minio

Metadata

Field	Value
Service	minio
Purpose	S3-compatible object store (Loki/Mimir storage, Velero and Longhorn backup targets)
Criticality	Tier 3
Owner	Platform owner
Clusters	homelab, jls (overlays exist; not deployed on homelab as of 2026-09-11)
Namespace	minio
Exposure	internet (Traefik IngressRoutes)
Stateful	yes
Backup class	NAS dataset snapshots and replicas (homelab)
RPO / RTO	24 hours (NAS keep-daily snapshot), 1 hour to restore
Last reviewed	2026-09-11

1. Service Overview

A single-node MinIO server whose data lives on the NAS over NFS. On homelab it has served the loki, mimir-tsdb, mimir-alerts, velero-backups, longhorn-backups and cloudcasa buckets. The last write to the data was on 2026-05-12.

Summary

If MinIO is down, anything using it as a storage backend stops writing. Nothing depends on it today.

Dependencies

Dependency	Type	Why it matters
NAS dataset SSD-zpool/apps-data/minio (homelab)	storage	All objects; own NFS export
Traefik	ingress	Console and S3 API endpoints

2. Architecture Diagram

[S3 clients] -> [Traefik s3.mutana.site] -> [minio :9000]
[Browser]    -> [Traefik minio.mutana.site] -> [minio console :9001]
[minio] -> [PV minio-pv, NFS 192.168.1.2:/mnt/SSD-zpool/apps-data/minio]

3. Deployment Specifications

Item	Value
Source path	minio/base and minio/overlays/{homelab,jls}
Deployment model	Kustomize with Fleet targets in fleet.yaml
Namespace	minio
Workload kind	Deployment (1 replica) with a static NFS PersistentVolume
Chart or image version	quay.io/minio/minio tag set in the overlay images: block
Config files	base/kustomization.yaml, overlays/homelab/kustomization.yaml, overlays/jls/kustomization.yaml, fleet.yaml

Cluster mapping

Cluster	Overlay path	Notes
homelab	minio/overlays/homelab	PV minio-pv → /mnt/SSD-zpool/apps-data/minio (moved from S3-store on 2026-09-11)
jls	minio/overlays/jls	PV → /mnt/SSD-zpool/vpn-share

4. Configuration Guide

Environment variables

Variable	Source	Purpose	Secret?
MINIO_ROOT_USER, MINIO_ROOT_PASSWORD	minio-admin-user from minio-admin-user.txt	Root credentials	yes
Ports, browser, Prometheus settings	Deployment env	Server behaviour	no

ConfigMaps

Resource	Path	Purpose
minio-config	overlays//minio-config.yaml	Copied into the data volume by the init container

Secrets management

• Secret names: minio-admin-user (and smb-creds on homelab, unused by the NFS PV) in namespace minio
• Source of truth: overlay *.txt inputs (tracked secret debt)
• Rotation trigger: root credential rotation
• Recovery note: restore the root credentials before starting the server

5. Access Protocols

Path	URL or endpoint	Audience	Auth	TLS terminates at
Internal	minio-api-service / minio-console-service in namespace minio	Cluster workloads	S3 access keys	Service
External	https://s3.mutana.site (API), https://minio.mutana.site (console)	Operators and S3 clients	MinIO credentials	Traefik (LE-prod)

6. Operations and Observability

• Primary health indicators: /minio/health/ready and /minio/health/live.
• Dashboards or alerts: MinIO Prometheus endpoint (public auth type).
• Log locations: minio pod logs.
• Known failure modes: NFS export missing or pointing at the wrong path (the apps-data export does not show child datasets, so the PV needs export #2).

7. Backup and Recovery Notes

• Backup method: the homelab data is its own NAS dataset (SSD-zpool/apps-data/minio, 300G quota, 1M recordsize). It gets the SSD snapshot ladder and replicas on TANK and ARCHIVES. The loki and mimir buckets are class D (replaceable); the planned offsite egress excludes them.
• Restore prerequisites: the dataset or a snapshot of it, and the root credentials.
• Related runbook: not required for this Tier 3 service.

8. Release and Change Notes

• Current deployed app version: not deployed on homelab; image pin in the overlay.
• Current chart version: N/A.
• Last significant change: homelab PV path moved to /mnt/SSD-zpool/apps-data/minio (2026-09-11).
• Rollback reference: previous overlay revision in Git; on the NAS, rename the dataset back to SSD-zpool/S3-store and repoint NFS export #2.