From 31d2960571e2adb59b08ea9795594610d0f31035 Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Mon, 31 Aug 2026 02:52:50 +0200
Subject: [PATCH] feat(hephaestus): enable Sia storage backend for cold blobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flip LFS, attachments, packages, and repo-archive stores from local disk
to the 'hephaestus' bucket via s3.silentmode.st:8600 s3d gateway. Cert
there is a real LE cert (CN=navigate.st) that Go's minio driver trusts —
no skip-verify needed. Live git repos + Postgres stay on local SSD;
this only moves cold blobs onto Sia hosts.

Verified live: write→read→delete round-trip on the bucket, plus
Forgejo's own startup log confirming minio init for each store.
---
 docker-compose.yml | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 7c2dee8..f9cc8ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -62,11 +62,27 @@ services:
       FORGEJO__security__SECRET_KEY: ${FORGEJO_SECRET_KEY}
       FORGEJO__security__INTERNAL_TOKEN: ${FORGEJO_INTERNAL_TOKEN}
       FORGEJO__oauth2__JWT_SECRET: ${FORGEJO_OAUTH_JWT_SECRET}
-      # --- Storage backend: local disk for MVP ---
-      # sia.storage as S3 backend is deferred until the endpoint TLS cert chains cleanly
-      # (currently requires --no-verify-ssl which Forgejo's minio driver won't accept).
-      # Storage-on-disk works; the switch back to S3 is a config change only, no rebuild.
-      # (defaults to local — no MINIO_* env vars needed)
+      # --- Storage backend: Sia via silentmode.st's s3d (public endpoint on port 8600) ---
+      # Cert is a real LE cert issued to navigate.st (with SAN for s3.silentmode.st);
+      # Go's default TLS chain trusts it fine. No skip-verify needed.
+      # The 'hephaestus' bucket was pre-created on the 'sync' account.
+      # Path prefixes keep repos/LFS/attachments/packages/archives separated within the bucket.
+      FORGEJO__storage__MINIO_ENDPOINT: ${SIA_STORAGE_ENDPOINT}
+      FORGEJO__storage__MINIO_ACCESS_KEY_ID: ${SIA_STORAGE_ACCESS_KEY}
+      FORGEJO__storage__MINIO_SECRET_ACCESS_KEY: ${SIA_STORAGE_SECRET_KEY}
+      FORGEJO__storage__MINIO_BUCKET: ${SIA_STORAGE_BUCKET}
+      FORGEJO__storage__MINIO_LOCATION: us-east-1
+      FORGEJO__storage__MINIO_USE_SSL: "true"
+      FORGEJO__storage.lfs__STORAGE_TYPE: minio
+      FORGEJO__storage.lfs__MINIO_BASE_PATH: lfs/
+      FORGEJO__storage.attachments__STORAGE_TYPE: minio
+      FORGEJO__storage.attachments__MINIO_BASE_PATH: attachments/
+      FORGEJO__storage.packages__STORAGE_TYPE: minio
+      FORGEJO__storage.packages__MINIO_BASE_PATH: packages/
+      FORGEJO__storage.repo-archive__STORAGE_TYPE: minio
+      FORGEJO__storage.repo-archive__MINIO_BASE_PATH: archives/
+      # Live git repos still live on local disk under /data/git — S3 is only for LFS
+      # and other cold blobs. Never point [repository] itself at S3.
       # --- Quota (free tier: 500 MB per user) ---
       FORGEJO__quota__ENABLED: "true"
       FORGEJO__quota__DEFAULT_GROUPS: free