first commit

local/storage-init.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+case "$S3_BUCKET" in *[!a-z0-9.-]*|'') echo 'Invalid local bucket name' >&2; exit 1;; esac
+if [ "$MINIO_ROOT_USER" = "$S3_APP_USER" ]; then echo 'Runtime storage user must not be root' >&2; exit 1; fi
+# Disposable local secrets are passed via environment, never traced/logged.
+mc alias set local http://storage:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null
+mc mb --ignore-existing "local/$S3_BUCKET" >/dev/null
+mc anonymous set none "local/$S3_BUCKET" >/dev/null
+mc admin user add local "$S3_APP_USER" "$S3_APP_PASSWORD" >/dev/null
+# Use shell builtins only: the minimal MinIO image does not ship sed/cat.
+policy=''
+while IFS= read -r line || [ -n "$line" ]; do
+  while [ "${line#*dtf-local-artwork}" != "$line" ]; do
+    policy="$policy${line%%dtf-local-artwork*}$S3_BUCKET"
+    line=${line#*dtf-local-artwork}
+  done
+  policy="$policy$line
+"
+done < /policy.json
+printf '%s' "$policy" > /tmp/policy.json
+mc admin policy create local dtf-artwork /tmp/policy.json >/dev/null
+mc admin policy attach local dtf-artwork --user "$S3_APP_USER" >/dev/null
+mc ilm import "local/$S3_BUCKET" < /lifecycle.json
+echo 'Local storage runtime account provisioned.'