s stowage
Features How it works Benchmarks Compare Install FAQ About Docs
Get started
Browse documentation
  • Start
    • Stowage documentation
  • Getting started
    • Get started
    • Quickstart: Docker Compose
    • Quickstart: Kubernetes
    • Quickstart: one-liner
    • What is Stowage
    • Your first share link
    • Your first virtual S3 credential
  • Self-host
    • Overview
      • Self-host
      • Cross-backend transfers
      • Querying and exporting the audit log
    • Authentication
      • Local username + password
      • OIDC
      • Sessions, idle timeout, lockout
      • Static config-defined account
    • Backends
      • AWS S3
      • Backblaze B2
      • Cloudflare R2
      • Connecting an S3-compatible backend in YAML
      • Garage
      • Managing endpoints from the dashboard
      • MinIO
      • SeaweedFS
      • Wasabi
    • Buckets
      • Bucket policy
      • Bucket versioning
      • CORS
      • Lifecycle rules
      • Quotas
    • Configure
      • Logging
      • SQLite path and lifecycle
      • The config file and env-var overrides
    • Install
      • Install as a Docker container
      • Install as a systemd unit
      • Install from a release binary
      • Install from source
      • Install with the script
    • Migrations
      • Migrating from the MinIO Console
    • Operations
      • Backup and restore
      • Health probes
      • Rotating STOWAGE_SECRET_KEY
      • Upgrading between releases
    • Reverse proxy
      • Caddy
      • nginx
      • Traefik
      • Why Stowage runs HTTP-only behind a proxy
    • Sharing
      • Creating and revoking shares
      • Share semantics
      • The recipient page (/s/)
  • Kubernetes
    • Overview
      • Run on Kubernetes
      • Anonymous read buckets
      • Credential rotation
      • Image pull secrets
      • Ingress
      • Kubernetes overview
      • NetworkPolicy
      • Operations on Kubernetes
      • Upgrade
      • Virtual credentials in Kubernetes
      • Webhook & cert-manager
    • CRDs
      • BucketClaim
      • S3Backend
    • Install
      • Multi-tenant install (chart + operator)
      • Operator only (against external Stowage)
      • Stowage only (no operator)
  • S3 endpoint
    • Use as an S3 endpoint
    • Anonymous read endpoints
    • Authentication and bucket scope
    • Endpoint URL convention
    • Quickstart for SDK users
    • Quota errors and retry semantics
    • Supported S3 operations matrix
  • Reference
    • Overview
      • Reference
      • Audit event catalogue
      • Backend capabilities
      • Configuration
      • Error codes
      • Helm chart values
      • HTTP API
      • Prometheus metrics
      • Wire-contract Secret data fields
    • CLI
      • CLI
      • stowage create-admin
      • stowage hash-password
      • stowage quickstart
      • stowage serve
    • CRDs
      • BucketClaim CRD reference
      • S3Backend CRD reference
    • S3 proxy
      • Proxy error responses
      • S3 proxy operations
      • SigV4 signature handling
  • Explanations
    • Explanations
    • Architecture overview
    • Audit sampling tradeoffs
    • Benchmarks
    • How quotas are enforced
    • No community edition
    • Roadmap
    • The operator's reconciliation model
    • The SigV4 proxy
    • Threat model
    • Why a single binary
    • Why AGPL
  • Comparisons
    • Comparisons
    • Stowage vs Cyberduck
    • Stowage vs MinIO Console
    • Stowage vs raw S3 + presigned URLs
  • Security
    • Security
    • Hardening checklist
    • Known limitations
    • Reporting a vulnerability
    • Security model
  • Releases
    • Releases
    • Changelog
    • Deprecation policy
    • Upgrade guides
  • Contribute
    • Contributing
    • Authoring docs
    • Build, test, lint
    • Contributing
    • DCO sign-off
    • Frontend conventions
    • Repo layout
  • Start
    • Stowage documentation
  • Getting started
    • Get started
    • Quickstart: Docker Compose
    • Quickstart: Kubernetes
    • Quickstart: one-liner
    • What is Stowage
    • Your first share link
    • Your first virtual S3 credential
  • Self-host
    • Overview
      • Self-host
      • Cross-backend transfers
      • Querying and exporting the audit log
    • Authentication
      • Local username + password
      • OIDC
      • Sessions, idle timeout, lockout
      • Static config-defined account
    • Backends
      • AWS S3
      • Backblaze B2
      • Cloudflare R2
      • Connecting an S3-compatible backend in YAML
      • Garage
      • Managing endpoints from the dashboard
      • MinIO
      • SeaweedFS
      • Wasabi
    • Buckets
      • Bucket policy
      • Bucket versioning
      • CORS
      • Lifecycle rules
      • Quotas
    • Configure
      • Logging
      • SQLite path and lifecycle
      • The config file and env-var overrides
    • Install
      • Install as a Docker container
      • Install as a systemd unit
      • Install from a release binary
      • Install from source
      • Install with the script
    • Migrations
      • Migrating from the MinIO Console
    • Operations
      • Backup and restore
      • Health probes
      • Rotating STOWAGE_SECRET_KEY
      • Upgrading between releases
    • Reverse proxy
      • Caddy
      • nginx
      • Traefik
      • Why Stowage runs HTTP-only behind a proxy
    • Sharing
      • Creating and revoking shares
      • Share semantics
      • The recipient page (/s/)
  • Kubernetes
    • Overview
      • Run on Kubernetes
      • Anonymous read buckets
      • Credential rotation
      • Image pull secrets
      • Ingress
      • Kubernetes overview
      • NetworkPolicy
      • Operations on Kubernetes
      • Upgrade
      • Virtual credentials in Kubernetes
      • Webhook & cert-manager
    • CRDs
      • BucketClaim
      • S3Backend
    • Install
      • Multi-tenant install (chart + operator)
      • Operator only (against external Stowage)
      • Stowage only (no operator)
  • S3 endpoint
    • Use as an S3 endpoint
    • Anonymous read endpoints
    • Authentication and bucket scope
    • Endpoint URL convention
    • Quickstart for SDK users
    • Quota errors and retry semantics
    • Supported S3 operations matrix
  • Reference
    • Overview
      • Reference
      • Audit event catalogue
      • Backend capabilities
      • Configuration
      • Error codes
      • Helm chart values
      • HTTP API
      • Prometheus metrics
      • Wire-contract Secret data fields
    • CLI
      • CLI
      • stowage create-admin
      • stowage hash-password
      • stowage quickstart
      • stowage serve
    • CRDs
      • BucketClaim CRD reference
      • S3Backend CRD reference
    • S3 proxy
      • Proxy error responses
      • S3 proxy operations
      • SigV4 signature handling
  • Explanations
    • Explanations
    • Architecture overview
    • Audit sampling tradeoffs
    • Benchmarks
    • How quotas are enforced
    • No community edition
    • Roadmap
    • The operator's reconciliation model
    • The SigV4 proxy
    • Threat model
    • Why a single binary
    • Why AGPL
  • Comparisons
    • Comparisons
    • Stowage vs Cyberduck
    • Stowage vs MinIO Console
    • Stowage vs raw S3 + presigned URLs
  • Security
    • Security
    • Hardening checklist
    • Known limitations
    • Reporting a vulnerability
    • Security model
  • Releases
    • Releases
    • Changelog
    • Deprecation policy
    • Upgrade guides
  • Contribute
    • Contributing
    • Authoring docs
    • Build, test, lint
    • Contributing
    • DCO sign-off
    • Frontend conventions
    • Repo layout
Documentation

Self-host

Task-oriented recipes for running Stowage outside Kubernetes — on a VM, a bare-metal box, or a single container. Each page assumes you've done a quickstart and now want to do something specific.

#Install

  • Using the install script
  • From a release binary
  • From source
  • As a Docker container
  • As a systemd unit

#Configure

  • The config file and env-var overrides
  • Logging
  • SQLite path and lifecycle

#Authentication

  • Local username + password
  • Static config-defined account
  • OIDC
  • Sessions, idle timeout, lockout

#Reverse proxy and TLS

  • Why Stowage runs HTTP-only behind a proxy
  • nginx
  • Caddy
  • Traefik

#Backends

  • Connecting an S3-compatible backend in YAML
  • Managing endpoints from the dashboard
  • Per-vendor recipes:
    • MinIO
    • Garage
    • SeaweedFS
    • AWS S3
    • Backblaze B2
    • Cloudflare R2
    • Wasabi

#Bucket administration

  • Versioning
  • Bucket policy
  • CORS
  • Lifecycle rules
  • Quotas

#Sharing

  • Creating and revoking shares
  • Share semantics: passwords, expiry, download caps
  • The recipient page (/s/<code>)

#Cross-backend transfers

  • Copying between backends

#Audit

  • Querying and exporting the audit log

#Operations

  • Health probes
  • Backup and restore
  • Rotating STOWAGE_SECRET_KEY
  • Upgrading between releases

#Migrating to Stowage

  • From the MinIO Console
← Previous Your first virtual S3 credential Next → Cross-backend transfers
On this page
  • Install
  • Configure
  • Authentication
  • Reverse proxy and TLS
  • Backends
  • Bucket administration
  • Sharing
  • Cross-backend transfers
  • Audit
  • Operations
  • Migrating to Stowage
s stowage
A self-hosted web dashboard for any S3-compatible storage. Built by operators, for operators.
Product
  • Features
  • Benchmarks
  • Compare
  • Install
  • FAQ
Docs
  • Overview
  • Getting started
  • Self-host
  • Kubernetes
  • S3 endpoint
  • Reference
Project
  • GitHub
  • Releases
  • Changelog
  • What's next
Community
  • Discussions
  • Issues
  • About
  • License

Created and maintained by Damian van der Merwe.

© 2026 the Stowage maintainers. AGPL-3.0-or-later. v1.0 · latest release