Private storage zones: S3 buckets for your projects.
A zone for each project and environment. The AWS SDKs, rclone and backup tools reach it over S3, with keys scoped to the zone and quotas you set.
Each project includes 1.0 GB in production and 100 MB in its sandbox at no charge.
- 1.0 GB
- per project in production, at no charge
- 100 MB
- more in each project's sandbox
- 20 GB
- the largest object, uploaded in parts
- 30 days
- to restore a deleted object
From nothing to a bucket
- Pick a projectZones belong to an OpenVibe project. Make one on OpenVibe.Services if you have none.
- Create a zoneA zone is a bucket: a name in one environment, sandbox or production, with an optional quota.
- Issue an access keyRead, write or both, for every zone of the environment or only some. The secret is shown once.
- Use any S3 toolPoint it at https://s3.openvibe.media with path-style addressing.
With the tools you have
Path-style addressing, region us-east-1, Signature Version 4: one request carries at most 256 MB, so larger files go up in parts (the AWS CLI, the SDKs and rclone do this by default); an object is at most 20 GB.
aws configure set aws_access_key_id ovk_…
aws configure set aws_secret_access_key …
aws --endpoint-url https://s3.openvibe.media s3 cp ./site s3://assets/ --recursive
aws --endpoint-url https://s3.openvibe.media s3 ls s3://assets/rclone config create oz s3 provider Other endpoint https://s3.openvibe.media \
access_key_id ovk_… secret_access_key … no_check_bucket true
rclone sync ./backups oz:backupsconst { S3Client, PutObjectCommand, GetObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');
const s3 = new S3Client({
endpoint: 'https://s3.openvibe.media', region: 'us-east-1', forcePathStyle: true,
credentials: { accessKeyId: 'ovk_…', secretAccessKey: process.env.ZONE_SECRET },
});
await s3.send(new PutObjectCommand({ Bucket: 'assets', Key: 'hello.txt', Body: 'Hello' }));
const url = await getSignedUrl(s3, new GetObjectCommand({ Bucket: 'assets', Key: 'hello.txt' }), { expiresIn: 3600 });const { createClient } = require('openvibe-sdk/core');
const { createZoneClient } = require('openvibe-sdk/zone');
const zone = createZoneClient(createClient({ tokenProvider: tokens })); // a project member's or app's tokens
const z = await zone.zones.create('prj_…', { env: 'production', name: 'assets', quota_bytes: 512 * 1024 ** 2 });
console.log(await zone.zones.usage(z.id));What a zone gives you
5 items
- Private by default. A named zone's objects are reached only with a signed request or a presigned URL, never a public link.
- Names that stay yours. A zone's name is never given to another zone, even after it is deleted, so a URL signed for one bucket can never reach a different one.
- Scoped keys. A key reads, writes or both, in one environment, for every zone or only the ones you name. Revoking it takes effect at once.
- Quotas you set. Each zone may have its own ceiling below the environment's.
- One deletion path. Deleting a zone removes every object and every copy of it.
Limits
Limits
What one project gets in each environment, as OpenVibe.Media, which stores the objects, enforces them.
| Limit | Production | Sandbox |
|---|---|---|
| Stored bytes (every namespace of the tenant) | 1.0 GB | 100 MB |
| Size of a single-part upload | 256 MB | 256 MB |
| Size of a multipart upload | 20 GB | 20 GB |
| Size of one multipart part | 256 MB | 256 MB |
| Hours an unfinished upload holds its quota | 72 hours | 72 hours |
| Days a deleted object can be restored | 30 days | 30 days |
These are the limits the service enforces, read from openvibe.media/limits.json.
Questions
6 questions
Which S3 operations work?
Buckets (zones) and objects: put, get, head, list, delete, presigned URLs, multipart uploads and server-side copies (CopyObject, UploadPartCopy). ACLs, bucket policies and versioning are not supported: zones are private and access is the key's.
Which tools can I use?
Any S3 client that signs with Signature Version 4 and uses path-style addressing: the AWS CLI and SDKs, rclone, restic and backup tools. Point it at https://s3.openvibe.media, region us-east-1.
Who can read my objects?
Only requests signed with a key you issued for that zone, or a presigned URL you made, until it expires or its key is revoked. A zone has no public links.
What does it cost?
Each project includes 1.0 GB in production and 100 MB in its sandbox at no charge. A zone can have its own quota below that.
What happens when I delete something?
A deleted object can be restored for 30 days. Deleting a whole zone removes every object and every copy of it, and its name is never given to another zone.
Where are my files kept?
Every object is an OpenVibe.Media object, stored and served by Media and readable through its API as well as over S3.