Collaboration diagram for Bucket:

where the bytes come from. the scheme of the url picks the reader, so there is no type to set. url is the only key a bucket takes.

Bucket File

[bucket.assets]
url = "file://assets"     # relative to the working directory
url = "file:///srv/img"   # absolute

".." and a segment starting with "~" are refused.

Bucket Zip

a path may name a file inside an archive, as in /cdn/assets/pack.zip/logo.png, when allow_unzip is on. the archive is read once and kept in memory, so asking for a second picture out of it costs no fetch.

an entry larger than max_unzip, or one that expands more than two hundred times, is refused: real image data barely compresses, so anything near that is an attempt to spend memory rather than an archive.

Bucket Http

[bucket.upstream]
url = "https://host/prefix"   # everything under one prefix
url = "s3://s3.eu-west-1.amazonaws.com/bucket"   # signed, region from the host
url = "s3://minio.local:9000/bucket?region=us-east-1"   # or said outright
url = "https://*"             # open: the request names the host

redirects are followed, downgrades included. an open bucket fetches whatever host the caller names, warns at startup, and is meant for testing.

Bucket S3

an s3:// bucket is https with a signature. the region is settled while the config loads, from ?region= if it says so, else from an amazon host, else from AWS_DEFAULT_REGION. a bucket whose region nobody can work out is refused at startup rather than at the first request.

[bucket.orders]
url = "s3://bucket.s3.us-east-1.amazonaws.com/prefix"
access_key = "AKIA..."
secret_key = "..."
session_token = "..."   # only for temporary credentials

the keys may be left out, and then AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN are read instead. with neither the request goes out unsigned, which is what a public bucket wants.

a config holding a secret is a file worth guarding, and haio says so at startup if anybody but its owner can read it.

an s3 bucket cannot be open: a signature is made for one host, and there is nothing to sign for a host that arrives with the request.