From 6b1e09e73b6bf982a5446712ac34d89e71a199b8 Mon Sep 17 00:00:00 2001 From: clangenb Date: Wed, 14 Oct 2026 06:17:04 +0000 Subject: [PATCH 01/10] docs(installation): add Docker Swarm container guide Add installation/container/swarm.md: deploy a single-node RustFS service on Docker Swarm with the swarmcli rustfs chart, reading the root credentials from Docker secrets through RUSTFS_ACCESS_KEY_FILE and RUSTFS_SECRET_KEY_FILE. Covers the secrets, the data-node label, the install, verification, the S3 API / Console exposure modes, the key chart values, and uninstalling. Link it from the container sidebar and overview, and add Docker Swarm to the credentials warning on the installation overview. zh is translated; de, fr and ja carry the English text, as for docker.md. Co-Authored-By: Claude Opus 5.5 --- content/de/installation/container/index.md | 3 +- content/de/installation/container/meta.json | 3 +- content/de/installation/container/swarm.md | 141 ++++++++++++++++++++ content/de/installation/index.md | 1 + content/en/installation/container/index.md | 3 +- content/en/installation/container/meta.json | 3 +- content/en/installation/container/swarm.md | 141 ++++++++++++++++++++ content/en/installation/index.md | 1 + content/fr/installation/container/index.md | 3 +- content/fr/installation/container/meta.json | 3 +- content/fr/installation/container/swarm.md | 141 ++++++++++++++++++++ content/fr/installation/index.md | 1 + content/ja/installation/container/index.md | 3 +- content/ja/installation/container/meta.json | 3 +- content/ja/installation/container/swarm.md | 141 ++++++++++++++++++++ content/ja/installation/index.md | 1 + content/zh/installation/container/index.md | 3 +- content/zh/installation/container/meta.json | 3 +- content/zh/installation/container/swarm.md | 141 ++++++++++++++++++++ content/zh/installation/index.md | 1 + 20 files changed, 730 insertions(+), 10 deletions(-) create mode 100644 content/de/installation/container/swarm.md create mode 100644 content/en/installation/container/swarm.md create mode 100644 content/fr/installation/container/swarm.md create mode 100644 content/ja/installation/container/swarm.md create mode 100644 content/zh/installation/container/swarm.md diff --git a/content/de/installation/container/index.md b/content/de/installation/container/index.md index 4ee47b47d..1e2a9be3d 100644 --- a/content/de/installation/container/index.md +++ b/content/de/installation/container/index.md @@ -1,6 +1,6 @@ --- title: "Container" -description: "Run the official RustFS container image with Docker or Podman." +description: "Run the official RustFS container image with Docker, Podman, or Docker Swarm." --- RustFS is a high-performance, S3-compatible open-source distributed object storage system. In single-node single-disk (SNSD) deployment mode, the backend uses zero erasure coding without additional data redundancy, which makes it suitable for local testing and small-scale scenarios. The official RustFS image packages the RustFS binary and its runtime environment into a container, so you can start a service with a single command and persistent storage. @@ -11,6 +11,7 @@ The container runs as non-root user `rustfs` with id `10001`, so a bind-mounted - [Docker](./docker.md): run a single-node instance with persistent storage, then extend it with Docker Compose, TLS, and multi-node networking. - [Podman](./podman.md): run the same image in a daemonless workflow. +- [Docker Swarm](./swarm.md): run a single-node service with credentials stored as Docker secrets, using the swarmcli `rustfs` chart. :::note[Directory permissions] diff --git a/content/de/installation/container/meta.json b/content/de/installation/container/meta.json index be4e8d9a1..50a78f74d 100644 --- a/content/de/installation/container/meta.json +++ b/content/de/installation/container/meta.json @@ -2,6 +2,7 @@ "title": "Container", "pages": [ "docker", - "podman" + "podman", + "swarm" ] } \ No newline at end of file diff --git a/content/de/installation/container/swarm.md b/content/de/installation/container/swarm.md new file mode 100644 index 000000000..336a94660 --- /dev/null +++ b/content/de/installation/container/swarm.md @@ -0,0 +1,141 @@ +--- +title: "Docker Swarm" +description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +--- + +This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. + +The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. + +## 1. Prerequisites + +* A Docker Swarm (`docker swarm init`) and a shell on a manager node +* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh + +## 2. Create the credentials as Docker secrets + +Replace the credential placeholders, then create one secret for each key: + +```bash +printf '%s' '' | docker secret create rustfs-access-key - +printf '%s' '' | docker secret create rustfs-secret-key - +``` + +Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. + +:::warning[The service refuses weak credentials] + +The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. + +::: + +## 3. Label the data node + +A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: + +```bash +docker node update --label-add rustfs-data=true +``` + +On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. + +## 4. Add the chart repository + +Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: + +```bash +swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts +``` + +## 5. Install RustFS + +Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. + +## 6. Verify the deployment + +Check the release, the service task, and the S3 API health endpoint: + +```bash +swarmcli charts status rustfs +docker service ps rustfs_rustfs +curl --fail http://localhost:9000/health +``` + +The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. + +## Exposure modes + +The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: + +| Mode | Reachable from | +| - | - | +| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | +| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | +| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | + +For example, to publish the Console on port 9001 as well: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set console.enabled=true \ + --set console.exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +:::note[The Console port serves the S3 API too] + +The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. + +::: + +## Key values + +| Value | Purpose | Chart default | +| - | - | - | +| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Buckets created at start if missing | `[]` | +| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | +| `publish.port` | Published S3 API port | `9000` | +| `console.enabled` | Run the Console listener | `false` | +| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | +| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | +| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | +| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | + +The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. + +## Uninstall + +```bash +swarmcli charts uninstall rustfs +``` + +Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. + +:::note[The data volume survives an uninstall] + +A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: + +```bash +docker volume rm rustfs_rustfs-data +docker secret rm rustfs-access-key rustfs-secret-key +``` + +::: + +## Next steps + +- [RustFS Console](/administration/console) +- [Configure an S3 client](../../developer/examples/aws-cli.md) +- [Pre-Installation Checklists](../requirement/checklists/index.md) diff --git a/content/de/installation/index.md b/content/de/installation/index.md index 4d8361f57..a0c450076 100644 --- a/content/de/installation/index.md +++ b/content/de/installation/index.md @@ -11,6 +11,7 @@ After installation, set unique values for `RUSTFS_ACCESS_KEY` and `RUSTFS_SECRET - For a Linux binary or systemd installation, set both values in `/etc/default/rustfs`, then restart the `rustfs` service. - For Docker, Podman, or Docker Compose, pass both values as container environment variables when creating the container. Recreate an existing container if it was started without them. +- For Docker Swarm, create both values as Docker secrets before you install the chart. ::: diff --git a/content/en/installation/container/index.md b/content/en/installation/container/index.md index 4ee47b47d..1e2a9be3d 100644 --- a/content/en/installation/container/index.md +++ b/content/en/installation/container/index.md @@ -1,6 +1,6 @@ --- title: "Container" -description: "Run the official RustFS container image with Docker or Podman." +description: "Run the official RustFS container image with Docker, Podman, or Docker Swarm." --- RustFS is a high-performance, S3-compatible open-source distributed object storage system. In single-node single-disk (SNSD) deployment mode, the backend uses zero erasure coding without additional data redundancy, which makes it suitable for local testing and small-scale scenarios. The official RustFS image packages the RustFS binary and its runtime environment into a container, so you can start a service with a single command and persistent storage. @@ -11,6 +11,7 @@ The container runs as non-root user `rustfs` with id `10001`, so a bind-mounted - [Docker](./docker.md): run a single-node instance with persistent storage, then extend it with Docker Compose, TLS, and multi-node networking. - [Podman](./podman.md): run the same image in a daemonless workflow. +- [Docker Swarm](./swarm.md): run a single-node service with credentials stored as Docker secrets, using the swarmcli `rustfs` chart. :::note[Directory permissions] diff --git a/content/en/installation/container/meta.json b/content/en/installation/container/meta.json index be4e8d9a1..50a78f74d 100644 --- a/content/en/installation/container/meta.json +++ b/content/en/installation/container/meta.json @@ -2,6 +2,7 @@ "title": "Container", "pages": [ "docker", - "podman" + "podman", + "swarm" ] } \ No newline at end of file diff --git a/content/en/installation/container/swarm.md b/content/en/installation/container/swarm.md new file mode 100644 index 000000000..336a94660 --- /dev/null +++ b/content/en/installation/container/swarm.md @@ -0,0 +1,141 @@ +--- +title: "Docker Swarm" +description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +--- + +This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. + +The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. + +## 1. Prerequisites + +* A Docker Swarm (`docker swarm init`) and a shell on a manager node +* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh + +## 2. Create the credentials as Docker secrets + +Replace the credential placeholders, then create one secret for each key: + +```bash +printf '%s' '' | docker secret create rustfs-access-key - +printf '%s' '' | docker secret create rustfs-secret-key - +``` + +Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. + +:::warning[The service refuses weak credentials] + +The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. + +::: + +## 3. Label the data node + +A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: + +```bash +docker node update --label-add rustfs-data=true +``` + +On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. + +## 4. Add the chart repository + +Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: + +```bash +swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts +``` + +## 5. Install RustFS + +Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. + +## 6. Verify the deployment + +Check the release, the service task, and the S3 API health endpoint: + +```bash +swarmcli charts status rustfs +docker service ps rustfs_rustfs +curl --fail http://localhost:9000/health +``` + +The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. + +## Exposure modes + +The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: + +| Mode | Reachable from | +| - | - | +| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | +| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | +| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | + +For example, to publish the Console on port 9001 as well: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set console.enabled=true \ + --set console.exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +:::note[The Console port serves the S3 API too] + +The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. + +::: + +## Key values + +| Value | Purpose | Chart default | +| - | - | - | +| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Buckets created at start if missing | `[]` | +| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | +| `publish.port` | Published S3 API port | `9000` | +| `console.enabled` | Run the Console listener | `false` | +| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | +| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | +| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | +| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | + +The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. + +## Uninstall + +```bash +swarmcli charts uninstall rustfs +``` + +Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. + +:::note[The data volume survives an uninstall] + +A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: + +```bash +docker volume rm rustfs_rustfs-data +docker secret rm rustfs-access-key rustfs-secret-key +``` + +::: + +## Next steps + +- [RustFS Console](/administration/console) +- [Configure an S3 client](../../developer/examples/aws-cli.md) +- [Pre-Installation Checklists](../requirement/checklists/index.md) diff --git a/content/en/installation/index.md b/content/en/installation/index.md index 4d8361f57..a0c450076 100644 --- a/content/en/installation/index.md +++ b/content/en/installation/index.md @@ -11,6 +11,7 @@ After installation, set unique values for `RUSTFS_ACCESS_KEY` and `RUSTFS_SECRET - For a Linux binary or systemd installation, set both values in `/etc/default/rustfs`, then restart the `rustfs` service. - For Docker, Podman, or Docker Compose, pass both values as container environment variables when creating the container. Recreate an existing container if it was started without them. +- For Docker Swarm, create both values as Docker secrets before you install the chart. ::: diff --git a/content/fr/installation/container/index.md b/content/fr/installation/container/index.md index 4ee47b47d..1e2a9be3d 100644 --- a/content/fr/installation/container/index.md +++ b/content/fr/installation/container/index.md @@ -1,6 +1,6 @@ --- title: "Container" -description: "Run the official RustFS container image with Docker or Podman." +description: "Run the official RustFS container image with Docker, Podman, or Docker Swarm." --- RustFS is a high-performance, S3-compatible open-source distributed object storage system. In single-node single-disk (SNSD) deployment mode, the backend uses zero erasure coding without additional data redundancy, which makes it suitable for local testing and small-scale scenarios. The official RustFS image packages the RustFS binary and its runtime environment into a container, so you can start a service with a single command and persistent storage. @@ -11,6 +11,7 @@ The container runs as non-root user `rustfs` with id `10001`, so a bind-mounted - [Docker](./docker.md): run a single-node instance with persistent storage, then extend it with Docker Compose, TLS, and multi-node networking. - [Podman](./podman.md): run the same image in a daemonless workflow. +- [Docker Swarm](./swarm.md): run a single-node service with credentials stored as Docker secrets, using the swarmcli `rustfs` chart. :::note[Directory permissions] diff --git a/content/fr/installation/container/meta.json b/content/fr/installation/container/meta.json index 42daf076e..28baa9c5d 100644 --- a/content/fr/installation/container/meta.json +++ b/content/fr/installation/container/meta.json @@ -2,6 +2,7 @@ "title": "Conteneurs", "pages": [ "docker", - "podman" + "podman", + "swarm" ] } \ No newline at end of file diff --git a/content/fr/installation/container/swarm.md b/content/fr/installation/container/swarm.md new file mode 100644 index 000000000..336a94660 --- /dev/null +++ b/content/fr/installation/container/swarm.md @@ -0,0 +1,141 @@ +--- +title: "Docker Swarm" +description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +--- + +This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. + +The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. + +## 1. Prerequisites + +* A Docker Swarm (`docker swarm init`) and a shell on a manager node +* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh + +## 2. Create the credentials as Docker secrets + +Replace the credential placeholders, then create one secret for each key: + +```bash +printf '%s' '' | docker secret create rustfs-access-key - +printf '%s' '' | docker secret create rustfs-secret-key - +``` + +Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. + +:::warning[The service refuses weak credentials] + +The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. + +::: + +## 3. Label the data node + +A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: + +```bash +docker node update --label-add rustfs-data=true +``` + +On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. + +## 4. Add the chart repository + +Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: + +```bash +swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts +``` + +## 5. Install RustFS + +Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. + +## 6. Verify the deployment + +Check the release, the service task, and the S3 API health endpoint: + +```bash +swarmcli charts status rustfs +docker service ps rustfs_rustfs +curl --fail http://localhost:9000/health +``` + +The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. + +## Exposure modes + +The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: + +| Mode | Reachable from | +| - | - | +| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | +| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | +| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | + +For example, to publish the Console on port 9001 as well: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set console.enabled=true \ + --set console.exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +:::note[The Console port serves the S3 API too] + +The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. + +::: + +## Key values + +| Value | Purpose | Chart default | +| - | - | - | +| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Buckets created at start if missing | `[]` | +| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | +| `publish.port` | Published S3 API port | `9000` | +| `console.enabled` | Run the Console listener | `false` | +| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | +| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | +| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | +| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | + +The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. + +## Uninstall + +```bash +swarmcli charts uninstall rustfs +``` + +Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. + +:::note[The data volume survives an uninstall] + +A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: + +```bash +docker volume rm rustfs_rustfs-data +docker secret rm rustfs-access-key rustfs-secret-key +``` + +::: + +## Next steps + +- [RustFS Console](/administration/console) +- [Configure an S3 client](../../developer/examples/aws-cli.md) +- [Pre-Installation Checklists](../requirement/checklists/index.md) diff --git a/content/fr/installation/index.md b/content/fr/installation/index.md index 4d8361f57..a0c450076 100644 --- a/content/fr/installation/index.md +++ b/content/fr/installation/index.md @@ -11,6 +11,7 @@ After installation, set unique values for `RUSTFS_ACCESS_KEY` and `RUSTFS_SECRET - For a Linux binary or systemd installation, set both values in `/etc/default/rustfs`, then restart the `rustfs` service. - For Docker, Podman, or Docker Compose, pass both values as container environment variables when creating the container. Recreate an existing container if it was started without them. +- For Docker Swarm, create both values as Docker secrets before you install the chart. ::: diff --git a/content/ja/installation/container/index.md b/content/ja/installation/container/index.md index 4ee47b47d..1e2a9be3d 100644 --- a/content/ja/installation/container/index.md +++ b/content/ja/installation/container/index.md @@ -1,6 +1,6 @@ --- title: "Container" -description: "Run the official RustFS container image with Docker or Podman." +description: "Run the official RustFS container image with Docker, Podman, or Docker Swarm." --- RustFS is a high-performance, S3-compatible open-source distributed object storage system. In single-node single-disk (SNSD) deployment mode, the backend uses zero erasure coding without additional data redundancy, which makes it suitable for local testing and small-scale scenarios. The official RustFS image packages the RustFS binary and its runtime environment into a container, so you can start a service with a single command and persistent storage. @@ -11,6 +11,7 @@ The container runs as non-root user `rustfs` with id `10001`, so a bind-mounted - [Docker](./docker.md): run a single-node instance with persistent storage, then extend it with Docker Compose, TLS, and multi-node networking. - [Podman](./podman.md): run the same image in a daemonless workflow. +- [Docker Swarm](./swarm.md): run a single-node service with credentials stored as Docker secrets, using the swarmcli `rustfs` chart. :::note[Directory permissions] diff --git a/content/ja/installation/container/meta.json b/content/ja/installation/container/meta.json index 66218df5d..d33136b25 100644 --- a/content/ja/installation/container/meta.json +++ b/content/ja/installation/container/meta.json @@ -2,6 +2,7 @@ "title": "コンテナ", "pages": [ "docker", - "podman" + "podman", + "swarm" ] } \ No newline at end of file diff --git a/content/ja/installation/container/swarm.md b/content/ja/installation/container/swarm.md new file mode 100644 index 000000000..336a94660 --- /dev/null +++ b/content/ja/installation/container/swarm.md @@ -0,0 +1,141 @@ +--- +title: "Docker Swarm" +description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +--- + +This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. + +The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. + +## 1. Prerequisites + +* A Docker Swarm (`docker swarm init`) and a shell on a manager node +* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh + +## 2. Create the credentials as Docker secrets + +Replace the credential placeholders, then create one secret for each key: + +```bash +printf '%s' '' | docker secret create rustfs-access-key - +printf '%s' '' | docker secret create rustfs-secret-key - +``` + +Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. + +:::warning[The service refuses weak credentials] + +The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. + +::: + +## 3. Label the data node + +A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: + +```bash +docker node update --label-add rustfs-data=true +``` + +On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. + +## 4. Add the chart repository + +Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: + +```bash +swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts +``` + +## 5. Install RustFS + +Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. + +## 6. Verify the deployment + +Check the release, the service task, and the S3 API health endpoint: + +```bash +swarmcli charts status rustfs +docker service ps rustfs_rustfs +curl --fail http://localhost:9000/health +``` + +The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. + +## Exposure modes + +The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: + +| Mode | Reachable from | +| - | - | +| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | +| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | +| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | + +For example, to publish the Console on port 9001 as well: + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set console.enabled=true \ + --set console.exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +:::note[The Console port serves the S3 API too] + +The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. + +::: + +## Key values + +| Value | Purpose | Chart default | +| - | - | - | +| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Buckets created at start if missing | `[]` | +| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | +| `publish.port` | Published S3 API port | `9000` | +| `console.enabled` | Run the Console listener | `false` | +| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | +| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | +| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | +| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | + +The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. + +## Uninstall + +```bash +swarmcli charts uninstall rustfs +``` + +Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. + +:::note[The data volume survives an uninstall] + +A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: + +```bash +docker volume rm rustfs_rustfs-data +docker secret rm rustfs-access-key rustfs-secret-key +``` + +::: + +## Next steps + +- [RustFS Console](/administration/console) +- [Configure an S3 client](../../developer/examples/aws-cli.md) +- [Pre-Installation Checklists](../requirement/checklists/index.md) diff --git a/content/ja/installation/index.md b/content/ja/installation/index.md index 4d8361f57..a0c450076 100644 --- a/content/ja/installation/index.md +++ b/content/ja/installation/index.md @@ -11,6 +11,7 @@ After installation, set unique values for `RUSTFS_ACCESS_KEY` and `RUSTFS_SECRET - For a Linux binary or systemd installation, set both values in `/etc/default/rustfs`, then restart the `rustfs` service. - For Docker, Podman, or Docker Compose, pass both values as container environment variables when creating the container. Recreate an existing container if it was started without them. +- For Docker Swarm, create both values as Docker secrets before you install the chart. ::: diff --git a/content/zh/installation/container/index.md b/content/zh/installation/container/index.md index 67f27ca62..2c7be32ff 100644 --- a/content/zh/installation/container/index.md +++ b/content/zh/installation/container/index.md @@ -1,6 +1,6 @@ --- title: "容器" -description: "使用 Docker 或 Podman 运行官方 RustFS 容器镜像。" +description: "使用 Docker、Podman 或 Docker Swarm 运行官方 RustFS 容器镜像。" --- RustFS 是高性能、兼容 S3 的开源分布式对象存储系统。在单节点单磁盘（SNSD）部署模式下，后端使用零纠删码，不提供额外数据冗余，适合本地测试和小规模场景。官方 RustFS 镜像将 RustFS 二进制及其运行环境打包到容器中，一条命令即可启动带持久化存储的服务。 @@ -11,6 +11,7 @@ RustFS 是高性能、兼容 S3 的开源分布式对象存储系统。在单节 - [Docker](./docker.md)：运行带持久化存储的单节点实例，并可扩展 Docker Compose、TLS 和多节点网络。 - [Podman](./podman.md)：以无守护进程的方式运行同一镜像。 +- [Docker Swarm](./swarm.md)：使用 swarmcli 的 `rustfs` Chart 运行单节点服务，凭证以 Docker Secret 形式保存。 :::note[目录权限] diff --git a/content/zh/installation/container/meta.json b/content/zh/installation/container/meta.json index c6d8b8bba..13afd0944 100644 --- a/content/zh/installation/container/meta.json +++ b/content/zh/installation/container/meta.json @@ -2,6 +2,7 @@ "title": "容器", "pages": [ "docker", - "podman" + "podman", + "swarm" ] } \ No newline at end of file diff --git a/content/zh/installation/container/swarm.md b/content/zh/installation/container/swarm.md new file mode 100644 index 000000000..90de7f4a2 --- /dev/null +++ b/content/zh/installation/container/swarm.md @@ -0,0 +1,141 @@ +--- +title: "Docker Swarm" +description: "使用 swarmcli 的 rustfs Chart 在 Docker Swarm 上运行单节点 RustFS 服务，并将凭证保存为 Docker Secret。" +--- + +本文将 RustFS 部署为 Docker Swarm 服务，其根凭证以 Docker Secret 而非环境变量的形式提供：RustFS 通过 `RUSTFS_ACCESS_KEY_FILE` 和 `RUSTFS_SECRET_KEY_FILE` 从文件中读取凭证，因此这两个值都不会出现在服务定义或 `docker inspect` 的输出中。部署使用社区仓库 swarmcli-charts 中的 [`rustfs` Chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs)，并通过 [swarmcli](https://github.com/Eldara-Tech/swarmcli) 安装。二者均由 Eldara Tech 维护，而非 RustFS 项目。 + +该 Chart 在一个节点上运行一个使用单块磁盘的 RustFS 服务（单节点单磁盘，SNSD）。单块磁盘不提供纠删码冗余，因此适用于构建缓存、备份目标和小型 Swarm 上的应用 Blob 存储；它不运行多节点 RustFS 部署。 + +## 1. 前提条件 + +* 一个 Docker Swarm（`docker swarm init`），以及管理节点上的 Shell +* swarmcli 1.11.0 或更高版本，请参阅 [swarmcli 安装指南](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Swarm 节点上的 9000 端口（S3 API）未被占用，因为第 5 步会在 Swarm 路由网格上发布该端口 + +## 2. 将凭证创建为 Docker Secret + +替换凭证占位符，然后为每个密钥创建一个 Secret： + +```bash +printf '%s' '' | docker secret create rustfs-access-key - +printf '%s' '' | docker secret create rustfs-secret-key - +``` + +每个值都应位于一行内，且内部不含空白字符。例如，可以使用 `openssl rand -base64 30` 生成高强度的秘密密钥。 + +:::warning[服务会拒绝弱凭证] + +如果任一 Secret 缺失、为空、包含空白字符或使用众所周知的 `rustfsadmin` 值，该 Chart 的容器会在启动时退出。Docker Secret 无法修改：如需轮换凭证，请以新名称创建 Secret，将 Chart 的 `s3.accessKeySecret` 和 `s3.secretKeySecret` 值指向它们，然后升级该 Release。 + +::: + +## 3. 标记数据节点 + +命名卷只存在于一个节点上，因此服务会被固定到带有 `rustfs-data=true` 标签的节点。请只为一个节点添加该标签： + +```bash +docker node update --label-add rustfs-data=true +``` + +在单节点 Swarm 上，可以跳过标签，改为在第 5 步的安装命令中添加 `--set persistence.nodeLabel=""`。 + +## 4. 添加 Chart 仓库 + +如果 `swarmcli charts repo list` 已显示 `swarmcli-charts`，请跳过此步骤： + +```bash +swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts +``` + +## 5. 安装 RustFS + +将该 Chart 安装为名为 `rustfs` 的 Release，在 9000 端口发布 S3 API，并在启动时创建一个存储桶： + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +服务将数据保存在 `rustfs-data` 命名卷的 `/data` 下，Docker 会以 Release 名称为前缀将其命名为 `rustfs_rustfs-data`。`buckets` 中的每个存储桶会在服务器开始响应后创建；已存在的存储桶保持不变，因此重启和升级都是安全的。 + +## 6. 验证部署 + +检查 Release、服务任务和 S3 API 健康检查端点： + +```bash +swarmcli charts status rustfs +docker service ps rustfs_rustfs +curl --fail http://localhost:9000/health +``` + +S3 API 在每个 Swarm 节点上均可通过 `http://localhost:9000` 访问。客户端使用路径式寻址和区域 `us-east-1`。 + +## 暴露模式 + +该 Chart 分别暴露 S3 API 和控制台。控制台默认关闭，可通过 `console.enabled=true` 启用。S3 API 的模式由 `exposure.mode` 设置，控制台的模式由 `console.exposure.mode` 设置： + +| 模式 | 可访问范围 | +| - | - | +| `none`（默认） | 仅限连接到 `rustfs-net` 覆盖网络的服务，地址为 `http://_rustfs:9000` | +| `published` | 在 Swarm 路由网格上发布的端口：S3 API 使用 `publish.port`，控制台使用 `console.publish.port`（9001） | +| `traefik` | 由 Traefik 路由的主机名：S3 API 使用 `ingress.host`，控制台使用 `console.ingress.host` | + +例如，同时在 9001 端口发布控制台： + +```bash +swarmcli charts install rustfs swarmcli-charts/rustfs \ + --set exposure.mode=published \ + --set console.enabled=true \ + --set console.exposure.mode=published \ + --set 'buckets={my-bucket}' +``` + +:::note[控制台端口同样提供 S3 API] + +控制台监听器同样提供完整的签名 S3 API 和管理 API，因此即使只暴露控制台，也会将这些 API 置于公开地址上。不使用控制台时，请保持其关闭。 + +::: + +## 关键配置值 + +| 配置值 | 用途 | Chart 默认值 | +| - | - | - | +| `image.tag` | RustFS 镜像标签 | `""`（Chart 固定的 RustFS 版本） | +| `s3.accessKeySecret` / `s3.secretKeySecret` | 保存根凭证的 Docker Secret | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | 启动时创建的存储桶（若尚不存在） | `[]` | +| `exposure.mode` | S3 API 暴露方式：`none`、`published` 或 `traefik` | `none` | +| `publish.port` | 发布的 S3 API 端口 | `9000` | +| `console.enabled` | 运行控制台监听器 | `false` | +| `console.exposure.mode` | 控制台暴露方式：`none`、`published` 或 `traefik` | `none` | +| `persistence.nodeLabel` | 服务固定到的节点标签；`""` 表示不固定 | `rustfs-data` | +| `persistence.volumePath` | 以绑定挂载方式挂载到 `/data` 的主机目录，用于代替命名卷；所有者必须为 `10001` | `""` | +| `extraEnv` | 额外的 `RUSTFS_*` 环境变量，例如 `RUSTFS_SERVER_DOMAINS` | `{}` | + +[Chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) 记录了所有配置值，包括 Traefik 路由、通过 OpenID Connect 为控制台配置单点登录，以及主机目录绑定挂载。 + +## 卸载 + +```bash +swarmcli charts uninstall rustfs +``` + +卸载会删除服务和 Release 历史记录，但会保留数据卷、两个 Docker Secret 和 `rustfs-net` 网络；swarmcli 会列出该网络及其删除命令。 + +:::note[数据卷在卸载后仍会保留] + +之后以相同 Release 名称重新安装时，会重新挂载该卷及其中的数据。如需丢弃数据，请在带标签的节点上删除该卷；如果不再需要这些 Secret，也可将其删除： + +```bash +docker volume rm rustfs_rustfs-data +docker secret rm rustfs-access-key rustfs-secret-key +``` + +::: + +## 后续步骤 + +- [RustFS 控制台](/administration/console) +- [配置 S3 客户端](../../developer/examples/aws-cli.md) +- [安装前检查清单](../requirement/checklists/index.md) diff --git a/content/zh/installation/index.md b/content/zh/installation/index.md index 1c675965f..984d11bb6 100644 --- a/content/zh/installation/index.md +++ b/content/zh/installation/index.md @@ -11,6 +11,7 @@ RustFS 是使用 Rust 编写并采用 Apache 2.0 许可证发布的分布式对 - 对于 Linux 二进制文件或 systemd 安装，请在 `/etc/default/rustfs` 中设置这两个值，然后重启 `rustfs` 服务。 - 对于 Docker、Podman 或 Docker Compose，请在创建容器时将这两个值作为容器环境变量传入。如果现有容器启动时未设置这些值，请重新创建该容器。 +- 对于 Docker Swarm，请在安装 Chart 前将这两个值创建为 Docker Secret。 ::: From 1d7f96674f4caec812b4bb26d77295c75461d915 Mon Sep 17 00:00:00 2001 From: clangenb Date: Wed, 14 Oct 2026 12:20:02 +0000 Subject: [PATCH 02/10] docs(i18n): translate the Docker Swarm guide into de, fr and ja Replace the English fallback text of installation/container/swarm.md in content/de, content/fr and content/ja with translations that follow the locale glossaries in .agents/skills/localize-rustfs-docs/references. Code blocks, identifiers and values are unchanged from English. Co-Authored-By: Claude Opus 5.5 --- content/de/installation/container/swarm.md | 104 ++++++++++---------- content/fr/installation/container/swarm.md | 106 ++++++++++----------- content/ja/installation/container/swarm.md | 104 ++++++++++---------- 3 files changed, 157 insertions(+), 157 deletions(-) diff --git a/content/de/installation/container/swarm.md b/content/de/installation/container/swarm.md index 336a94660..fc2df5476 100644 --- a/content/de/installation/container/swarm.md +++ b/content/de/installation/container/swarm.md @@ -1,56 +1,56 @@ --- title: "Docker Swarm" -description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +description: "Führen Sie einen RustFS-Dienst auf einem Knoten in Docker Swarm aus, mit Anmeldedaten als Docker-Secrets und dem rustfs-Chart von swarmcli." --- -This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. +Diese Seite stellt RustFS als Docker-Swarm-Dienst bereit, dessen Root-Anmeldedaten als Docker-Secrets statt als Umgebungsvariablen vorliegen: RustFS liest sie über `RUSTFS_ACCESS_KEY_FILE` und `RUSTFS_SECRET_KEY_FILE` aus Dateien, sodass keiner der beiden Werte in der Dienstdefinition oder in `docker inspect` erscheint. Die Bereitstellung verwendet das [`rustfs`-Chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) aus dem Community-Repository swarmcli-charts und wird mit [swarmcli](https://github.com/Eldara-Tech/swarmcli) installiert. Beide werden von Eldara Tech gepflegt, nicht vom RustFS-Projekt. -The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. +Das Chart führt einen RustFS-Dienst mit einem Laufwerk auf einem Knoten aus (Single Node Single Disk, SNSD). Ein einzelnes Laufwerk bietet keine Redundanz durch Erasure Coding. Das Chart eignet sich daher für Build-Caches, Backup-Ziele und Blob-Speicher von Anwendungen in einem kleinen Swarm; eine RustFS-Bereitstellung über mehrere Knoten führt es nicht aus. -## 1. Prerequisites +## 1. Voraussetzungen -* A Docker Swarm (`docker swarm init`) and a shell on a manager node -* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) -* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh +* Ein Docker Swarm (`docker swarm init`) und eine Shell auf einem Manager-Knoten +* swarmcli 1.11.0 oder neuer – siehe die [Installationsanleitung von swarmcli](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Port 9000 (S3-API) ist auf den Swarm-Knoten frei, da Schritt 5 ihn im Routing-Mesh des Swarms veröffentlicht -## 2. Create the credentials as Docker secrets +## 2. Anmeldedaten als Docker-Secrets anlegen -Replace the credential placeholders, then create one secret for each key: +Ersetzen Sie die Platzhalter für die Anmeldedaten und legen Sie dann für jeden Schlüssel ein Secret an: ```bash printf '%s' '' | docker secret create rustfs-access-key - printf '%s' '' | docker secret create rustfs-secret-key - ``` -Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. +Jeder Wert muss in einer Zeile stehen und darf keine Leerzeichen enthalten. Einen starken geheimen Zugriffsschlüssel erzeugen Sie zum Beispiel mit `openssl rand -base64 30`. -:::warning[The service refuses weak credentials] +:::warning[Der Dienst lehnt schwache Anmeldedaten ab] -The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. +Der Container des Charts beendet sich beim Start, wenn eines der Secrets fehlt, leer ist, Leerzeichen enthält oder den allgemein bekannten Wert `rustfsadmin` hat. Docker-Secrets lassen sich nicht bearbeiten: Um die Anmeldedaten zu rotieren, legen Sie Secrets unter neuen Namen an, verweisen mit den Chart-Werten `s3.accessKeySecret` und `s3.secretKeySecret` darauf und aktualisieren anschließend das Release. ::: -## 3. Label the data node +## 3. Datenknoten kennzeichnen -A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: +Ein benanntes Volume existiert nur auf einem Knoten. Deshalb wird der Dienst an den Knoten mit dem Label `rustfs-data=true` gebunden. Versehen Sie genau einen Knoten mit diesem Label: ```bash docker node update --label-add rustfs-data=true ``` -On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. +In einem Swarm mit nur einem Knoten können Sie das Label weglassen und stattdessen `--set persistence.nodeLabel=""` an den Installationsbefehl in Schritt 5 anhängen. -## 4. Add the chart repository +## 4. Chart-Repository hinzufügen -Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: +Überspringen Sie diesen Schritt, wenn `swarmcli charts repo list` bereits `swarmcli-charts` anzeigt: ```bash swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts ``` -## 5. Install RustFS +## 5. RustFS installieren -Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: +Installieren Sie das Chart als Release mit dem Namen `rustfs`, veröffentlichen Sie die S3-API auf Port 9000 und legen Sie beim Start einen Bucket an: ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -58,11 +58,11 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. +Der Dienst speichert seine Daten unter `/data` auf dem benannten Volume `rustfs-data`, das Docker nach dem Release als `rustfs_rustfs-data` benennt. Jeder Bucket in `buckets` wird angelegt, sobald der Server antwortet; ein bereits vorhandener Bucket bleibt unverändert, sodass Neustarts und Upgrades unbedenklich sind. -## 6. Verify the deployment +## 6. Bereitstellung prüfen -Check the release, the service task, and the S3 API health endpoint: +Prüfen Sie das Release, den Task des Dienstes und den Endpunkt für die Integritätsprüfung der S3-API: ```bash swarmcli charts status rustfs @@ -70,19 +70,19 @@ docker service ps rustfs_rustfs curl --fail http://localhost:9000/health ``` -The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. +Die S3-API ist auf jedem Swarm-Knoten unter `http://localhost:9000` erreichbar. Clients verwenden pfadbasierte Adressierung und die Region `us-east-1`. -## Exposure modes +## Bereitstellungsmodi -The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: +Das Chart stellt die S3-API und die Console unabhängig voneinander bereit. Die Console ist standardmäßig deaktiviert; aktivieren Sie sie mit `console.enabled=true`. Den Modus der S3-API legt `exposure.mode` fest, den der Console `console.exposure.mode`: -| Mode | Reachable from | +| Modus | Erreichbar von | | - | - | -| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | -| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | -| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | +| `none` (Standard) | Nur Diensten im Overlay-Netzwerk `rustfs-net`, unter `http://_rustfs:9000` | +| `published` | Einem im Routing-Mesh des Swarms veröffentlichten Port: `publish.port` für die S3-API, `console.publish.port` (9001) für die Console | +| `traefik` | Einem von Traefik gerouteten Hostnamen: `ingress.host` für die S3-API, `console.ingress.host` für die Console | -For example, to publish the Console on port 9001 as well: +So veröffentlichen Sie zum Beispiel zusätzlich die Console auf Port 9001: ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -92,40 +92,40 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -:::note[The Console port serves the S3 API too] +:::note[Der Console-Port bedient auch die S3-API] -The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. +Der Console-Listener bedient zusätzlich die vollständige signierte S3- und Admin-API. Wenn Sie nur die Console bereitstellen, ist diese API daher trotzdem unter einer öffentlichen Adresse erreichbar. Lassen Sie die Console deaktiviert, wenn Sie sie nicht verwenden. ::: -## Key values +## Wichtige Werte -| Value | Purpose | Chart default | +| Wert | Zweck | Standardwert des Charts | | - | - | - | -| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | -| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | -| `buckets` | Buckets created at start if missing | `[]` | -| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | -| `publish.port` | Published S3 API port | `9000` | -| `console.enabled` | Run the Console listener | `false` | -| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | -| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | -| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | -| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | +| `image.tag` | Tag des RustFS-Images | `""` (die vom Chart festgelegte RustFS-Version) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker-Secrets mit den Root-Anmeldedaten | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Buckets, die beim Start angelegt werden, falls sie fehlen | `[]` | +| `exposure.mode` | Bereitstellung der S3-API: `none`, `published` oder `traefik` | `none` | +| `publish.port` | Veröffentlichter Port der S3-API | `9000` | +| `console.enabled` | Console-Listener ausführen | `false` | +| `console.exposure.mode` | Bereitstellung der Console: `none`, `published` oder `traefik` | `none` | +| `persistence.nodeLabel` | Knoten-Label, an das der Dienst gebunden wird; `""` für keine Bindung | `rustfs-data` | +| `persistence.volumePath` | Hostverzeichnis, das statt des benannten Volumes unter `/data` eingebunden wird; muss `10001` gehören | `""` | +| `extraEnv` | Zusätzliche `RUSTFS_*`-Umgebungsvariablen, etwa `RUSTFS_SERVER_DOMAINS` | `{}` | -The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. +Die [README des Charts](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) beschreibt alle Werte, darunter das Routing über Traefik, Single Sign-on für die Console über OpenID Connect und das Einbinden eines Hostverzeichnisses. -## Uninstall +## Deinstallation ```bash swarmcli charts uninstall rustfs ``` -Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. +Die Deinstallation entfernt den Dienst und den Release-Verlauf. Erhalten bleiben das Daten-Volume, die beiden Docker-Secrets und das Netzwerk `rustfs-net`, das swarmcli zusammen mit dem Befehl zum Entfernen auflistet. -:::note[The data volume survives an uninstall] +:::note[Das Daten-Volume bleibt nach der Deinstallation erhalten] -A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: +Eine spätere Installation mit demselben Release-Namen bindet das Volume samt Daten wieder ein. Um die Daten zu verwerfen, entfernen Sie das Volume auf dem gekennzeichneten Knoten und, falls Sie sie nicht mehr benötigen, die Secrets: ```bash docker volume rm rustfs_rustfs-data @@ -134,8 +134,8 @@ docker secret rm rustfs-access-key rustfs-secret-key ::: -## Next steps +## Nächste Schritte - [RustFS Console](/administration/console) -- [Configure an S3 client](../../developer/examples/aws-cli.md) -- [Pre-Installation Checklists](../requirement/checklists/index.md) +- [S3-Client konfigurieren](../../developer/examples/aws-cli.md) +- [Checklisten vor der Installation](../requirement/checklists/index.md) diff --git a/content/fr/installation/container/swarm.md b/content/fr/installation/container/swarm.md index 336a94660..39df3cda6 100644 --- a/content/fr/installation/container/swarm.md +++ b/content/fr/installation/container/swarm.md @@ -1,56 +1,56 @@ --- title: "Docker Swarm" -description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +description: "Exécutez un service RustFS sur un seul nœud Docker Swarm, avec des informations d’identification stockées dans des secrets Docker, à l’aide du chart rustfs de swarmcli." --- -This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. +Cette page déploie RustFS en tant que service Docker Swarm dont les informations d’identification racine sont des secrets Docker plutôt que des variables d’environnement : RustFS les lit depuis des fichiers via `RUSTFS_ACCESS_KEY_FILE` et `RUSTFS_SECRET_KEY_FILE`, si bien qu’aucune des deux valeurs n’apparaît dans la définition du service ni dans `docker inspect`. Le déploiement utilise le [chart `rustfs`](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) du dépôt communautaire swarmcli-charts, installé avec [swarmcli](https://github.com/Eldara-Tech/swarmcli). Tous deux sont maintenus par Eldara Tech, et non par le projet RustFS. -The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. +Le chart exécute un service RustFS avec un seul disque sur un seul nœud (nœud unique, disque unique, SNSD). Un disque unique n’offre aucune redondance par codage d’effacement : le chart convient donc aux caches de build, aux cibles de sauvegarde et au stockage de blobs d’applications sur un petit swarm. Il n’exécute pas de déploiement RustFS multinœud. -## 1. Prerequisites +## 1. Prérequis -* A Docker Swarm (`docker swarm init`) and a shell on a manager node -* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) -* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh +* Un Docker Swarm (`docker swarm init`) et un shell sur un nœud manager +* swarmcli 1.11.0 ou version ultérieure : consultez le [guide d’installation de swarmcli](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) +* Le port 9000 (API S3) libre sur les nœuds du swarm, car l’étape 5 le publie sur le maillage de routage du swarm -## 2. Create the credentials as Docker secrets +## 2. Créer les informations d’identification sous forme de secrets Docker -Replace the credential placeholders, then create one secret for each key: +Remplacez les espaces réservés des informations d’identification, puis créez un secret pour chaque clé : ```bash printf '%s' '' | docker secret create rustfs-access-key - printf '%s' '' | docker secret create rustfs-secret-key - ``` -Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. +Chaque valeur doit tenir sur une seule ligne, sans espace. Pour générer une clé d’accès secrète robuste, utilisez par exemple `openssl rand -base64 30`. -:::warning[The service refuses weak credentials] +:::warning[Le service refuse les informations d’identification faibles] -The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. +Le conteneur du chart s’arrête au démarrage si l’un des secrets est absent, vide, contient un espace ou a la valeur bien connue `rustfsadmin`. Les secrets Docker ne sont pas modifiables : pour renouveler les informations d’identification, créez des secrets sous de nouveaux noms, faites-y pointer les valeurs `s3.accessKeySecret` et `s3.secretKeySecret` du chart, puis mettez à niveau la release. ::: -## 3. Label the data node +## 3. Étiqueter le nœud de données -A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: +Un volume nommé n’existe que sur un seul nœud ; le service est donc épinglé au nœud portant l’étiquette `rustfs-data=true`. Étiquetez exactement un nœud : ```bash docker node update --label-add rustfs-data=true ``` -On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. +Sur un swarm à nœud unique, vous pouvez omettre l’étiquette et ajouter plutôt `--set persistence.nodeLabel=""` à la commande d’installation de l’étape 5. -## 4. Add the chart repository +## 4. Ajouter le dépôt de charts -Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: +Ignorez cette étape si `swarmcli charts repo list` affiche déjà `swarmcli-charts` : ```bash swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts ``` -## 5. Install RustFS +## 5. Installer RustFS -Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: +Installez le chart en tant que release nommée `rustfs`, publiez l’API S3 sur le port 9000 et créez un compartiment au démarrage : ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -58,11 +58,11 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. +Le service stocke ses données sous `/data` sur le volume nommé `rustfs-data`, que Docker nomme `rustfs_rustfs-data` d’après la release. Chaque compartiment listé dans `buckets` est créé dès que le serveur répond ; un compartiment existant est laissé tel quel, de sorte que les redémarrages et les mises à niveau sont sans risque. -## 6. Verify the deployment +## 6. Vérifier le déploiement -Check the release, the service task, and the S3 API health endpoint: +Vérifiez la release, la tâche du service et le point de terminaison de contrôle d’intégrité de l’API S3 : ```bash swarmcli charts status rustfs @@ -70,19 +70,19 @@ docker service ps rustfs_rustfs curl --fail http://localhost:9000/health ``` -The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. +L’API S3 est accessible à l’adresse `http://localhost:9000` sur chaque nœud du swarm. Les clients utilisent l’adressage de type chemin et la Région `us-east-1`. -## Exposure modes +## Modes d’exposition -The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: +Le chart expose l’API S3 et la Console indépendamment l’une de l’autre. La Console est désactivée par défaut ; activez-la avec `console.enabled=true`. Le mode de l’API S3 est défini par `exposure.mode`, celui de la Console par `console.exposure.mode` : -| Mode | Reachable from | +| Mode | Accessible depuis | | - | - | -| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | -| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | -| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | +| `none` (par défaut) | Uniquement les services connectés au réseau overlay `rustfs-net`, à l’adresse `http://_rustfs:9000` | +| `published` | Un port publié sur le maillage de routage du swarm : `publish.port` pour l’API S3, `console.publish.port` (9001) pour la Console | +| `traefik` | Un nom d’hôte routé par Traefik : `ingress.host` pour l’API S3, `console.ingress.host` pour la Console | -For example, to publish the Console on port 9001 as well: +Par exemple, pour publier également la Console sur le port 9001 : ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -92,40 +92,40 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -:::note[The Console port serves the S3 API too] +:::note[Le port de la Console sert aussi l’API S3] -The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. +L’écouteur de la Console sert également l’API S3 signée complète et l’API d’administration : exposer uniquement la Console place donc tout de même cette API sur une adresse publique. Laissez la Console désactivée si vous ne l’utilisez pas. ::: -## Key values +## Valeurs principales -| Value | Purpose | Chart default | +| Valeur | Rôle | Valeur par défaut du chart | | - | - | - | -| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | -| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | -| `buckets` | Buckets created at start if missing | `[]` | -| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | -| `publish.port` | Published S3 API port | `9000` | -| `console.enabled` | Run the Console listener | `false` | -| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | -| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | -| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | -| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | +| `image.tag` | Tag de l’image RustFS | `""` (la version de RustFS fixée par le chart) | +| `s3.accessKeySecret` / `s3.secretKeySecret` | Secrets Docker contenant les informations d’identification racine | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | Compartiments créés au démarrage s’ils n’existent pas | `[]` | +| `exposure.mode` | Exposition de l’API S3 : `none`, `published` ou `traefik` | `none` | +| `publish.port` | Port publié de l’API S3 | `9000` | +| `console.enabled` | Exécuter l’écouteur de la Console | `false` | +| `console.exposure.mode` | Exposition de la Console : `none`, `published` ou `traefik` | `none` | +| `persistence.nodeLabel` | Étiquette du nœud auquel le service est épinglé ; `""` pour aucun épinglage | `rustfs-data` | +| `persistence.volumePath` | Répertoire de l’hôte monté sur `/data` à la place du volume nommé ; doit appartenir à `10001` | `""` | +| `extraEnv` | Variables d’environnement `RUSTFS_*` supplémentaires, comme `RUSTFS_SERVER_DOMAINS` | `{}` | -The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. +Le [README du chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documente toutes les valeurs, notamment le routage par Traefik, l’authentification unique (SSO) pour la Console via OpenID Connect et le montage d’un répertoire de l’hôte. -## Uninstall +## Désinstallation ```bash swarmcli charts uninstall rustfs ``` -Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. +La désinstallation supprime le service et l’historique de la release. Elle conserve le volume de données, les deux secrets Docker et le réseau `rustfs-net`, que swarmcli affiche avec la commande permettant de le supprimer. -:::note[The data volume survives an uninstall] +:::note[Le volume de données survit à la désinstallation] -A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: +Une installation ultérieure avec le même nom de release réattache le volume et ses données. Pour supprimer les données, supprimez le volume sur le nœud étiqueté, ainsi que les secrets si vous n’en avez plus besoin : ```bash docker volume rm rustfs_rustfs-data @@ -134,8 +134,8 @@ docker secret rm rustfs-access-key rustfs-secret-key ::: -## Next steps +## Étapes suivantes -- [RustFS Console](/administration/console) -- [Configure an S3 client](../../developer/examples/aws-cli.md) -- [Pre-Installation Checklists](../requirement/checklists/index.md) +- [Console RustFS](/administration/console) +- [Configurer un client S3](../../developer/examples/aws-cli.md) +- [Listes de contrôle avant l’installation](../requirement/checklists/index.md) diff --git a/content/ja/installation/container/swarm.md b/content/ja/installation/container/swarm.md index 336a94660..1a4654c75 100644 --- a/content/ja/installation/container/swarm.md +++ b/content/ja/installation/container/swarm.md @@ -1,56 +1,56 @@ --- title: "Docker Swarm" -description: "Run a single-node RustFS service on Docker Swarm with credentials stored as Docker secrets, using the swarmcli rustfs chart." +description: "swarmcli の rustfs Chart を使い、認証情報を Docker シークレットとして保持した単一ノードの RustFS サービスを Docker Swarm 上で実行します。" --- -This page deploys RustFS as a Docker Swarm service whose root credentials are Docker secrets rather than environment variables: RustFS reads them from files through `RUSTFS_ACCESS_KEY_FILE` and `RUSTFS_SECRET_KEY_FILE`, so neither value appears in the service definition or in `docker inspect`. The deployment uses the [`rustfs` chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) from the community swarmcli-charts repository, installed with [swarmcli](https://github.com/Eldara-Tech/swarmcli). Both are maintained by Eldara Tech, not by the RustFS project. +このページでは、RustFS を Docker Swarm サービスとしてデプロイします。ルート認証情報は環境変数ではなく Docker シークレットとして渡します。RustFS は `RUSTFS_ACCESS_KEY_FILE` と `RUSTFS_SECRET_KEY_FILE` を通じて認証情報をファイルから読み込むため、どちらの値もサービス定義や `docker inspect` の出力には現れません。デプロイには、コミュニティリポジトリ swarmcli-charts の [`rustfs` Chart](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) を使用し、[swarmcli](https://github.com/Eldara-Tech/swarmcli) でインストールします。どちらも RustFS プロジェクトではなく Eldara Tech がメンテナンスしています。 -The chart runs one RustFS service with one drive on one node (single-node single-disk, SNSD). A single drive has no erasure-coding redundancy, so it suits build caches, backup targets, and application blob stores on a small swarm; it does not run a multi-node RustFS deployment. +この Chart は、1 つのノード上で 1 台のドライブを使う RustFS サービスを 1 つ実行します（シングルノード・シングルディスク、SNSD）。単一ドライブにはイレイジャーコーディングによる冗長性がないため、小規模な Swarm でのビルドキャッシュ、バックアップ先、アプリケーションの Blob ストアに適しています。複数ノードにまたがる RustFS デプロイは実行しません。 -## 1. Prerequisites +## 1. 前提条件 -* A Docker Swarm (`docker swarm init`) and a shell on a manager node -* swarmcli 1.11.0 or later — see the [swarmcli installation guide](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md) -* Port 9000 (S3 API) free on the swarm nodes, because step 5 publishes it on the Swarm routing mesh +* Docker Swarm（`docker swarm init`）と、マネージャーノード上のシェル +* swarmcli 1.11.0 以降（[swarmcli のインストールガイド](https://github.com/Eldara-Tech/swarmcli/blob/main/docs/installation.md)を参照） +* Swarm ノード上でポート 9000（S3 API）が空いていること。手順 5 でこのポートを Swarm のルーティングメッシュに公開します -## 2. Create the credentials as Docker secrets +## 2. 認証情報を Docker シークレットとして作成する -Replace the credential placeholders, then create one secret for each key: +認証情報のプレースホルダーを置き換え、キーごとにシークレットを 1 つ作成します。 ```bash printf '%s' '' | docker secret create rustfs-access-key - printf '%s' '' | docker secret create rustfs-secret-key - ``` -Keep each value on one line with no whitespace inside it. Generate a strong secret key with, for example, `openssl rand -base64 30`. +各値は 1 行に収め、内部に空白文字を含めないでください。強力なシークレットアクセスキーは、たとえば `openssl rand -base64 30` で生成できます。 -:::warning[The service refuses weak credentials] +:::warning[弱い認証情報ではサービスが起動しません] -The chart's container exits at start if either secret is missing, empty, contains whitespace, or holds the well-known `rustfsadmin` value. Docker secrets cannot be edited: to rotate the credentials, create secrets under new names and point the chart's `s3.accessKeySecret` and `s3.secretKeySecret` values at them, then upgrade the release. +いずれかのシークレットが存在しない、空である、空白文字を含む、またはよく知られた値 `rustfsadmin` である場合、Chart のコンテナは起動時に終了します。Docker シークレットは編集できません。認証情報をローテーションするには、新しい名前でシークレットを作成し、Chart の `s3.accessKeySecret` と `s3.secretKeySecret` の値をそれらに向けてから、リリースをアップグレードします。 ::: -## 3. Label the data node +## 3. データノードにラベルを付ける -A named volume exists on one node only, so the service is pinned to the node labelled `rustfs-data=true`. Label exactly one node: +名前付きボリュームは 1 つのノード上にしか存在しないため、サービスは `rustfs-data=true` ラベルを持つノードに固定されます。ラベルは必ず 1 つのノードにだけ付けます。 ```bash docker node update --label-add rustfs-data=true ``` -On a single-node swarm you can skip the label and add `--set persistence.nodeLabel=""` to the install command in step 5 instead. +単一ノードの Swarm では、ラベル付けを省略し、代わりに手順 5 のインストールコマンドに `--set persistence.nodeLabel=""` を追加できます。 -## 4. Add the chart repository +## 4. Chart リポジトリを追加する -Skip this step if `swarmcli charts repo list` already shows `swarmcli-charts`: +`swarmcli charts repo list` にすでに `swarmcli-charts` が表示される場合、この手順は不要です。 ```bash swarmcli charts repo add swarmcli-charts https://eldara-tech.github.io/swarmcli-charts ``` -## 5. Install RustFS +## 5. RustFS をインストールする -Install the chart as a release named `rustfs`, publish the S3 API on port 9000, and create a bucket at start: +Chart を `rustfs` という名前のリリースとしてインストールし、S3 API をポート 9000 で公開して、起動時にバケットを 1 つ作成します。 ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -58,11 +58,11 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -The service stores its data under `/data` on the `rustfs-data` named volume, which Docker names `rustfs_rustfs-data` after the release. Each bucket in `buckets` is created once the server answers; a bucket that already exists is left alone, so restarts and upgrades are safe. +サービスはデータを名前付きボリューム `rustfs-data` の `/data` 配下に保存します。Docker はこのボリュームにリリース名を付けて `rustfs_rustfs-data` と命名します。`buckets` に指定した各バケットはサーバーが応答した時点で作成され、既存のバケットはそのまま残るため、再起動やアップグレードを行っても問題ありません。 -## 6. Verify the deployment +## 6. デプロイを確認する -Check the release, the service task, and the S3 API health endpoint: +リリース、サービスのタスク、S3 API のヘルスチェックエンドポイントを確認します。 ```bash swarmcli charts status rustfs @@ -70,19 +70,19 @@ docker service ps rustfs_rustfs curl --fail http://localhost:9000/health ``` -The S3 API is available at `http://localhost:9000` on every swarm node. Clients use path-style addressing and region `us-east-1`. +S3 API は、すべての Swarm ノードで `http://localhost:9000` から利用できます。クライアントはパス形式のアドレス指定とリージョン `us-east-1` を使用します。 -## Exposure modes +## 公開モード -The chart exposes the S3 API and the Console independently. The Console is off by default; enable it with `console.enabled=true`. The S3 API mode is `exposure.mode`, and the Console mode is `console.exposure.mode`: +Chart は S3 API と Console を個別に公開します。Console はデフォルトで無効になっており、`console.enabled=true` で有効にできます。S3 API のモードは `exposure.mode`、Console のモードは `console.exposure.mode` で指定します。 -| Mode | Reachable from | +| モード | アクセス元 | | - | - | -| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | -| `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | -| `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | +| `none`（デフォルト） | `rustfs-net` オーバーレイネットワークに接続されたサービスのみ。アドレスは `http://_rustfs:9000` | +| `published` | Swarm のルーティングメッシュに公開されたポート。S3 API は `publish.port`、Console は `console.publish.port`（9001） | +| `traefik` | Traefik がルーティングするホスト名。S3 API は `ingress.host`、Console は `console.ingress.host` | -For example, to publish the Console on port 9001 as well: +たとえば、Console もポート 9001 で公開するには次のようにします。 ```bash swarmcli charts install rustfs swarmcli-charts/rustfs \ @@ -92,40 +92,40 @@ swarmcli charts install rustfs swarmcli-charts/rustfs \ --set 'buckets={my-bucket}' ``` -:::note[The Console port serves the S3 API too] +:::note[Console のポートでも S3 API が提供されます] -The Console listener also serves the full signed S3 and admin API, so exposing only the Console still puts that API on a public address. Leave the Console disabled where you do not use it. +Console のリスナーは、署名付きの S3 API と管理 API もすべて提供します。そのため、Console だけを公開した場合でも、これらの API はパブリックなアドレスから到達可能になります。Console を使用しない場合は無効のままにしてください。 ::: -## Key values +## 主な設定値 -| Value | Purpose | Chart default | +| 値 | 用途 | Chart のデフォルト | | - | - | - | -| `image.tag` | RustFS image tag | `""` (the RustFS version the chart pins) | -| `s3.accessKeySecret` / `s3.secretKeySecret` | Docker secrets holding the root credentials | `rustfs-access-key` / `rustfs-secret-key` | -| `buckets` | Buckets created at start if missing | `[]` | -| `exposure.mode` | S3 API exposure: `none`, `published`, or `traefik` | `none` | -| `publish.port` | Published S3 API port | `9000` | -| `console.enabled` | Run the Console listener | `false` | -| `console.exposure.mode` | Console exposure: `none`, `published`, or `traefik` | `none` | -| `persistence.nodeLabel` | Node label the service is pinned to; `""` for no pin | `rustfs-data` | -| `persistence.volumePath` | Host directory bind-mounted at `/data` instead of the named volume; must be owned by `10001` | `""` | -| `extraEnv` | Additional `RUSTFS_*` environment variables, such as `RUSTFS_SERVER_DOMAINS` | `{}` | +| `image.tag` | RustFS イメージのタグ | `""`（Chart が固定している RustFS のバージョン） | +| `s3.accessKeySecret` / `s3.secretKeySecret` | ルート認証情報を保持する Docker シークレット | `rustfs-access-key` / `rustfs-secret-key` | +| `buckets` | 起動時に存在しなければ作成するバケット | `[]` | +| `exposure.mode` | S3 API の公開方法：`none`、`published`、`traefik` | `none` | +| `publish.port` | S3 API の公開ポート | `9000` | +| `console.enabled` | Console のリスナーを実行する | `false` | +| `console.exposure.mode` | Console の公開方法：`none`、`published`、`traefik` | `none` | +| `persistence.nodeLabel` | サービスを固定するノードラベル。`""` で固定しない | `rustfs-data` | +| `persistence.volumePath` | 名前付きボリュームの代わりに `/data` へバインドマウントするホストディレクトリ。所有者は `10001` である必要があります | `""` | +| `extraEnv` | 追加の `RUSTFS_*` 環境変数（`RUSTFS_SERVER_DOMAINS` など） | `{}` | -The [chart README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) documents every value, including Traefik routing, single sign-on for the Console through OpenID Connect, and the host-directory bind mount. +すべての設定値は [Chart の README](https://github.com/Eldara-Tech/swarmcli-charts/tree/main/charts/rustfs) に記載されています。Traefik によるルーティング、OpenID Connect を使った Console のシングルサインオン、ホストディレクトリのバインドマウントについてもこちらを参照してください。 -## Uninstall +## アンインストール ```bash swarmcli charts uninstall rustfs ``` -Uninstalling removes the service and the release history. It keeps the data volume, the two Docker secrets, and the `rustfs-net` network, which swarmcli lists with the command to remove it. +アンインストールすると、サービスとリリース履歴が削除されます。データボリューム、2 つの Docker シークレット、`rustfs-net` ネットワークは残ります。swarmcli はこのネットワークを、削除するためのコマンドとともに表示します。 -:::note[The data volume survives an uninstall] +:::note[データボリュームはアンインストール後も残ります] -A later install with the same release name reattaches the volume and its data. To discard the data, remove the volume on the labelled node, and remove the secrets if you no longer need them: +同じリリース名で再度インストールすると、ボリュームとそのデータが再びマウントされます。データを破棄するには、ラベルを付けたノード上でボリュームを削除します。シークレットが不要であれば、あわせて削除します。 ```bash docker volume rm rustfs_rustfs-data @@ -134,8 +134,8 @@ docker secret rm rustfs-access-key rustfs-secret-key ::: -## Next steps +## 次のステップ - [RustFS Console](/administration/console) -- [Configure an S3 client](../../developer/examples/aws-cli.md) -- [Pre-Installation Checklists](../requirement/checklists/index.md) +- [S3 クライアントを設定する](../../developer/examples/aws-cli.md) +- [インストール前チェックリスト](../requirement/checklists/index.md) From 9769963a3022bb42dbd192180ae98a2fba4cd2e1 Mon Sep 17 00:00:00 2001 From: clangenb Date: Wed, 14 Oct 2026 12:26:14 +0000 Subject: [PATCH 03/10] docs(installation): use the rustfs chart's overlay alias in the Swarm guide The released rustfs chart (rustfs/v0.1.0) adds the network alias -rustfs on rustfs-net. Point overlay clients at it instead of the stack's service name _rustfs: AWS SDK for Java clients reject a host name that contains '_'. Updated in every locale. Co-Authored-By: Claude Opus 5.5 --- content/de/installation/container/swarm.md | 2 +- content/en/installation/container/swarm.md | 2 +- content/fr/installation/container/swarm.md | 2 +- content/ja/installation/container/swarm.md | 2 +- content/zh/installation/container/swarm.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/content/de/installation/container/swarm.md b/content/de/installation/container/swarm.md index fc2df5476..0b191c948 100644 --- a/content/de/installation/container/swarm.md +++ b/content/de/installation/container/swarm.md @@ -78,7 +78,7 @@ Das Chart stellt die S3-API und die Console unabhängig voneinander bereit. Die | Modus | Erreichbar von | | - | - | -| `none` (Standard) | Nur Diensten im Overlay-Netzwerk `rustfs-net`, unter `http://_rustfs:9000` | +| `none` (Standard) | Nur Diensten im Overlay-Netzwerk `rustfs-net`, unter `http://-rustfs:9000` | | `published` | Einem im Routing-Mesh des Swarms veröffentlichten Port: `publish.port` für die S3-API, `console.publish.port` (9001) für die Console | | `traefik` | Einem von Traefik gerouteten Hostnamen: `ingress.host` für die S3-API, `console.ingress.host` für die Console | diff --git a/content/en/installation/container/swarm.md b/content/en/installation/container/swarm.md index 336a94660..0f9d890c6 100644 --- a/content/en/installation/container/swarm.md +++ b/content/en/installation/container/swarm.md @@ -78,7 +78,7 @@ The chart exposes the S3 API and the Console independently. The Console is off b | Mode | Reachable from | | - | - | -| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://_rustfs:9000` | +| `none` (default) | Only services attached to the `rustfs-net` overlay network, at `http://-rustfs:9000` | | `published` | A port published on the Swarm routing mesh: `publish.port` for the S3 API, `console.publish.port` (9001) for the Console | | `traefik` | A host name routed by Traefik: `ingress.host` for the S3 API, `console.ingress.host` for the Console | diff --git a/content/fr/installation/container/swarm.md b/content/fr/installation/container/swarm.md index 39df3cda6..7c5f1cbd2 100644 --- a/content/fr/installation/container/swarm.md +++ b/content/fr/installation/container/swarm.md @@ -78,7 +78,7 @@ Le chart expose l’API S3 et la Console indépendamment l’une de l’autre. L | Mode | Accessible depuis | | - | - | -| `none` (par défaut) | Uniquement les services connectés au réseau overlay `rustfs-net`, à l’adresse `http://_rustfs:9000` | +| `none` (par défaut) | Uniquement les services connectés au réseau overlay `rustfs-net`, à l’adresse `http://-rustfs:9000` | | `published` | Un port publié sur le maillage de routage du swarm : `publish.port` pour l’API S3, `console.publish.port` (9001) pour la Console | | `traefik` | Un nom d’hôte routé par Traefik : `ingress.host` pour l’API S3, `console.ingress.host` pour la Console | diff --git a/content/ja/installation/container/swarm.md b/content/ja/installation/container/swarm.md index 1a4654c75..b4803ba32 100644 --- a/content/ja/installation/container/swarm.md +++ b/content/ja/installation/container/swarm.md @@ -78,7 +78,7 @@ Chart は S3 API と Console を個別に公開します。Console はデフォ | モード | アクセス元 | | - | - | -| `none`（デフォルト） | `rustfs-net` オーバーレイネットワークに接続されたサービスのみ。アドレスは `http://_rustfs:9000` | +| `none`（デフォルト） | `rustfs-net` オーバーレイネットワークに接続されたサービスのみ。アドレスは `http://-rustfs:9000` | | `published` | Swarm のルーティングメッシュに公開されたポート。S3 API は `publish.port`、Console は `console.publish.port`（9001） | | `traefik` | Traefik がルーティングするホスト名。S3 API は `ingress.host`、Console は `console.ingress.host` | diff --git a/content/zh/installation/container/swarm.md b/content/zh/installation/container/swarm.md index 90de7f4a2..0719cb74b 100644 --- a/content/zh/installation/container/swarm.md +++ b/content/zh/installation/container/swarm.md @@ -78,7 +78,7 @@ S3 API 在每个 Swarm 节点上均可通过 `http://localhost:9000` 访问。 | 模式 | 可访问范围 | | - | - | -| `none`（默认） | 仅限连接到 `rustfs-net` 覆盖网络的服务，地址为 `http://_rustfs:9000` | +| `none`（默认） | 仅限连接到 `rustfs-net` 覆盖网络的服务，地址为 `http://-rustfs:9000` | | `published` | 在 Swarm 路由网格上发布的端口：S3 API 使用 `publish.port`，控制台使用 `console.publish.port`（9001） | | `traefik` | 由 Traefik 路由的主机名：S3 API 使用 `ingress.host`，控制台使用 `console.ingress.host` | From d8e2f9850ee94fea556c89e26c0678cfc97357ab Mon Sep 17 00:00:00 2001 From: clangenb Date: Thu, 15 Oct 2026 17:43:02 +0200 Subject: [PATCH 04/10] docs(home): add a Docker Swarm card to the install grid Fills the empty eighth slot in every locale and links to the Swarm guide. The icon is the SwarmCLI terminal mark (LuTerminal, same geometry). Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0187R25x4FVEZ8ox9wwLu3WV --- content/de/index.mdx | 9 +++++++++ content/en/index.mdx | 9 +++++++++ content/fr/index.mdx | 9 +++++++++ content/ja/index.mdx | 9 +++++++++ content/zh/index.mdx | 9 +++++++++ src/app.css | 8 ++++++++ src/components/brand-logo.tsx | 2 ++ 7 files changed, 55 insertions(+) diff --git a/content/de/index.mdx b/content/de/index.mdx index a8a8e8cc2..f094bfa1e 100644 --- a/content/de/index.mdx +++ b/content/de/index.mdx @@ -79,5 +79,14 @@ description: "Installieren Sie RustFS unter Linux, in Containern, auf Kubernetes