Deployment Overview of RustFS on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

• Operating System: Ubuntu.

• Privileges: Root or sudo access is required for package installation and Docker management.

• Network/Ports:

• 80 (HTTP) for Let's Encrypt challenges and redirection.

• 443 (HTTPS) for secure web console and S3 API access.

• Dependencies: The system must have curl and ca-certificates installed.

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain generated based on the server ID.

File and Directory Structure¶

The application uses the following directory structure for configuration and data persistence:

• /root/rustfs: Application installation directory containing the Docker Compose file and environment variables.

• /data/rustfs: Data storage directory where S3 objects are stored (managed by user 10001).

• /root/nginx: Configuration directory for the reverse proxy.

• /data/nginx: Nginx configuration files and SSL certificate management data.

Application installation process¶

The installation is performed through a multi-step process involving system preparation and container orchestration:

1. System Preparation: The system cleans up existing Docker repository sources to prevent conflicts and ensures ca-certificates and curl are present.

2. Docker Installation: The Docker engine is installed on the host system.

3. Application Setup:

4. A directory for RustFS is created at /root/rustfs.

5. An environment file (.env) is generated containing the RUSTFS_ACCESS_KEY and a secure secret key.

6. The application deployment configuration (Docker Compose) is prepared in /root/rustfs/compose.yml.

7. Reverse Proxy Setup:

8. Nginx directories are initialized for SSL management via Certbot.

9. A reverse proxy configuration is generated to handle HTTPS termination and routing between the web console and the S3 API.

Access Rights and Security¶

• Firewall: If UFW (Uncomplicated Firewall) is active, ports 80/tcp and 443/tcp are automatically allowed.

• Container Security: The RustFS container is configured with no-new-privileges:true to restrict privilege escalation.

• User Permissions: Data stored in /data/rustfs is owned by UID 10001 to match the application's internal user requirements.

Databases¶

This application does not utilize a separate database server; it manages object storage directly within the configured data directory.

Docker Containers and Their Deployment¶

The deployment consists of two primary container services:

RustFS Service¶

• Image: docker.io/rustfs/rustfs:1.0.0

• Container Name: rustfs

• Ports:

• 127.0.0.1:{9000}:{9000} (S3 and Admin API)

• 127.0.0.1:{9001}:{9001} (Web Console)

• Volumes: /data/rustfs mapped to /data.

• Environment Variables:

• RUSTFS_VOLUMES=/data

• RUSTFS_ADDRESS=0.0.0.0:9000

• RUSTFS_CONSOLE_ENABLE=true

• RUSTFS_CONSOLE_ADDRESS=0.0.0.0:9001

• Restart Policy: unless-stopped

Nginx Proxy Service¶

• Image: jonasal/nginx-certbot:6.2.0-nginx1.31.0

• Network Mode: host

• Volumes:

• nginx_secrets (external volume) mapped to /etc/letsencrypt.

• /data/nginx/user_conf.d mapped to /etc/nginx/user_conf.d.

• /data/nginx/letsencrypt mapped to /var/www/letsencrypt.

• Restart Policy: unless-stopped

Application Update Instructions¶

To update the main RustFS application, navigate to the installation directory and pull the latest images:

cd /root/rustfs
docker compose pull && docker compose up -d

Location of configuration files and data¶

Available ports for connection¶

• Web Console: 443 (via HTTPS)

• S3 API: 443 (via HTTPS)

Starting and Stopping the application¶

The application is managed via Docker Compose from the installation directory.

To start the application:

cd /root/rustfs && docker compose up -d

To stop the application:

cd /root/rustfs && docker compose down

Proxy Servers¶

The deployment utilizes an Nginx container with Certbot integration to provide SSL termination.

• SSL: Certificates are managed via Let's Encrypt. The renewal interval is set to 8 days.

• Routing Logic:

• Requests to the root path (/) are redirected to the web console at /rustfs/console/.

• Traffic for /rustfs/console/ is proxied to the internal Web Console port.

• All other traffic (S3 API requests) is proxied to the internal API port.