frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Show HN: I built a S3 proxy that combines storage from S3/clouds into one target

https://github.com/afreidah/s3-orchestrator
2•munch-o-man•1h ago
I wanted offsite copies of my nomad cluster backups without paying. So I started thinking about how to maximize free S3 storage from multiple providers. What if I could just stack them all together and treat them as one big bucket? I started hacking out a simple proxy and then I was having fun, so I kept building. My weekend project turned into what is basically a fully production-ready S3 orchestration service. You configure multiple S3-compatible backends (AWS, OCI, Backblaze, R2, MinIO, whatever), set a quota on each one, and the orchestrator presents them to your apps as a single S3 endpoint. Clients just sees one bucket with no idea files are being spread across multiple s3 providers

What makes it useful:

- Combine free tiers — set per-backend quotas to match each provider's free limit and the proxy fills them in order (pack mode) or evenly (spread mode). 10GB + 10GB + 10GB = 30GB of free offsite storage

- Multi-cloud replication — set replication.factor: 2 and every object automatically lands on two different providers. Instant redundancy, zero client-side changes

- Full S3 API — works with aws cli, rclone, boto3, any S3 SDK. SigV4 auth, multipart uploads, range reads, batch deletes, the works

- Virtual buckets — multiple apps can share the orchestrator with isolated namespaces and independent credentials

- Monthly usage limits — cap API requests, egress, and ingress per backend so you never blow past a free tier

- Write safety — all metadata and quota updates happen inside PostgreSQL transactions. Object location inserts and quota counter changes are atomic — if anything fails, the whole operation rolls back. Orphaned objects from partial failures get caught by a persistent cleanup queue with exponential backoff retry instead of silently leaking storage

- TLS and mTLS — native TLS termination with configurable min version (1.2/1.3), plus mutual TLS support for environments where you want to restrict access to clients with a valid certificate. Certificate reload on SIGHUP for zero-downtime rotation

- Multi-instance / split-mode deployment — run with -mode all (default), -mode api (request serving only), or -mode worker (background tasks only). Scale API instances independently from workers behind a load balancer.

- Trusted proxy awareness — configure trusted CIDR ranges so rate limiting targets real client IPs from X-Forwarded-For, not your load balancer (rebalancer, replicator, cleanup queue, lifecycle) use PostgreSQL advisory locks so only one worker runs each task at a time — no duplicate work, no coordination needed

- Circuit breaker — if the metadata DB goes down, reads keep working via broadcast to all backends. Writes fail cleanly

- Automatic rebalancing — if you add a new backend, the rebalancer redistributes objects across all of them

- Backend draining — need to remove a provider? s3-orchestrator admin drain <backend> live-migrates all objects off that backend to the remaining pool with progress tracking. Once drained, admin remove-backend cleans up the database records (optionally purging the S3 objects too). No downtime, no manual file shuffling — swap providers without your clients noticing

- Web dashboard — storage summary, backend status, file browser, upload/delete, log viewer

- Production observability — Prometheus metrics (60+ gauges/counters), OpenTelemetry tracing, structured audit logging with request ID correlation

- Lifecycle rules — auto-expire objects by prefix and age

- Config hot-reload — update credentials, quotas, rate limits, replication, and rebalance settings without restarting via SIGHUP

- Comes with production ready Kubernetes and Nomad manifests/jobs that can be run with, a custom grafana dashboard utilizing the exported metrics

A bit nervous to share this but I think it is ready to be seen and maybe somebody else would find it useful.

Comments

munch-o-man•1h ago
author here: I've been running this in my homelab nomad/consul/vault cluster for a while now and it has been working great. My temporal job that does nightly backups of nomad/consul/vault/postgres now has an extra step to push to s3-orchestrator too and if it gets an error that no backend has available space it will delete the oldest backup of that type and then try again. Right now I have it doing "spread" routing between OCI and Cloudflare s3-compatible storage because they offer the best always-free s3 storage and I was already using cloudflare and running four nomad clients on oracle cloud connected to my cluster via wireguard (I would never give oracle a cent of my money but when they are offering 26gb of compute in always-free tier I'll take every bit of it thanks).

The coolest way to test this out is to just clone it and then run either:

make nomad-demo

make kubernetes-demo

that will spin up the docker-compose crap used for integration testing (two minio instances and a postgres) then start kubernetes via k3d or nomad via -dev mode, build the docker image, ingest it, run it, and print out a handy list of urls for different dashboards/metrics/ui/etc. The grafana dashboard in the repo is automatically ingested by grafana in the two "-demo" modes so you can literally run one command to run it and immediately play with the ui, see visualizations of the metrics, and start playing with it in a safe sandboxed environment.

For people that aren't just trying to get as much free storage as possible the storage and api/ingress/egress quotas can still be super useful in cost management since you can cap yourself.

The other cool use is if you needed data replicated across two different clouds for [reasons] this will do all that work for you if you set a replication factor and your application doesn't have to know anything about it...just point it at this instead of the actual s3 backend.

Also the ability to drain a backend could be super useful if you are trying to get off a certain cloud without taking downtime.

This is engineered to be highly durable...instead of failing it degrades and returns to healthy when conditions improve and the postgres is back...and it stops all writes when postgres is down since no usage would be tracked.

also, if you have an existing bucket that you want to bring under management by the s3-orchestrator it has sync functionality...the only thing it can't import is the monthly api-calls/ingress/egress from before the sync.

I'm open to all advice and comments. Pretty nervous sharing this.

Speculative Speculative Decoding (SSD)

https://arxiv.org/abs/2603.03251
1•E-Reverance•37s ago•0 comments

Just Send the Prompt

https://justsendtheprompt.com/
16•medalblue•10m ago•9 comments

Show HN: My AI hires humans for physical tasks, calls them biological units

https://crawde.com/hire
2•crawde•11m ago•0 comments

Extending the Demo: Destruction Derby

https://32bits.substack.com/p/extending-the-demo-destruction-derby
1•farmerbb•12m ago•0 comments

News Corp, Meta in AI Content Licensing Deal Worth Up to $50M a Year

https://www.wsj.com/business/media/news-corp-meta-in-ai-content-licensing-deal-worth-up-to-50-mil...
1•bookofjoe•13m ago•2 comments

Show HN: A visual sitemap generator that maps any website's full navigation tree

2•epic_ai•13m ago•1 comments

CIA working to arm Kurdish forces to spark uprising in Iran, sources say

https://www.cnn.com/2026/03/03/politics/cia-arming-kurds-iran
5•vinnyglennon•18m ago•0 comments

MoneyCollect provides warm and human-centered payment protection for merchants

https://www.moneycollect.com/
1•jerryoverwrite•18m ago•0 comments

Current state of OpenClaw and bot protections

https://proxybase.xyz/blog/openclaw-bot-protections
1•m00dy•19m ago•0 comments

LLMs can unmask pseudonymous users at scale with surprising accuracy

https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users-at-scale-with-surpris...
5•Gagarin1917•24m ago•0 comments

LexisNexis confirms React2Shell powered data breach

https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-st...
4•esaym•25m ago•0 comments

New Python library by Guido van Rossum

https://github.com/microsoft/typeagent-py
1•tzury•26m ago•1 comments

YGG, Largest French Torrent Tracker, Hacked

https://yggleak.top/fr/home/ygg-dossier
1•TechSquidTV•27m ago•0 comments

Stop Trying to Hand Trump a Censorship Weapon

https://www.techdirt.com/2026/03/03/ron-wyden-is-begging-his-colleagues-to-stop-trying-to-hand-tr...
5•HotGarbage•27m ago•0 comments

We are now on Substack Give us a follow

https://substack.com/profile/387803331-pcg-inc/note/c-222710211
1•CCK80LLC•40m ago•0 comments

An AI Just Did Everything I Do on a Computer – Written by the AI Itself

https://coasty.ai/
1•PrateekJ17•41m ago•1 comments

Mac external displays for designers and developers, part 2

https://bjango.com/articles/macexternaldisplays2/
9•fragmede•41m ago•2 comments

New Launch Workshops and Masterclasses

https://www.pretium-inc.com/workshops
1•CCK80LLC•42m ago•0 comments

Oscar Six Radar – vulnerability scanner with native A2A (agent-to-agent) support

1•oscarsixsecllc•44m ago•0 comments

Show HN: Lip Flip Before and After – Real Results and AI Preview

https://lipflip.ai/
1•ovelv•45m ago•0 comments

Yes... and...

https://htmx.org/essays/yes-and/
2•rammy1234•47m ago•1 comments

Show HN: Term-CLI – interactive terminals for AI agents (for SSH/TUI/REPL flows)

https://github.com/EliasOenal/term-cli
3•eliasoe•47m ago•0 comments

The secret green shelters that feed London's cabbies (2018)

https://www.bbc.com/travel/article/20180430-the-secret-green-shelters-that-feed-londons-cabbies
2•1659447091•48m ago•0 comments

Show HN: Hanaco Garden – A Calm iOS Garden

https://apps.apple.com/us/app/hanaco-garden/id6759095190
3•tsuyoshi_k•50m ago•1 comments

Number Research Inc

https://numberresearch.xyz/
2•eieio•50m ago•0 comments

Show HN: Docker pulls more than it needs to

https://dockerpull.com
2•a_t48•53m ago•3 comments

Show HN: Schelling Protocol – Where AI agents coordinate on behalf of humans

https://github.com/codyz123/schelling-protocol
2•codyz123•53m ago•1 comments

We built high speed threat hunting for email security

https://sublime.security/blog/how-we-built-high-speed-threat-hunting-for-email-security/
2•jkamdjou•57m ago•0 comments

MrBeast Is Getting into Financial Services. Parents Should Pay Attention

https://www.nytimes.com/2026/03/03/business/mrbeast-step-banking-crypto.html
12•sigwinch•1h ago•3 comments

Graphics Programming Resources

https://develop--gpvm-website.netlify.app/resources/
9•abetusk•1h ago•0 comments