mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
docs: rebrand the repository documentation, templates and dashboards
README, README_ZH, SECURITY, COMPLIANCE, CONTRIBUTING, NOTICE, code_of_conduct, the vulnerability and PR-etiquette documents, the GitHub issue and pull request templates, and the docs/ tree all present Silo as the product. The Grafana dashboards under docs/metrics/prometheus/grafana/ have their panel titles and descriptions rebranded while every minio_* query, label and expression is left alone, so existing alerts and recording rules keep matching. The distinction the review demanded is applied per hit rather than by search-and-replace: - Product and command text becomes Silo and silo: install and run instructions, systemd examples, compose services, download links, badges. - Protocol and interface text keeps MinIO: MINIO_* variables, minio_* metrics, x-minio-* headers, /minio/* routes, .minio.sys, arn:minio, and API field and error names. - Attribution keeps MinIO and gains the fork's own: the AGPL obligations, original copyright, CREDITS and NOTICE stay, with the modification notice added alongside rather than replacing them. - Historical and third-party references are left as facts, not rewritten for brand tidiness. README and README_ZH each carry an explicit non-affiliation notice, document the side-by-side package migration including the /etc/systemd/system/silo.service.d/10-legacy-user.conf drop-in for keeping a legacy UID/GID, and state that recursive chown is never performed. The trademark attribution uses the policy's approved "based on MinIO technology" wording, not the shortened form the policy rejects. github.com/pgsty/minio links are left in place and labelled transitional. The repository has not been renamed, and rewriting them now would produce documented URLs that 404 until the cutover; they change in the cutover commit together with the goreleaser release target, the OCI source label and the raw-content branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
+20
-20
@@ -1,23 +1,23 @@
|
||||
# How to secure access to MinIO server with TLS [](https://slack.min.io)
|
||||
# How to secure access to Silo server with TLS
|
||||
|
||||
This guide explains how to configure MinIO Server with TLS certificates on Linux and Windows platforms.
|
||||
This guide explains how to configure Silo Server with TLS certificates on Linux and Windows platforms.
|
||||
|
||||
1. [Install MinIO Server](#install-minio-server)
|
||||
2. [Use an Existing Key and Certificate with MinIO](#use-an-existing-key-and-certificate-with-minio)
|
||||
3. [Generate and use Self-signed Keys and Certificates with MinIO](#generate-use-self-signed-keys-certificates)
|
||||
1. [Install Silo Server](#install-minio-server)
|
||||
2. [Use an Existing Key and Certificate with Silo](#use-an-existing-key-and-certificate-with-minio)
|
||||
3. [Generate and use Self-signed Keys and Certificates with Silo](#generate-use-self-signed-keys-certificates)
|
||||
4. [Install Certificates from Third-party CAs](#install-certificates-from-third-party-cas)
|
||||
|
||||
## 1. Install MinIO Server
|
||||
## 1. Install Silo Server
|
||||
|
||||
Install MinIO Server using the instructions in the [MinIO Quickstart Guide](https://silo.pgsty.com/operations/deployments/baremetal-deploy-minio-on-redhat-linux/).
|
||||
Install Silo Server using the instructions in the [Silo Quickstart Guide](https://silo.pgsty.com/operations/deployments/baremetal-deploy-minio-on-redhat-linux/).
|
||||
|
||||
## 2. Use an Existing Key and Certificate with MinIO
|
||||
## 2. Use an Existing Key and Certificate with Silo
|
||||
|
||||
This section describes how to use a private key and public certificate that have been obtained from a certificate authority (CA). If these files have not been obtained, skip to [3. Generate Self-signed Certificates](#generate-use-self-signed-keys-certificates) or generate them with [Let's Encrypt](https://letsencrypt.org) using these instructions: [Generate Let's Encrypt certificate using Certbot for MinIO](https://silo.pgsty.com/integrations/generate-lets-encrypt-certificate-using-certbot-for-minio/). For more about TLS and certificates in MinIO, see the [Network Encryption documentation](https://silo.pgsty.com/operations/network-encryption/).
|
||||
This section describes how to use a private key and public certificate that have been obtained from a certificate authority (CA). If these files have not been obtained, skip to [3. Generate Self-signed Certificates](#generate-use-self-signed-keys-certificates) or generate them with [Let's Encrypt](https://letsencrypt.org) using these instructions: [Generate Let's Encrypt certificate using Certbot for Silo](https://silo.pgsty.com/integrations/generate-lets-encrypt-certificate-using-certbot-for-minio/). For more about TLS and certificates in Silo, see the [Network Encryption documentation](https://silo.pgsty.com/operations/network-encryption/).
|
||||
|
||||
Copy the existing private key and public certificate to the `certs` directory. The default certs directory is:
|
||||
|
||||
* **Linux:** `${HOME}/.minio/certs`
|
||||
* **Linux:** `${HOME}/.silo/certs`
|
||||
* **Windows:** `%%USERPROFILE%%\.minio\certs`
|
||||
|
||||
**Note:**
|
||||
@@ -26,7 +26,7 @@ Copy the existing private key and public certificate to the `certs` directory. T
|
||||
* Inside the `certs` directory, the private key must by named `private.key` and the public key must be named `public.crt`.
|
||||
* A certificate signed by a CA contains information about the issued identity (e.g. name, expiry, public key) and any intermediate certificates. The root CA is not included.
|
||||
|
||||
## 3. Generate and use Self-signed Keys and Certificates with MinIO
|
||||
## 3. Generate and use Self-signed Keys and Certificates with Silo
|
||||
|
||||
This section describes how to generate a self-signed certificate using various tools:
|
||||
|
||||
@@ -37,8 +37,8 @@ This section describes how to generate a self-signed certificate using various t
|
||||
|
||||
**Note:**
|
||||
|
||||
* MinIO only supports keys and certificates in PEM format on Linux and Windows.
|
||||
* MinIO doesn't currently support PFX certificates.
|
||||
* Silo only supports keys and certificates in PEM format on Linux and Windows.
|
||||
* Silo doesn't currently support PFX certificates.
|
||||
|
||||
### 3.1 Use `certgen` to Generate a Certificate
|
||||
|
||||
@@ -115,7 +115,7 @@ openssl genrsa -aes256 -passout pass:PASSWORD -out private.key 2048
|
||||
export MINIO_CERT_PASSWD=<PASSWORD>
|
||||
```
|
||||
|
||||
The default OpenSSL format for private encrypted keys is PKCS-8, but MinIO only supports PKCS-1. An RSA key that has been formatted with PKCS-8 can be converted to PKCS-1 using the following command:
|
||||
The default OpenSSL format for private encrypted keys is PKCS-8, but Silo only supports PKCS-1. An RSA key that has been formatted with PKCS-8 can be converted to PKCS-1 using the following command:
|
||||
|
||||
```sh
|
||||
openssl rsa -in private-pkcs8-key.key -aes256 -passout pass:PASSWORD -out private.key
|
||||
@@ -230,15 +230,15 @@ certtool.exe --generate-self-signed --load-privkey private.key --template cert.c
|
||||
|
||||
## 4. Install Certificates from Third-party CAs
|
||||
|
||||
MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by placing these certificates under one of the following MinIO configuration paths:
|
||||
Silo can connect to other servers, including Silo nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to Silo Server by placing these certificates under one of the following Silo configuration paths:
|
||||
|
||||
* **Linux:** `~/.minio/certs/CAs/`
|
||||
* **Linux:** `~/.silo/certs/CAs/`
|
||||
* **Windows**: `C:\Users\<Username>\.minio\certs\CAs`
|
||||
|
||||
## Explore Further
|
||||
|
||||
* [TLS Configuration for MinIO server on Kubernetes](https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes)
|
||||
* [MinIO Client Complete Guide](https://silo.pgsty.com/reference/minio-mc/)
|
||||
* [MinIO Network Encryption Overview](https://silo.pgsty.com/operations/network-encryption/)
|
||||
* [TLS Configuration for Silo server on Kubernetes](https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes)
|
||||
* [Silo Client Complete Guide](https://silo.pgsty.com/reference/minio-mc/)
|
||||
* [Silo Network Encryption Overview](https://silo.pgsty.com/operations/network-encryption/)
|
||||
* [Generate Let's Encrypt Certificate](https://silo.pgsty.com/integrations/generate-lets-encrypt-certificate-using-certbot-for-minio/)
|
||||
* [Setup nginx Proxy with MinIO Server](https://silo.pgsty.com/integrations/setup-nginx-proxy-with-minio/)
|
||||
* [Setup nginx Proxy with Silo Server](https://silo.pgsty.com/integrations/setup-nginx-proxy-with-minio/)
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
# How to secure access to MinIO on Kubernetes with TLS [](https://slack.min.io)
|
||||
# How to secure access to Silo on Kubernetes with TLS
|
||||
|
||||
This document explains how to configure MinIO server with TLS certificates on Kubernetes.
|
||||
This document explains how to configure Silo server with TLS certificates on Kubernetes.
|
||||
|
||||
## 1. Prerequisites
|
||||
|
||||
- Familiarity with [MinIO deployment process on Kubernetes](https://silo.pgsty.com/operations/deployments/kubernetes/).
|
||||
- Familiarity with [Silo deployment process on Kubernetes](https://silo.pgsty.com/operations/deployments/kubernetes/).
|
||||
|
||||
- Kubernetes cluster with `kubectl` configured.
|
||||
|
||||
- Acquire TLS certificates, either from a CA or [create self-signed certificates](https://silo.pgsty.com/operations/network-encryption/).
|
||||
|
||||
For a [distributed MinIO setup](https://silo.pgsty.com/operations/deployments/kubernetes/), where there are multiple pods with different domain names expected to run, you will either need wildcard certificates valid for all the domains or have specific certificates for each domain. If you are going to use specific certificates, make sure to create Kubernetes secrets accordingly.
|
||||
For a [distributed Silo setup](https://silo.pgsty.com/operations/deployments/kubernetes/), where there are multiple pods with different domain names expected to run, you will either need wildcard certificates valid for all the domains or have specific certificates for each domain. If you are going to use specific certificates, make sure to create Kubernetes secrets accordingly.
|
||||
|
||||
For testing purposes, here is [how to create self-signed certificates](https://github.com/pgsty/minio/tree/master/docs/tls#3-generate-self-signed-certificates).
|
||||
|
||||
@@ -60,12 +60,12 @@ Note that the `secretName` should be same as the secret name created in previous
|
||||
```yaml
|
||||
volumeMounts:
|
||||
- name: secret-volume
|
||||
mountPath: /<user-running-minio>/.minio/certs
|
||||
mountPath: /<user-running-silo>/.silo/certs
|
||||
```
|
||||
|
||||
Here the name of `volumeMount` should match the name of `volume` created previously. Also `mountPath` must be set to the path of
|
||||
the MinIO server's config sub-directory that is used to store certificates. By default, the location is
|
||||
`/<user-running-minio>/.minio/certs`.
|
||||
the Silo server's config sub-directory that is used to store certificates. By default, the location is
|
||||
`/<user-running-silo>/.silo/certs`.
|
||||
|
||||
*Tip*: In a standard Kubernetes configuration, this will be `/root/.minio/certs`. Kubernetes will mount the secrets volume read-only,
|
||||
so avoid setting `mountPath` to a path that MinIO server expects to write to.
|
||||
*Tip*: In a standard Kubernetes configuration, this will be `/root/.silo/certs`. Kubernetes will mount the secrets volume read-only,
|
||||
so avoid setting `mountPath` to a path that Silo server expects to write to.
|
||||
|
||||
Reference in New Issue
Block a user