MinIO on OpenBSD 7.2: Configure network
Tags: minio, storage, aws, s3
Published: 2023-01-12 13:08:43

## Intro

[MinIO](https://min.io/) is one of object storage suites.
It has compatibility with [AWS](https://aws.amazon.com/) [S3](https://aws.amazon.com/s3/) and is open source written in [Go (golang)](https://go.dev/).

[OpenBSD](https://www.openbsd.org/) offers it as a [Ports](https://www.openbsd.org/faq/ports/ports.html) package, so it takes a few minutes to install it.

Well, by default, the daemon listens to the external directly.
This post shows how to configure it to block connections from WAN (Wide Area Network).
It is dealed with `--address` option.
At the same time, let [replayd](https://man.openbsd.org/relayd.8) act as proxy.

### Environment

- OS: OpenBSD [7.2](https://www.openbsd.org/72.html)
- Web proxy: relayd
- Object Storage: MinIO 0.20220826

## Body

### minio server default settings

First, check `/etc/rc.d/minio`, the daemon script of [rc.d](https://man.openbsd.org/rc.d). It starts with:

```sh
#!/bin/ksh

daemon="/usr/local/bin/minio server"
daemon_flags="/var/minio/export"
daemon_user="_minio"
(...)
```

Next, read the help of `minio server`:

```console
$ minio server --help
```

It starts with:

```console
NAME:
  minio server - start object storage server

USAGE:
  minio server [FLAGS] DIR1 [DIR2..]
  minio server [FLAGS] DIR{1...64}
  minio server [FLAGS] DIR{1...64} DIR{65...128}
(...)
```

And you will find the below in it:

```
FLAGS:
  --address value              bind to a specific ADDRESS:PORT, ADDRESS can be an IP or hostname (default: ":9000") [$MINIO_ADDRESS]
```

The `--address` option is the key.

### Introduce `--address` option

We have to overwrite `daemon_flags` in `/etc/rc.d/minio` in order to introduce `--address` option.
You have two options.

#### Option 1: Use `/etc/rc.conf.local` (recommended)

Edit [`/etc/rc.conf.local`](https://man.openbsd.org/rc.conf.local.8) to append:

```diff
+ minio_flags="--address 127.0.0.1:9000 /var/minio/export"
```

Besides, the file is not placed at OS installation. Therefore, you may have to create it this time.

It overwrites the part of the daemon script:

```sh
daemon_flags="/var/minio/export"
```

#### Option 2: Overwrite the daemon script directly

You can also modify `/etc/rc.d/minio` direcly. It may work.
Rememvber it is, however, ephemeral.

### Verify addresses minio listens to

Now the address minio listens to, which is ":9000" by default, is replaced with "127.0.0.1:9000".
Let's verify it.

```console
$ curl -I 127.0.0.1:9000
```

The output was:

```console
HTTP/1.1 400 Bad Request
Accept-Ranges: bytes
Content-Length: 261
Content-Type: application/xml
Server: MinIO
Vary: Origin
Date: Wed, 11 Jan 2023 12:30:49 GMT
```

Accepted.

How about requests from outside ?

```console
$ curl -I <minio-ip>:9000
```

The output was:

```console
curl: (56) Recv failure: Connection reset by peer
```

Blocked. OK.

### Introduce `relayd`

It's turn of [`/etc/relayd.conf`](https://man.openbsd.org/relayd.conf.5).
Create it if necessary, and write the below in it:

```apache
log connection errors

table <minio_host> { "127.0.0.1" }

minio_fqdn = "<your-fqdn>"
minio_port = "9000"

http protocol "https-filter" {
        block
        
        pass request header "Host" value $minio_fqdn \
               forward to <minio_host>
        tls keypair $minio_fqdn

        # for minio: extend http headerlen (default = 8192)
        http headerlen 24576

        # performance enhancement
        tcp { nodelay, sack, backlog 128 }

        match header set "X-Client-IP" \
                value "$REMOTE_ADDR:$REMOTE_PORT"
        match header set "X-Forwarded-For" \
                value "$REMOTE_ADDR"
        match header set "X-Forwarded-By" \
                value "$SERVER_ADDR:$SERVER_PORT"
}

relay "https" {
        listen on egress port https tls
        
        # for minio: extend session timeout (default = 600)
        session timeout 1800

        protocol "https-filter"
        forward to <minio_host> port $minio_port check tcp
}
```

For TLS connection, generate keypair for `<your-fqdn>`.
Each below of `<your-country-code>` / `<your-state>` / `<your-organization>` is up to you:

```console
$ cd /etc/ssl

$ export MYDOMAIN="<your-fqdn>"
$ export CERT_SUBJ="/C=<your-country-code (2 digits)>/ST=<your-state>/L=/O=<your-organization>/OU=/CN=$MYDOMAIN"
$ doas openssl req -newkey rsa:2048 -new -nodes -x509 -days 36500 \
      -keyout private/$MYDOMAIN.key -out $MYDOMAIN.crt -subj "$CERT_SUBJ"; \
  doas chmod 400 private/$MYDOMAIN.key
```

Be careful that the name of cert file [should be end with `.crt` on relayd](https://man.openbsd.org/relayd.conf.5#keypair).

It is self-signed certificate. Alternatively, you can use [Let's Encrypt](https://letsencrypt.org/) etc.

Activate the daemon and start it:

```console
$ doas rcctl enable relayd
relayd(ok)

$ doas rcctl start relayd
relayd(ok)
```

#### MinIO supports TLS

For the purpose of TLS usage, you don't necessarily have to use relayd, for MinIO supports [Network Encryption (TLS)](https://min.io/docs/minio/container/operations/network-encryption.html).

## Outro

Now your MinIO listens to only local address, and relayd stands between MinIO and external network.

```
[ (external) ] <--> [ (local) relayd <--> minio ]
```