Object Storage

Kinoder stores uploads, generated media, render outputs, thumbnails, font binaries, template covers, and temporary provider artifacts in private object storage.

Local development

The supplied Compose stack uses MinIO. Configure endpoint, port, TLS mode, access key, secret key, and bucket through the object-storage environment fields.

Production

Use a private S3-compatible service or the managed AWS storage configuration. Separate internal service access from browser-facing signed access when required by the network topology.

Invariants

• persisted records use stable object keys and asset IDs;
• browser object URLs and temporary signed URLs never enter project manifests;
• reads are short-lived and authorization-scoped;
• upload completion verifies size, content type, and where applicable binary signature;
• storage reservations protect quotas;
• retained project revisions can block deletion;
• backups cover private objects as well as PostgreSQL metadata.

IMAGE PLACEHOLDER - Storage administration Replace with the sanitized Kinoder storage-status screen and a private bucket lifecycle diagram. Recommended size: 1800 x 1000 px.

Rotate credentials through the supported administrator workflow and verify reads and writes before retiring the previous credential.