🔧(compose) replace MinIO by Garage for local development

The development stacks now run Garage instead of MinIO which is deprecated. Garage is a bit stricter than MinIO: - key IDs and secrets must be at least 8 and 16 characters long - requests must be signed for its region, so every development env now sets AWS_S3_REGION_NAME=local; - cross-origin requests are denied unless the bucket CORS rules allow them, so a one-shot aws-cli container allows the frontend origin to upload files straight to the bucket.
2026-10-01 05:55:11 +02:00 · 2026-09-29 10:52:49 +02:00
parent 62a2515c6b
commit 3f9942a61d
22 changed files with 293 additions and 210 deletions
@@ -226,8 +226,9 @@ jobs:
      REDIS_URL: redis://localhost:6379/1
      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
      AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet
-      AWS_S3_SECRET_ACCESS_KEY: password
+      AWS_S3_ACCESS_KEY_ID: meet-access-key
+      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
+      AWS_S3_REGION_NAME: local
      OIDC_RS_CLIENT_ID: meet
      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
@@ -250,34 +251,22 @@ jobs:
          path: "src/backend/core/templates/mail"
          key: mail-templates-${{ hashFiles('src/mail/mjml') }}

-      - name: Start MinIO
+      # Creates the access key and the bucket on startup
+      - name: Start Garage
        run: |
-          docker pull quay.io/minio/minio
-          docker run -d --name minio \
+          docker run -d --name garage \
            -p 9000:9000 \
-            -e "MINIO_ACCESS_KEY=meet" \
-            -e "MINIO_SECRET_KEY=password" \
-            -v /data/media:/data \
-            quay.io/minio/minio server --console-address :9001 /data
+            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
+            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
+            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
+            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
+            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
+            dxflrs/garage:v2.4.1 \
+            /garage server --single-node --default-bucket

-      # Tool to wait for a service to be ready
-      - name: Install Dockerize
+      - name: Wait for Garage to be ready
        run: |
-          curl --proto "=https" --proto-redir "=https" --tlsv1.2 -sSLf \
-            https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz |
-            sudo tar -C /usr/local/bin -xzv
-
-      - name: Wait for MinIO to be ready
-        run: |
-          dockerize -wait tcp://localhost:9000 -timeout 10s
-
-      - name: Configure MinIO
-        run: |
-          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
-          docker exec ${MINIO} sh -c \
-            "mc alias set meet http://localhost:9000 meet password && \
-            mc alias ls && \
-            mc mb meet/meet-media-storage"
+          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'

      - name: Install Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
@@ -310,9 +299,9 @@ jobs:
    env:
      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "minio:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet"
-      AWS_S3_SECRET_ACCESS_KEY: "password"
+      AWS_S3_ENDPOINT_URL: "garage:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
+      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
      WHISPERX_BASE_URL: "https://configure-your-url.com"
      WHISPERX_ASR_MODEL: "large-v2"
      WHISPERX_API_KEY: "test-whisperx-secret"
@@ -41,6 +41,7 @@ and this project adheres to
 - 🔖(helm) release chart 0.0.28
 - ♻️(backend) decouple recording event handling from LiveKit egress statuses
 - ♻️(agents) replace the minio client by boto3
+- 🔧(compose) replace MinIO by Garage for local development

 ### Fixed

@@ -85,6 +85,7 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
+	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
@@ -317,6 +318,10 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret

+env.d/development/garage:
+	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
+		env.d/development/garage.dist > env.d/development/garage
+
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber

@@ -104,8 +104,8 @@ k8s_yaml(secret_yaml_generic(

 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))

-k8s_resource('minio-bucket', resource_deps=['minio'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
+k8s_resource('garage-cors', resource_deps=['garage'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
@@ -15,36 +15,44 @@ services:
    ports:
      - "1081:1080"

-  minio:
+  garage:
    user: ${DOCKER_USER:-1000}
-    image: quay.io/minio/minio
+    image: dxflrs/garage:v2.4.1
+    command: /garage server --single-node --default-bucket
+    env_file:
+      - env.d/development/garage
    environment:
-      - MINIO_ROOT_USER=meet
-      - MINIO_ROOT_PASSWORD=password
+      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
+      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
+      - GARAGE_DEFAULT_BUCKET=meet-media-storage
    ports:
-      - '9000:9000'
-      - '9001:9001'
+      - '127.0.0.1:9000:9000'
    healthcheck:
-      test: [ "CMD", "mc", "ready", "local" ]
+      test: [ "CMD", "/garage", "health" ]
      interval: 1s
      timeout: 20s
      retries: 300
-    entrypoint: ""
-    command: minio server --console-address :9001 /data
    volumes:
-      - ./data/media:/data
+      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
+      - ./data/media:/var/lib/garage

-  createbuckets:
-    image: quay.io/minio/mc
+  # Garage denies cross-origin requests by default: allow the frontend to upload files
+  garage-cors:
+    image: amazon/aws-cli:2.37.1
+    environment:
+      - AWS_ACCESS_KEY_ID=meet-access-key
+      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
+      - AWS_DEFAULT_REGION=local
    depends_on:
-      minio:
+      garage:
        condition: service_healthy
        restart: true
-    entrypoint: >
-      sh -c "
-      /usr/bin/mc alias set meet http://minio:9000 meet password && \
-      /usr/bin/mc mb meet/meet-media-storage && \
-      exit 0;"
+    command:
+      - s3api
+      - put-bucket-cors
+      - --endpoint-url=http://garage:9000
+      - --bucket=meet-media-storage
+      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'

  app-dev:
    build:
@@ -70,7 +78,7 @@ services:
        - postgresql
        - mailcatcher
        - redis
-        - createbuckets
+        - garage-cors
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
@@ -110,7 +118,7 @@ services:
      - postgresql
      - redis
      - livekit
-      - minio
+      - garage

  celery:
    user: ${DOCKER_USER:-1000}
@@ -244,7 +252,7 @@ services:
      - /app/.venv
    depends_on:
      - livekit
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -297,7 +305,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -317,7 +325,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - minio
+      - garage
    develop:
      watch:
        - action: rebuild
@@ -163,7 +163,7 @@ in
      REDIS_URL = "redis://127.0.0.1:6379/1";
      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";

-      # S3 / MinIO
+      # S3 / Garage
      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";

      # OIDC
@@ -19,7 +19,7 @@ services:
    <<: *keep-id
  celery-dev:
    <<: *keep-id
-  minio:
+  garage:
    <<: *keep-id
  node:
    <<: *keep-id
@@ -0,0 +1,15 @@
+# Garage configuration for local development only: single node, no replication.
+# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+db_engine = "lmdb"
+
+replication_factor = 1
+
+rpc_bind_addr = "127.0.0.1:3901"
+rpc_public_addr = "127.0.0.1:3901"
+
+[s3_api]
+api_bind_addr = "[::]:9000"
+# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+s3_region = "local"
@@ -17,9 +17,9 @@ server {
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;

-        # Get resource from Minio
-        proxy_pass http://minio:9000/meet-media-storage/;
-        proxy_set_header Host minio:9000;
+        # Get resource from Garage
+        proxy_pass http://garage:9000/meet-media-storage/;
+        proxy_set_header Host garage:9000;
        # To use with ds_proxy
        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
        # proxy_set_header Host ds-proxy:4444;
@@ -13,7 +13,7 @@ These components rely on a few key services:

 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
- MinIO for storing files (room recordings)
+- Garage for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)

 We provide two stack options for getting Visio up and running for development:
@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |

-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.


 ## Software Requirements
@@ -24,9 +24,10 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=http://garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True

@@ -0,0 +1,2 @@
+# Filled with a random value by `make create-env-files`
+GARAGE_RPC_SECRET=
@@ -2,8 +2,9 @@ LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret

-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local
 AWS_STORAGE_BUCKET_NAME=meet-media-storage
 AWS_S3_SECURE_ACCESS=False
@@ -1,6 +1,7 @@
-AWS_S3_ENDPOINT_URL=minio:9000
-AWS_S3_ACCESS_KEY_ID=meet
-AWS_S3_SECRET_ACCESS_KEY=password
+AWS_S3_ENDPOINT_URL=garage:9000
+AWS_S3_ACCESS_KEY_ID=meet-access-key
+AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
+AWS_S3_REGION_NAME=local

 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
@@ -2,11 +2,12 @@ APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"

 AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="minio:9000"
+AWS_S3_ENDPOINT_URL="garage:9000"
 AWS_S3_SECURE_ACCESS=false

-AWS_S3_ACCESS_KEY_ID="meet"
-AWS_S3_SECRET_ACCESS_KEY="password"
+AWS_S3_ACCESS_KEY_ID="meet-access-key"
+AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
+AWS_S3_REGION_NAME="local"

 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"
@@ -117,14 +117,14 @@ def test_api_files_create_file_authenticated_success():
    policy_parsed = urlparse(policy)

    assert policy_parsed.scheme == "http"
-    assert policy_parsed.netloc in ["minio:9000", "localhost:9000"]
+    assert policy_parsed.netloc in ["garage:9000", "localhost:9000"]
    assert policy_parsed.path == f"/meet-media-storage/tmp/files/{file.id!s}.png"

    query_params = parse_qs(policy_parsed.query)

    assert query_params.pop("X-Amz-Algorithm") == ["AWS4-HMAC-SHA256"]
    assert query_params.pop("X-Amz-Credential") == [
-        f"meet/{now.strftime('%Y%m%d')}/us-east-1/s3/aws4_request"
+        f"meet-access-key/{now.strftime('%Y%m%d')}/local/s3/aws4_request"
    ]
    assert query_params.pop("X-Amz-Date") == [now.strftime("%Y%m%dT%H%M%SZ")]
    assert query_params.pop("X-Amz-Expires") == ["60"]
@@ -24,10 +24,11 @@ _summaryEnvVars: &summaryEnvVars
  APP_NAME: summary-microservice
  APP_API_TOKEN: password
  AWS_STORAGE_BUCKET_NAME: meet-media-storage
-  AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
-  AWS_S3_ACCESS_KEY_ID: meet
-  AWS_S3_SECRET_ACCESS_KEY: password
+  AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000/
+  AWS_S3_ACCESS_KEY_ID: meet-access-key
+  AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
  AWS_S3_SECURE_ACCESS: False
+  AWS_S3_REGION_NAME: local
  AUTHORIZED_TENANTS: >
    [
      {
@@ -161,9 +162,9 @@ backend:
    FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
    FRONTEND_IS_SILENT_LOGIN_ENABLED: False
    # S3 Storage
-    AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: http://garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    # Telephony
    ROOM_TELEPHONY_ENABLED: True
@@ -180,7 +181,7 @@ backend:
    # Custom Background
    AWS_S3_REGION_NAME: local
    AWS_S3_SIGNATURE_VERSION: s3v4
-    AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
+    AWS_S3_DOMAIN_REPLACE: https://garage.127.0.0.1.nip.io
    MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
    FILE_UPLOAD_ENABLED: True
    CELERY_ENABLED: True
@@ -264,11 +265,11 @@ ingressMedia:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1

 serviceMedia:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000

 # ---- Extra ingress/service for background file uploads ------------
@@ -280,11 +281,11 @@ ingressMediaFiles:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
-    nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
+    nginx.ingress.kubernetes.io/upstream-vhost: garage.meet.svc.cluster.local:9000
    nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1

 serviceMediaFiles:
-  host: minio.meet.svc.cluster.local
+  host: garage.meet.svc.cluster.local
  port: 9000

 # ---- STT Orchestration Microservice Components --------------------
@@ -362,10 +363,11 @@ agentMetadata:
    {{- end }}
    {{- end }}
    ENABLE_SILERO_VAD: "false"
-    AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
-    AWS_S3_ACCESS_KEY_ID: meet
-    AWS_S3_SECRET_ACCESS_KEY: password
+    AWS_S3_ENDPOINT_URL: garage.meet.svc.cluster.local:9000
+    AWS_S3_ACCESS_KEY_ID: meet-access-key
+    AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
    AWS_S3_SECURE_ACCESS: False
+    AWS_S3_REGION_NAME: local
    AWS_STORAGE_BUCKET_NAME: meet-media-storage
    AWS_S3_OUTPUT_FOLDER: metadata

@@ -16,11 +16,11 @@ egress:
    address: redis-master:6379
    password: pass
  s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
    region: local
    bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
    force_path_style: true

 loadBalancer:
@@ -19,11 +19,11 @@ egress:
    address: redis-master:6379
    password: pass
  s3:
-    access_key: meet
-    secret: password
+    access_key: meet-access-key
+    secret: meet-secret-access-key
    region: local
    bucket: meet-media-storage
-    endpoint: http://minio:9000
+    endpoint: http://garage:9000
    force_path_style: true

 loadBalancer:
@@ -0,0 +1,172 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: garage
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 10m
+spec:
+  rules:
+  - host: "garage.127.0.0.1.nip.io"
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: garage
+            port:
+              number: 9000
+  tls:
+  - hosts:
+    - garage.127.0.0.1.nip.io
+    secretName: meet-tls
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  ports:
+  - name: client
+    port: 9000
+    protocol: TCP
+    targetPort: 9000
+  selector:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: garage-config
+  namespace: {{ .Release.Namespace | quote }}
+data:
+  garage.toml: |
+    metadata_dir = "/var/lib/garage/meta"
+    data_dir = "/var/lib/garage/data"
+    db_engine = "lmdb"
+
+    replication_factor = 1
+
+    rpc_bind_addr = "127.0.0.1:3901"
+    rpc_public_addr = "127.0.0.1:3901"
+
+    [s3_api]
+    api_bind_addr = "[::]:9000"
+    # Clients must sign their requests for this region (AWS_S3_REGION_NAME)
+    s3_region = "local"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: garage-dev
+  namespace: {{ .Release.Namespace | quote }}
+type: Opaque
+data:
+  GARAGE_RPC_SECRET: {{ printf "%s/garage-rpc-secret" .Release.Namespace | sha256sum | b64enc }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: garage
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app.kubernetes.io/instance: extra
+    app.kubernetes.io/name: garage
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: extra
+      app.kubernetes.io/name: garage
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: extra
+        app.kubernetes.io/name: garage
+    spec:
+      containers:
+      - name: garage
+        command:
+          - /garage
+          - server
+          - --single-node
+          - --default-bucket
+        env:
+          - name: GARAGE_RPC_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: garage-dev
+                key: GARAGE_RPC_SECRET
+          - name: GARAGE_DEFAULT_ACCESS_KEY
+            value: meet-access-key
+          - name: GARAGE_DEFAULT_SECRET_KEY
+            value: meet-secret-access-key
+          - name: GARAGE_DEFAULT_BUCKET
+            value: meet-media-storage
+        image: "dxflrs/garage:v2.4.1"
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9000
+          name: client
+        readinessProbe:
+          exec:
+            command:
+              - /garage
+              - health
+        volumeMounts:
+        - mountPath: /etc/garage.toml
+          name: config
+          subPath: garage.toml
+        - mountPath: /var/lib/garage
+          name: data
+      volumes:
+      - name: config
+        configMap:
+          name: garage-config
+      - name: data
+        emptyDir:
+---
+# Garage denies cross-origin requests by default: allow the frontend to upload
+# files straight to the bucket
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: garage-cors
+spec:
+  template:
+    spec:
+      containers:
+      - name: aws-cli
+        image: amazon/aws-cli:2.37.1
+        env:
+          - name: AWS_ACCESS_KEY_ID
+            value: meet-access-key
+          - name: AWS_SECRET_ACCESS_KEY
+            value: meet-secret-access-key
+          - name: AWS_DEFAULT_REGION
+            value: local
+          - name: AWS_ENDPOINT_URL
+            value: http://garage:9000
+          - name: BUCKET
+            value: meet-media-storage
+        command:
+          - /bin/sh
+          - -c
+          - |
+            deadline=$(($(date +%s) + 300))
+            until aws s3api head-bucket --bucket="$BUCKET" --cli-connect-timeout=5; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "Bucket $BUCKET still unavailable on $AWS_ENDPOINT_URL" >&2
+                exit 1
+              fi
+              echo "Waiting for bucket $BUCKET on $AWS_ENDPOINT_URL"
+              sleep 5
+            done
+            exec aws s3api put-bucket-cors --bucket="$BUCKET" \
+              --cors-configuration='{"CORSRules": [{"AllowedOrigins": ["https://meet.127.0.0.1.nip.io"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+      restartPolicy: Never
+  backoffLimit: 3
@@ -1,115 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: minio
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-spec:
-  rules:
-  - host: "minio.127.0.0.1.nip.io"
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: minio
-            port:
-              number: 9000
-  tls:
-  - hosts:
-    - minio.127.0.0.1.nip.io
-    secretName: meet-tls
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-spec:
-  ports:
-  - name: client
-    port: 9000
-    protocol: TCP
-    targetPort: 9000
-  - name: console
-    port: 9001
-    protocol: TCP
-    targetPort: 9001
-  selector:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: minio
-  namespace: {{ .Release.Namespace | quote }}
-  labels:
-    app.kubernetes.io/instance: extra
-    app.kubernetes.io/name: minio
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: extra
-      app.kubernetes.io/name: minio
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: extra
-        app.kubernetes.io/name: minio
-    spec:
-      containers:
-      - name: minio
-        command:
-          - /bin/sh
-          - -c
-          - |
-            minio server --console-address :9001 /data
-        env:
-          - name: MINIO_ROOT_USER
-            value: meet
-          - name: MINIO_ROOT_PASSWORD
-            value: password
-        image: "quay.io/minio/minio"
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9000
-          name: client
-        - containerPort: 9001
-          name: console
-        volumeMounts:
-        - mountPath: /data
-          name: data
-        - mountPath: /etc/ssl/certs/mkcert-ca.pem
-          name: mkcert
-          subPath: rootCA.pem
-      volumes:
-      - name: data
-        emptyDir:
-      - name: mkcert
-        secret:
-          secretName: mkcert
---
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: minio-bucket
-spec:
-  template:
-    spec:
-      containers:
-      - name: mc
-        image: quay.io/minio/mc
-        command:
-          - /bin/sh
-          - -c
-          - |
-            /usr/bin/mc alias set meet http://minio:9000 meet password && \
-            /usr/bin/mc mb meet/meet-media-storage && \
-            exit 0
-      restartPolicy: Never
-  backoffLimit: 3