MinIO - S3-kompatibler Object Storage

MinIO ist ein hochperformanter S3-kompatibler Object Storage. Er ermöglicht selbstgehosteten Cloud-Storage für Backups, Medien und Anwendungsdaten.

Installation

Binary

# MinIO Server
wget https://dl.min.io/server/minio/release/linux-amd64/minio
chmod +x minio
mv minio /usr/local/bin/

# MinIO Client (mc)
wget https://dl.min.io/client/mc/release/linux-amd64/mc
chmod +x mc
mv mc /usr/local/bin/

Docker

docker run -d \
    --name minio \
    -p 9000:9000 \
    -p 9001:9001 \
    -v /data/minio:/data \
    -e MINIO_ROOT_USER=admin \
    -e MINIO_ROOT_PASSWORD=supersecret \
    minio/minio server /data --console-address ":9001"

Single-Node Setup

Starten

# Mit Umgebungsvariablen
export MINIO_ROOT_USER=admin
export MINIO_ROOT_PASSWORD=supersecret123

minio server /data --console-address ":9001"

Systemd-Service

# /etc/systemd/system/minio.service
[Unit]
Description=MinIO Object Storage
After=network.target

[Service]
User=minio
Group=minio
Environment="MINIO_ROOT_USER=admin"
Environment="MINIO_ROOT_PASSWORD=supersecret123"
ExecStart=/usr/local/bin/minio server /data --console-address ":9001"
Restart=always

[Install]
WantedBy=multi-user.target

useradd -r minio
mkdir /data
chown minio:minio /data
systemctl enable minio
systemctl start minio

Multi-Node Cluster

# 4-Node Cluster (auf jedem Node)
export MINIO_ROOT_USER=admin
export MINIO_ROOT_PASSWORD=supersecret123

minio server \
    http://minio{1...4}.example.de/data{1...4} \
    --console-address ":9001"

MinIO Client (mc)

Verbindung einrichten

# Alias erstellen
mc alias set myminio http://localhost:9000 admin supersecret123

# Verbindung testen
mc admin info myminio

Bucket-Operationen

# Bucket erstellen
mc mb myminio/mybucket

# Buckets auflisten
mc ls myminio

# Bucket-Info
mc stat myminio/mybucket

# Bucket löschen
mc rb myminio/mybucket
mc rb --force myminio/mybucket  # Mit Inhalt

Datei-Operationen

# Hochladen
mc cp file.txt myminio/mybucket/
mc cp -r folder/ myminio/mybucket/folder/

# Herunterladen
mc cp myminio/mybucket/file.txt ./
mc cp -r myminio/mybucket/folder/ ./

# Dateien auflisten
mc ls myminio/mybucket/

# Löschen
mc rm myminio/mybucket/file.txt
mc rm -r --force myminio/mybucket/folder/

Synchronisation

# Lokal zu MinIO
mc mirror /local/folder myminio/mybucket/folder

# MinIO zu lokal
mc mirror myminio/mybucket/folder /local/folder

# Kontinuierlich (Watch)
mc mirror --watch /local/folder myminio/mybucket/folder

Policies und Zugriff

User erstellen

# User anlegen
mc admin user add myminio appuser apppassword123

# User auflisten
mc admin user list myminio

# User löschen
mc admin user remove myminio appuser

Policies

# Eingebaute Policies
# readonly, readwrite, diagnostics, writeonly

# Policy zuweisen
mc admin policy attach myminio readwrite --user=appuser

# Custom Policy
mc admin policy create myminio mybucket-policy policy.json

// policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": ["arn:aws:s3:::mybucket/*"]
    }
  ]
}

Bucket Policy

# Public Read
mc anonymous set download myminio/mybucket

# Public Read/Write
mc anonymous set public myminio/mybucket

# Privat (Standard)
mc anonymous set none myminio/mybucket

Versionierung

# Versionierung aktivieren
mc version enable myminio/mybucket

# Status prüfen
mc version info myminio/mybucket

# Versionen auflisten
mc ls --versions myminio/mybucket/

# Bestimmte Version löschen
mc rm myminio/mybucket/file.txt --version-id=xxx

Lifecycle Rules

// lifecycle.json
{
  "Rules": [
    {
      "ID": "expire-old",
      "Status": "Enabled",
      "Filter": {"Prefix": "logs/"},
      "Expiration": {"Days": 30}
    },
    {
      "ID": "delete-old-versions",
      "Status": "Enabled",
      "Filter": {},
      "NoncurrentVersionExpiration": {"NoncurrentDays": 7}
    }
  ]
}

mc ilm import myminio/mybucket < lifecycle.json
mc ilm ls myminio/mybucket

Replikation

Site-to-Site

# Remote-Ziel konfigurieren
mc admin bucket remote add myminio/mybucket \
    http://admin:password@remote-minio:9000/mybucket \
    --service replication

# Replikation aktivieren
mc replicate add myminio/mybucket \
    --remote-bucket arn:minio:replication::xxx:mybucket

Verschlüsselung

Server-Side Encryption

# SSE-S3 (MinIO-managed)
mc cp --encrypt "myminio" file.txt myminio/mybucket/

# KMS konfigurieren (Vault)
export MINIO_KMS_KES_ENDPOINT=https://kes.example.de:7373
export MINIO_KMS_KES_KEY_FILE=/etc/minio/kes-client.key
export MINIO_KMS_KES_CERT_FILE=/etc/minio/kes-client.crt

Monitoring

Prometheus-Metriken

# Metriken-Endpoint
curl http://localhost:9000/minio/v2/metrics/cluster

# Prometheus-Konfiguration
- job_name: 'minio'
  metrics_path: /minio/v2/metrics/cluster
  static_configs:
    - targets: ['minio:9000']

Admin-Befehle

# Server-Info
mc admin info myminio

# Disk-Info
mc admin info myminio --disk

# Top-Statistiken
mc admin top myminio

TLS

Zertifikate

# Verzeichnis erstellen
mkdir -p ~/.minio/certs

# Zertifikate ablegen
cp public.crt ~/.minio/certs/
cp private.key ~/.minio/certs/

# Oder Let's Encrypt
certbot certonly --standalone -d minio.example.de
cp /etc/letsencrypt/live/minio.example.de/fullchain.pem ~/.minio/certs/public.crt
cp /etc/letsencrypt/live/minio.example.de/privkey.pem ~/.minio/certs/private.key

S3-API Nutzung

AWS CLI

aws configure
# Access Key: admin
# Secret Key: supersecret123
# Region: us-east-1

aws --endpoint-url http://localhost:9000 s3 ls
aws --endpoint-url http://localhost:9000 s3 cp file.txt s3://mybucket/

Python (boto3)

import boto3

s3 = boto3.client('s3',
    endpoint_url='http://localhost:9000',
    aws_access_key_id='admin',
    aws_secret_access_key='supersecret123'
)

# Bucket erstellen
s3.create_bucket(Bucket='mybucket')

# Datei hochladen
s3.upload_file('file.txt', 'mybucket', 'file.txt')

# Dateien auflisten
response = s3.list_objects(Bucket='mybucket')
for obj in response.get('Contents', []):
    print(obj['Key'])

Zusammenfassung

Fazit

MinIO bietet vollständige S3-Kompatibilität für selbstgehosteten Storage. Die Performance ist ausgezeichnet. Erasure Coding schützt vor Datenverlust. Die Web-Console vereinfacht die Verwaltung. Für Cloud-native Anwendungen ist MinIO eine starke Alternative zu AWS S3.