S3 object storage on serverplus

Object storage is a place for files you access over HTTP rather than as a disk. You put objects (files) into "buckets", and each object is available by its key. On serverplus it is S3-compatible, so it works with all the usual tools: aws-cli, rclone, boto3 and other SDKs.

When to use it

• Backups and archives — DB dumps, snapshots, logs; stored separately from servers.
• Media and user uploads — images, video, documents for a web app.
• Static assets and file delivery — site assets, distributions, reports.
• Data exchange between services and for large volumes that are awkward to keep on a server disk.

If you need a filesystem your app writes to like a local disk, that's a volume (Cinder), not object storage. Object storage is about "put/get a file by key".

1. Endpoint, bucket and keys

A single connection address (compatible with Amazon S3, supports the standard S3 API):

https://object-store.serverplus.uz

Create a bucket: in the cloud.serverplus.uz panel open "Object storage" → "Create bucket", set a unique name and the access type — private (for internal data) or public. Once created, the bucket is available via the S3 API.

Get keys: the "Access" → "S3/EC2 credentials" section → create an ACCESS_KEY + SECRET_KEY pair. They are used to connect via the API, CLI and applications.

S3 keys are access to your files. Don't put SECRET_KEY in public code, keep it like a password, create separate keys for different services and revoke unused ones. Use private buckets for internal data.

2. Configuring aws-cli

aws configure
# AWS Access Key ID:     <access key>
# AWS Secret Access Key: <secret>
# Default region name:   us-east-1
# Default output format: json

# path-style addressing for S3-compatible storage
aws configure set default.s3.addressing_style path

To avoid repeating the endpoint address, an alias is handy:

alias s3='aws --endpoint-url https://object-store.serverplus.uz s3'

3. Basic operations

s3 mb s3://my-bucket                 # create a bucket
s3 cp report.pdf s3://my-bucket/     # upload a file
s3 sync ./site s3://my-bucket/site/  # sync a directory
s3 ls s3://my-bucket/                # list objects
s3 cp s3://my-bucket/report.pdf .    # download
s3 rm s3://my-bucket/report.pdf      # delete

4. From code: Python (boto3)

import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://object-store.serverplus.uz",
    aws_access_key_id="<access key>",
    aws_secret_access_key="<secret>",
    region_name="us-east-1",
)

s3.upload_file("photo.jpg", "my-bucket", "images/photo.jpg")

for obj in s3.list_objects_v2(Bucket="my-bucket").get("Contents", []):
    print(obj["Key"], obj["Size"])

5. rclone: sync and mount

rclone is convenient for regular sync and even mounting a bucket as a folder. Config ~/.config/rclone/rclone.conf:

[sp]
type = s3
provider = Other
access_key_id = <access key>
secret_access_key = <secret>
endpoint = https://object-store.serverplus.uz

rclone sync ./data sp:my-bucket/data     # sync
rclone ls sp:my-bucket                    # list
rclone mount sp:my-bucket /mnt/s3 &        # mount as a folder

6. Versioning and lifecycle

To protect against accidental overwrites and clean up old data automatically:

# enable bucket versioning
aws --endpoint-url https://object-store.serverplus.uz \
  s3api put-bucket-versioning --bucket my-bucket \
  --versioning-configuration Status=Enabled

• Versioning keeps previous versions of objects — you can roll back an overwrite or a deletion.
• Lifecycle rules automatically delete or archive objects older than N days — handy for logs and backups.

7. Large files

aws-cli and rclone upload large objects in parts (multipart) automatically — more reliable: on an interruption only the failed part is re-uploaded. Usually no extra configuration is needed.

8. Public access and temporary links

By default objects are private. To grant access to a file without exposing the bucket, use a presigned URL — a temporary signed link:

s3 presign s3://my-bucket/report.pdf --expires-in 3600
# returns a link valid for 1 hour

Don't make a bucket public unless you need to. Public access is fine for site static, but for private files use temporary links rather than "open to everyone".

9. Common scenarios

• Backups: DB dumps and archives on a schedule (see the "Backup strategy" article).
• App upload storage: user images and files — the server doesn't grow, files are served by links.
• Static delivery: assets and distributions, behind a CDN if needed.
• Moving large volumes between servers (faster than direct copying).

Security

• Separate keys, least privilege. Each app gets its own S3 keys; revoke unused ones, rotate periodically.
• Private by default. Public access only deliberately; for temporary access use a presigned URL.
• HTTPS and encryption. Work only through the https endpoint; encrypt sensitive data before uploading.
• Versioning as protection against accidental and malicious deletion.

FAQ

SignatureDoesNotMatch error. Usually a wrong secret, a clock skew on the client, or the wrong endpoint/region. Check the keys, the time and the address.

Access Denied when reaching a bucket. Either the keys are from a different project, or they lack permissions on this bucket. Check which key you're using and the access policy.

The client can't find the bucket / odd addressing errors. Enable path-style: aws configure set default.s3.addressing_style path (or the equivalent option in the SDK/rclone).

What is the serverplus endpoint address? https://object-store.serverplus.uz — the single S3-compatible endpoint. You pass it to the client as --endpoint-url (or the endpoint field in an SDK/rclone).