CGDMF-69: Moved from minio to s3 for naming for a more generalized approach (#62)

tluijken · wouterpot · commit cfa42a1c9b2a · 2026-03-27T11:03:41.000+01:00
* Moved from minio to s3 for naming for a more generalized approach * rename MINIO_SECRET_KEY to S3_SECRET_KEY * Update src/main/kotlin/services/StorageService.kt Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/main/kotlin/config/S3Config.kt Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * CGDMF-69: Remaining replacements from MINIO_ to S3_ * Versionbump for helm chart
diff --git a/.env.example b/.env.example
@@ -11,11 +11,11 @@ PORT=8080
 
 # MinIO configuration (object storage)
 # These are defaults; can be overridden for custom storage
-MINIO_ENDPOINT=http://localhost:9000
-MINIO_ACCESS_KEY=minioadmin
-MINIO_SECRET_KEY=minioadmin
-MINIO_BUCKET=documenten
-MINIO_URL_EXPIRY=PT15M
+S3_ENDPOINT=http://localhost:9000
+S3_ACCESS_KEY=minioadmin
+S3_SECRET_KEY=minioadmin
+S3_BUCKET=documenten
+S3_URL_EXPIRY=PT15M
 
 # OpenZaak configuration (for OpenZaak integration tests)
 # These are defaults; only needed if testing OpenZaak integration
diff --git a/.github/workflows/TEST.yml b/.github/workflows/TEST.yml
@@ -7,7 +7,7 @@ on:
     secrets:
       OPENZAAK_CLIENT_SECRET:
         required: true
-      MINIO_SECRET_KEY:
+      S3_SECRET_KEY:
         required: true
 
 jobs:
@@ -32,7 +32,7 @@ jobs:
         run: ./gradlew test --console=plain --no-daemon
         env:
           OPENZAAK_CLIENT_SECRET: ${{ secrets.OPENZAAK_CLIENT_SECRET }}
-          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
+          S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
 
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@v6
@@ -45,4 +45,4 @@ jobs:
         uses: actions/upload-artifact@v7
         with:
           name: test-results
-          path: build/test-results/test/
+          path: build/test-results/test/
diff --git a/README.md b/README.md
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -63,8 +63,8 @@ services:
       - '9000:9000'
       - '9001:9001'
     environment:
-      - MINIO_ACCESS_KEY=minioadmin
-      - MINIO_SECRET_KEY=minioadmin
+      - S3_ACCESS_KEY=minioadmin
+      - S3_SECRET_KEY=minioadmin
       - CONSOLE_ACCESS_KEY=admin
       - CONSOLE_SECRET_KEY=admin
     command: server --address ":9000" --console-address ":9001" /data
diff --git a/helm/cg-dmf/Chart.yaml b/helm/cg-dmf/Chart.yaml
@@ -4,7 +4,7 @@ description: >
   Document Management Facility (DMF) – a Proof-of-Concept implementation of the
   Common Ground Documenten API (DRC) written in Kotlin.
 type: application
-version: 0.1.0
+version: 0.2.0
 appVersion: "1.0.0"
 keywords:
   - common-ground
diff --git a/helm/cg-dmf/README.md b/helm/cg-dmf/README.md
diff --git a/helm/cg-dmf/templates/configmap.yaml b/helm/cg-dmf/templates/configmap.yaml
@@ -3,17 +3,16 @@ kind: ConfigMap
 metadata:
   name: {{ include "cg-dmf.fullname" . }}
   namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "cg-dmf.labels" . | nindent 4 }}
+  labels: {{- include "cg-dmf.labels" . | nindent 4 }}
 data:
   # Application
   BASE_URL: {{ .Values.settings.baseUrl | quote }}
   # Authentication
   OIDC_ISSUER: {{ .Values.settings.oidcIssuer | quote }}
-  ZGW_ALLOWED_CLIENT_IDS: {{ required "settings.zgwAllowedClientIds is required" .Values.settings.zgwAllowedClientIds | quote }}
-  # S3 / MinIO (non-sensitive) — env var names kept as MINIO_* until app is migrated to S3_*
-  MINIO_ENDPOINT: {{ .Values.settings.s3.endpoint | quote }}
-  MINIO_BUCKET: {{ .Values.settings.s3.bucket | quote }}
+  ZGW_ALLOWED_CLIENT_IDS: {{- required "settings.zgwAllowedClientIds is required" .Values.settings.zgwAllowedClientIds | quote }}
+  # S3 / MinIO (non-sensitive) — env var names kept as S3_* until app is migrated to S3_*
+  S3_ENDPOINT: {{ .Values.settings.s3.endpoint | quote }}
+  S3_BUCKET: {{ .Values.settings.s3.bucket | quote }}
   S3_DISABLE_CHECKSUMS: {{ .Values.settings.s3.disableChecksums | quote }}
   S3_DISABLE_CHUNKED_ENCODING: {{ .Values.settings.s3.disableChunkedEncoding | quote }}
   # OpenZaak (non-sensitive)
diff --git a/helm/cg-dmf/templates/secret.yaml b/helm/cg-dmf/templates/secret.yaml
@@ -1,58 +1,58 @@
-{{- if not .Values.settings.database.existingSecret }}
+{ { - if not .Values.settings.database.existingSecret } }
 
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "cg-dmf.databaseSecretName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: { { include "cg-dmf.databaseSecretName" . } }
+  namespace: { { .Release.Namespace } }
   labels:
-    {{- include "cg-dmf.labels" . | nindent 4 }}
+    { { - include "cg-dmf.labels" . | nindent 4 } }
   annotations:
     helm.sh/resource-policy: keep
 type: Opaque
 stringData:
-  DB_URL: {{ .Values.settings.database.url | quote }}
-  DB_USER: {{ .Values.settings.database.username | quote }}
-  DB_PASSWORD: {{ required "settings.database.password is required" .Values.settings.database.password | quote }}
+  DB_URL: { { .Values.settings.database.url | quote } }
+  DB_USER: { { .Values.settings.database.username | quote } }
+  DB_PASSWORD: { { required "settings.database.password is required" .Values.settings.database.password | quote } }
 
 ---
 
-{{- end }}
+{ { - end } }
 
-{{- if not .Values.settings.s3.existingSecret }}
+  { { - if not .Values.settings.s3.existingSecret } }
 
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "cg-dmf.s3SecretName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: { { include "cg-dmf.s3SecretName" . } }
+  namespace: { { .Release.Namespace } }
   labels:
-    {{- include "cg-dmf.labels" . | nindent 4 }}
+    { { - include "cg-dmf.labels" . | nindent 4 } }
   annotations:
     helm.sh/resource-policy: keep
 type: Opaque
 stringData:
-  # Env var names kept as MINIO_* until app is migrated to S3_*
-  MINIO_ACCESS_KEY: {{ required "settings.s3.accessKey is required" .Values.settings.s3.accessKey | quote }}
-  MINIO_SECRET_KEY: {{ required "settings.s3.secretKey is required" .Values.settings.s3.secretKey | quote }}
+  # Env var names kept as S3_* until app is migrated to S3_*
+  S3_ACCESS_KEY: { { required "settings.s3.accessKey is required" .Values.settings.s3.accessKey | quote } }
+  S3_SECRET_KEY: { { required "settings.s3.secretKey is required" .Values.settings.s3.secretKey | quote } }
 
 ---
 
-{{- end }}
+{ { - end } }
 
-{{- if not .Values.settings.openzaak.existingSecret }}
+  { { - if not .Values.settings.openzaak.existingSecret } }
 
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "cg-dmf.openzaakSecretName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: { { include "cg-dmf.openzaakSecretName" . } }
+  namespace: { { .Release.Namespace } }
   labels:
-    {{- include "cg-dmf.labels" . | nindent 4 }}
+    { { - include "cg-dmf.labels" . | nindent 4 } }
   annotations:
     helm.sh/resource-policy: keep
 type: Opaque
 stringData:
-  OPENZAAK_CLIENT_SECRET: {{ required "settings.openzaak.clientSecret is required" .Values.settings.openzaak.clientSecret | quote }}
+  OPENZAAK_CLIENT_SECRET: { { required "settings.openzaak.clientSecret is required" .Values.settings.openzaak.clientSecret | quote } }
 
-{{- end }}
+  { { - end } }
diff --git a/helm/cg-dmf/values.yaml b/helm/cg-dmf/values.yaml
@@ -66,7 +66,7 @@ ingress:
     # nginx.ingress.kubernetes.io/proxy-body-size: "0"
     # nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     # nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    # cert-manager.io/cluster-issuer: letsencrypt-production
+  # cert-manager.io/cluster-issuer: letsencrypt-production
   hosts:
     - host: cg-dmf.example.com
       paths:
@@ -85,7 +85,7 @@ resources: {}
   #   memory: 512Mi
   # requests:
   #   cpu: 100m
-  #   memory: 256Mi
+#   memory: 256Mi
 
 startupProbe:
   httpGet:
@@ -183,7 +183,7 @@ settings:
   # S3 / MinIO object storage
   # ---------------------------------------------------------------------------
   s3:
-    # -- Name of an existing Secret containing S3/MinIO credentials (keys: MINIO_ACCESS_KEY, MINIO_SECRET_KEY).
+    # -- Name of an existing Secret containing S3/MinIO credentials (keys: S3_ACCESS_KEY, S3_SECRET_KEY).
     # When set, the chart will not create a Secret and will reference this name instead.
     # Leave empty/null to let the chart manage the Secret (named <fullname>-s3).
     existingSecret: null
diff --git a/src/main/kotlin/Main.kt b/src/main/kotlin/Main.kt
@@ -7,7 +7,7 @@ import com.baseflow.api.healthModule
 import com.baseflow.api.openApiModule
 import com.baseflow.config.ApplicationConfig
 import com.baseflow.config.DatabaseConfig
-import com.baseflow.config.MinioConfig
+import com.baseflow.config.S3Config
 import com.baseflow.config.NotificationConfig
 import com.baseflow.config.appModule
 import com.baseflow.config.authenticationModule
@@ -25,7 +25,7 @@ import org.koin.ktor.plugin.Koin
 fun main() {
     ApplicationConfig.printConfig()
     DatabaseConfig.printConfig()
-    MinioConfig.printConfig()
+    S3Config.printConfig()
 
     Database.connect(
         url = DatabaseConfig.url,
diff --git a/src/main/kotlin/config/MinioConfig.kt b/src/main/kotlin/config/MinioConfig.kt
diff --git a/src/main/kotlin/config/S3ClientFactory.kt b/src/main/kotlin/config/S3ClientFactory.kt
@@ -43,26 +43,26 @@ class S3ClientFactory {
      */
     fun create(): S3AsyncClient {
         val creds = StaticCredentialsProvider.create(
-            AwsBasicCredentials.create(MinioConfig.accessKey, MinioConfig.secretKey),
+            AwsBasicCredentials.create(S3Config.accessKey, S3Config.secretKey),
         )
 
         val s3Config = S3Configuration.builder()
             .pathStyleAccessEnabled(true)
-            .chunkedEncodingEnabled(!MinioConfig.disableChunkedEncoding)
+            .chunkedEncodingEnabled(!S3Config.disableChunkedEncoding)
             .build()
 
         val httpClientBuilder = NettyNioAsyncHttpClient.builder()
             .connectionTimeout(S3_OPERATION_TIMEOUT)
             .readTimeout(S3_OPERATION_TIMEOUT)
 
         val clientBuilder = S3AsyncClient.builder()
-            .region(MinioConfig.region)
-            .endpointOverride(URI.create(MinioConfig.endpoint))
+            .region(S3Config.region)
+            .endpointOverride(URI.create(S3Config.endpoint))
             .credentialsProvider(creds)
             .httpClientBuilder(httpClientBuilder)
             .serviceConfiguration(s3Config)
 
-        if (MinioConfig.disableChecksums) {
+        if (S3Config.disableChecksums) {
             clientBuilder
                 .requestChecksumCalculation(RequestChecksumCalculation.WHEN_REQUIRED)
                 .responseChecksumValidation(ResponseChecksumValidation.WHEN_REQUIRED)
diff --git a/src/main/kotlin/config/S3Config.kt b/src/main/kotlin/config/S3Config.kt
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: EUPL-1.2
+// Copyright (C) 2025-2026 Gemeente Utrecht
+package com.baseflow.config
+
+import org.slf4j.LoggerFactory
+import software.amazon.awssdk.regions.Region
+import java.time.Duration
+
+/**
+ * S3Config reads S3 configuration from environment variables
+ * and provides it to services like StorageService.
+ */
+internal object S3Config : Config() {
+    private val logger = LoggerFactory.getLogger(S3Config::class.java)
+
+    val urlExpiry: Duration = Duration.parse(envOrSystem("S3_URL_EXPIRY", "PT15M"))
+    val endpoint: String = envOrSystem("S3_ENDPOINT", "http://localhost:9000")
+    val accessKey: String = envOrSystem("S3_ACCESS_KEY", "minioadmin")
+    val secretKey: String = envOrThrow("S3_SECRET_KEY")
+    val bucketName: String = envOrSystem("S3_BUCKET", "default-bucket")
+    val region: Region = Region.of(envOrSystem("S3_REGION", "eu-west-1"))
+    val disableChecksums: Boolean = envOrSystem("S3_DISABLE_CHECKSUMS", "false").toBoolean()
+    val disableChunkedEncoding: Boolean = envOrSystem("S3_DISABLE_CHUNKED_ENCODING", "false").toBoolean()
+
+    override fun printConfig() {
+        logger.info(
+            "S3Config: endpoint={}, accessKey={}, bucketName={}, urlExpiry={}, region={}, disableChecksums={}, disableChunkedEncoding={}",
+            endpoint,
+            accessKey,
+            bucketName,
+            urlExpiry,
+            region,
+            disableChecksums,
+            disableChunkedEncoding,
+        )
+        logger.debug("S3Config: secretKey is set: {}", secretKey.isNotEmpty())
+    }
+}
diff --git a/src/main/kotlin/services/HealthCheckService.kt b/src/main/kotlin/services/HealthCheckService.kt
@@ -2,7 +2,7 @@
 // Copyright (C) 2025-2026 Gemeente Utrecht
 package com.baseflow.services
 
-import com.baseflow.config.MinioConfig
+import com.baseflow.config.S3Config
 import com.baseflow.config.S3ClientFactory
 import kotlinx.serialization.Serializable
 import org.jetbrains.exposed.v1.jdbc.transactions.transaction
@@ -62,7 +62,7 @@ open class HealthCheckService(s3ClientFactory: S3ClientFactory) {
             // Check read access: list buckets / head bucket
             val readStatus = try {
                 val headRequest = HeadBucketRequest.builder()
-                    .bucket(MinioConfig.bucketName)
+                    .bucket(S3Config.bucketName)
                     .build()
                 try {
                     s3Client.headBucket(headRequest)
@@ -95,7 +95,7 @@ open class HealthCheckService(s3ClientFactory: S3ClientFactory) {
             val writeStatus = try {
                 val probeKey = ".healthcheck-probe-${UUID.randomUUID()}"
                 val putRequest = software.amazon.awssdk.services.s3.model.PutObjectRequest.builder()
-                    .bucket(MinioConfig.bucketName)
+                    .bucket(S3Config.bucketName)
                     .key(probeKey)
                     .build()
 
@@ -110,7 +110,7 @@ open class HealthCheckService(s3ClientFactory: S3ClientFactory) {
                 }
 
                 try {
-                    s3Client.deleteObject { it.bucket(MinioConfig.bucketName).key(probeKey) }
+                    s3Client.deleteObject { it.bucket(S3Config.bucketName).key(probeKey) }
                         .orTimeout(s3TimeoutSeconds, TimeUnit.SECONDS)
                         .join()
                 } catch (_: Exception) {
@@ -126,17 +126,17 @@ open class HealthCheckService(s3ClientFactory: S3ClientFactory) {
                     detail = "Storage write timed out after ${s3TimeoutSeconds}s",
                 )
             } catch (_: NoSuchBucketException) {
-                logger.warn("Storage write health check failed – bucket not found: {}", MinioConfig.bucketName)
+                logger.warn("Storage write health check failed – bucket not found: {}", S3Config.bucketName)
                 DependencyStatus(
                     status = "error",
-                    detail = "Bucket '${MinioConfig.bucketName}' does not exist",
+                    detail = "Bucket '${S3Config.bucketName}' does not exist",
                 )
             } catch (e: S3Exception) {
                 if (e.statusCode() == 403) {
                     logger.warn("Storage write health check failed – access denied: {}", e.message)
                     DependencyStatus(
                         status = "error",
-                        detail = "Access denied for bucket '${MinioConfig.bucketName}': ${
+                        detail = "Access denied for bucket '${S3Config.bucketName}': ${
                             e.awsErrorDetails()?.errorMessage() ?: e.message
                         }",
                     )
diff --git a/src/main/kotlin/services/StorageService.kt b/src/main/kotlin/services/StorageService.kt
