Replace MinIO root credentials with scoped service account for production S3 access #133

New Issue

marcel · 2026-03-28T08:40:30+01:00

marcel commented

2026-03-28 08:40:30 +01:00

Priority: medium — must be resolved before production deployment

docker-compose.yml configures the backend to use MinIO root credentials for S3 access (lines 97–98):

S3_ACCESS_KEY: ${MINIO_ROOT_USER}
S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD}

The application should never hold root/admin credentials. If the backend is compromised, an attacker gains full MinIO/S3 admin access.

What to do

In production (Hetzner Object Storage or MinIO):

Create a dedicated service account / access key scoped to only the archive-documents bucket (read + write, no admin operations).
Store the scoped credentials as secrets and inject them via environment variables:

S3_ACCESS_KEY=<scoped-service-account-key>
S3_SECRET_KEY=<scoped-service-account-secret>

For local dev and CI, the root credentials remain acceptable.

**Priority: medium — must be resolved before production deployment** `docker-compose.yml` configures the backend to use MinIO root credentials for S3 access (lines 97–98): ```yaml S3_ACCESS_KEY: ${MINIO_ROOT_USER} S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD} ``` The application should never hold root/admin credentials. If the backend is compromised, an attacker gains full MinIO/S3 admin access. ## What to do In production (Hetzner Object Storage or MinIO): 1. Create a dedicated service account / access key scoped to only the `archive-documents` bucket (read + write, no admin operations). 2. Store the scoped credentials as secrets and inject them via environment variables: ```bash S3_ACCESS_KEY=<scoped-service-account-key> S3_SECRET_KEY=<scoped-service-account-secret> ``` For local dev and CI, the root credentials remain acceptable.

marcel added the phase-1: security label 2026-03-28 08:51:23 +01:00

marcel added the devops label 2026-03-28 10:47:25 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: marcel/familienarchiv#133