S3 Gateway Clients

Downstream S3 clients connect to Vaulthalla with gateway credentials, not upstream provider credentials. Use the direct listener for local/private access or the managed S3-domain endpoint for public reverse-proxy access.

Endpoint Selection

Configure path-style addressing for clients whenever possible. In path-style mode, s3://archive/photos/image.jpg becomes /archive/photos/image.jpg on the gateway endpoint.

AWS CLI

Configure the gateway key:

1aws configure set aws_access_key_id VH...2aws configure set aws_secret_access_key ...3aws configure set default.region us-east-14aws configure set s3.addressing_style path

Use the public S3-domain endpoint:

1aws --endpoint-url https://s3.vaulthalla.example.com s3api list-buckets2aws --endpoint-url https://s3.vaulthalla.example.com s3 cp ./file.txt s3://archive/file.txt3aws --endpoint-url https://s3.vaulthalla.example.com s3 rm s3://archive/file.txt

Use the direct local endpoint:

1aws --endpoint-url http://127.0.0.1:39000 s3api list-buckets2aws --endpoint-url http://127.0.0.1:39000 s3 cp ./file.txt s3://archive/file.txt3aws --endpoint-url http://127.0.0.1:39000 s3 rm s3://archive/file.txt

Directory upload and download:

1aws --endpoint-url https://s3.vaulthalla.example.com s3 sync ./photos s3://archive/photos2aws --endpoint-url https://s3.vaulthalla.example.com s3 sync s3://archive/photos ./restored-photos3aws --endpoint-url https://s3.vaulthalla.example.com s3 rm s3://archive/photos/old-prefix --recursive

rclone

Example rclone remote:

1[vh-public]2type = s33provider = Other4access_key_id = VH...5secret_access_key = ...6endpoint = https://s3.vaulthalla.example.com7force_path_style = true8region = us-east-19acl = private

Directory upload, sync, download, and delete examples:

1rclone copy ./photos vh-public:archive/photos --progress2rclone sync ./backup vh-public:archive/backup --progress3rclone copy vh-public:archive/photos ./restored-photos --progress4rclone delete vh-public:archive/backup/old-prefix --rmdirs

rclone copy preserves existing destination objects that are not in the source. rclone sync makes the destination match the source, including deletes. For remote-backed gateway buckets, those deletes are local-first in Vaulthalla and upstream cleanup remains sync-owned.

MinIO mc

Configure a public endpoint alias:

1mc alias set vh https://s3.vaulthalla.example.com VH... ...

Basic object operations:

1mc cp ./file.txt vh/archive/file.txt2mc ls vh/archive3mc rm vh/archive/file.txt

Directory operations:

1mc cp --recursive ./photos vh/archive/photos2mc cp --recursive vh/archive/photos ./restored-photos3mc rm --recursive --force vh/archive/photos/old-prefix

Use http://127.0.0.1:39000 in the alias when the client runs on the Vaulthalla host and should bypass public Nginx.

Multipart Uploads

Multipart uploads are supported for large object and directory workflows. Vaulthalla stores upload parts in Vaulthalla-owned hidden per-upload backing directories until the upload is completed, aborted, or expired by the configured retention window.

Multipart ETags use the S3-style form based on part MD5 digests and part count. They are client-visible gateway metadata and are not the same value as Vaulthalla's local encrypted content hash.