下载:
wget https://dl.min.io/server/minio/release/linux-amd64/minio

service 文件:
/usr/lib/systemd/system/minio.service

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
[Unit]
Description=MinIO
Wants=network-online.target
After=network-online.target
AssertFileIsExecutable=/usr/local/bin/minio

[Service]
WorkingDirectory=/usr/local

User=minio-user
Group=minio-user
ProtectProc=invisible

EnvironmentFile=-/etc/default/minio
ExecStartPre=/bin/bash -c "if [ -z \"${MINIO_VOLUMES}\" ]; then echo \"Variable MINIO_VOLUMES not set in /etc/default/minio\"; exit 1; fi"
ExecStart=/usr/local/bin/minio server $MINIO_OPTS $MINIO_VOLUMES

# MinIO RELEASE.2023-05-04T21-44-30Z adds support for Type=notify (https://www.freedesktop.org/software/systemd/man/systemd.service.html#Type=)
# This may improve systemctl setups where other services use `After=minio.server`
# Uncomment the line to enable the functionality
# Type=notify

# Let systemd restart this service always
Restart=always

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65536

# Specifies the maximum number of threads this process can create
TasksMax=infinity

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=infinity
SendSIGKILL=no

[Install]
WantedBy=multi-user.target

默认配置:
vim /etc/default/minio

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any resource in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice, regardless of environment

MINIO_ROOT_USER=xxx
MINIO_ROOT_PASSWORD=xxxx

# MINIO_VOLUMES sets the storage volume or path to use for the MinIO server.

MINIO_VOLUMES="/data"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example, `--console-address :9001` sets the MinIO Console listen port
# MINIO_OPTS="--console-address :9001"
MINIO_OPTS="--certs-dir /etc/minio"

# MINIO_SERVER_URL sets the hostname of the local machine for use with the MinIO Server
# MinIO assumes your network control plane can correctly resolve this hostname to the local machine

# Uncomment the following line and replace the value with the correct hostname for the local machine and port for the MinIO server (9000 by default).

# MINIO_SERVER_URL="http://127.0.0.0:9000"


MINIO_ADDRESS=:xxxx
MINIO_COMPRESSION_ENABLE=on
MINIO_COMPRESSION_ALLOW_ENCRYPTION=on

MINIO_BROWSER=off
1
2
3
4
groupadd -r minio-user
useradd -M -r -g minio-user minio-user
mkdir /data
chown minio-user:minio-user /data/

下载 certgen:
wget https://github.com/minio/certgen/releases/latest/download/certgen-linux-amd64

生成自签证书:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
chmod +x certgen-linux-amd64
mv certgen-linux-amd64 certgen
./certgen -host x.x.x.x

mkdir /etc/minio
cp private.key public.crt /etc/minio/

chown minio-user:minio-user /etc/minio/ -R

chmod 600 /etc/minio/private.key

客户端配置:

1
2
3
mc alias set myminio https://minioserver.example.net ACCESS_KEY SECRET_KEY
#测试
mc admin info myminio

命令:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
# 创建桶
mc mb host/xxx

# 查看桶
mc ls host/xxx

# 获取桶策略
mc anonymous get host/xxx

# 列出host
mc config host

# 删除host
mc config host remove gcs

# 上传文件
mc cp core host/xxx/

# 删除文件
mc rm host/xxx/file

SSE-C 加密
Generate the Encryption Key: cat /dev/urandom | head -c 32 | base64 -

加密上传
mc cp ~/data/mydata.json host/xxx/mydata.json \ --encrypt-key "host/xxx/=c2VjcmV0ZW5jcnlwdGlvbmtleWNoYW5nZW1lMTIzNAo="

mc encrypt set ENCRYPTION