is a
person's data.

THE WORD "minio" STAYS, and it is not a leftover. Forgejo's storage driver is
literally named `minio` and has no `s3` alias, so STORAGE_TYPE and every
FORGEJO__STORAGE__MINIO_* variable are fixed by upstream and say nothing about
which store answers. Only the endpoint and the credential source move.

The credential moves with the endpoint. A consumer reading its key from the
MinIO chain after its endpoint moved gets a key the new store has never heard
of, and that fails as an S3 403 at write time -- not at deploy, not at
startup, but the first time someone uploads a file.

There is no NetworkPolicy to update: namespace forgejo has none, checked
rather than assumed.

tests/object-store-consumers.sh is new and deliberately a CLASS guard rather
than a forgejo one, so the next repointed consumer is covered the day it lands.
Four rules, each of which this migration has already paid for: no MinIO
endpoint, never the headless Service, an explicit :9000 because RustFS has no
port-80 listener and MinIO answered on 80, and a credential source that
followed the endpoint. It reads a comment-stripped copy, because these files
quote the forbidden forms to explain them and a raw match fires on the
explanation. Four negative controls, each confirmed red.

The port check counts rather than refuting. `! grep` as a bare statement never
fails a script, and tests/refutations-are-effective.sh refuses the pattern
outright rather than judging which uses are safe -- it caught this one on the
first full run, which is the guard doing its job.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 1c1a37e845 into trunk

2026-09-09 18:48:44 +00:00

Rows
Columns

feat(forgejo): serve attachments and LFS from RustFS #502