Migrate Manyangles object storage to DigitalOcean Spaces

2026-09-11 17:41:11 -04:00
parent 2db2ab6638
commit 32e56b1c34
3 changed files with 91 additions and 8 deletions
@@ -2,6 +2,30 @@

 ## Coolify on one VM

+### Current Manyangles storage
+
+`compose.coolify.yml` uses the private Spaces bucket `hltma` in `nyc3` for
+web/worker storage. Set `SPACES_ACCESS_KEY` and `SPACES_SECRET_KEY` in Coolify;
+never commit their values. The endpoint is `https://nyc3.digitaloceanspaces.com`
+and virtual-host addressing is enabled. Configure bucket CORS separately for
+`https://ma.hadlock.tech` (GET/PUT/HEAD, allowed headers `*`, exposed headers
+ETag/Content-Length). The bucket-scoped object key cannot administer these rules.
+
+Garage and its initializer/volumes remain in the stack for migration rollback.
+Do not remove them until the migration and a recovery path are verified. Do not
+blindly roll back after new uploads reach Spaces: synchronize those objects back
+first. Bucket lifecycle must also be configured separately (expire `exports/`
+after one day; never expire originals). The worker performs export cleanup too.
+
+For the initial migration, `scripts/copy-to-spaces.ts` runs in the old worker's
+storage package directory, receiving the two Spaces secrets as JSON on stdin.
+It preserves object paths and verifies SHA-256, refusing differing existing
+objects. It does not delete anything or perform the live cutover. Pause web
+writes, allow the ten-minute signed-upload lifetime to expire and any in-flight
+transfers to finish, drain workers, then repeat the copy before deploying.
+
+### Original Garage setup (retained for reference)
+
 Use the repository Docker Compose build pack and `/compose.coolify.yml`.
 This adds isolated Postgres and Garage volumes, migrations, and a one-shot
 storage initializer (exact-origin CORS, one-day export expiry and abandoned