XNS Relayer · What's New
What's changed since you last tried XNS
The Relayer app has been rebuilt and expanded since late 2025. The S3 Gateway reached general availability at v2.0.0 on June 16, 2026 and is now at v2.9.0 — here's what landed.
Full capability comparison
Relayer v1.1.0 vs v2.9.0 —
what changed across 76 features
Grouped by domain. ✓ = present · ✗ = absent · ~ = partial. Notes include version numbers and specific technical changes.
| Feature / Capability | v1.1.0 (.235) | v2.9.0 (.109) | Notes |
|---|---|---|---|
| S3 Protocol Surface | |||
| PutObject | ✓ | ✓ | v1.1.0: MinIO fork. v3.56.0: streaming; fixed 50 MB + 96 MB/upload memory ceiling |
| GetObject (inline + streaming) | ✓ | ✓ | Separate inline/stream paths in v3.56.0; no 96 MiB cap on large GETs |
| GetObject byte-range (RFC 7233 / 206 Partial Content) | ~ | ✓ | Added v1.3.0; v1.1.0 MinIO behavior not confirmed in research |
| HeadObject | ~ | ✓ | v3.56.0: returns x-amz-delete-marker: true on delete markers with 405 |
| DeleteObject | ✓ | ✓ | v3.56.0: versioning-aware; creates delete marker on versioned buckets |
| DeleteObjects (bulk / quiet mode) | ~ | ✓ | Added v1.4.0; single-transaction; 1,000-key delete: ~30s → sub-second |
| ListObjectsV1 | ✓ | ✓ | v3.56.0 added v1.5.0; correct Owner, ContinuationToken echoed, MaxKeys=0 returns empty |
| ListObjectsV2 (continuation tokens) | ~ | ✓ | V1→V2 translation; KeyCount correct (objects + common prefixes); NextContinuationToken on truncated pages |
| ListObjectVersions (pagination) | ✗ | ✓ | Added v1.7.0; pagination cursor corrected v1.26.5 |
| GetObjectAttributes | ✗ | ✓ | Added v1.5.0 |
| GetObject / HeadObject ?partNumber=N | ✗ | ✓ | Added v1.31.0; returns 206 + x-amz-mp-parts-count |
| Multipart Upload (Create / Upload / Complete / Abort / ListParts / ListMultipartUploads) | ~ | ✓ | v3.56.0: sessions persist across gateway restart (DB-backed v1.31.6); orphan reaper; idempotent part resend |
| CopyObject (physical streaming) | ~ | ✓ | Added v1.17.0; all four x-amz-copy-source-if-* conditionals; COPY/REPLACE metadata directive |
| CopyObject (logical / sector-set reference counting) | ✗ | ✓ | Added v1.19.0; shared objects skip gateway byte deletion; last-ref triggers physical delete; dedup-transparent billing |
| UploadPartCopy | ~ | ✓ | Added v1.17.0 |
| Bucket CRUD (CreateBucket / HeadBucket / DeleteBucket) | ✓ | ✓ | WORM Compliance enforced on DeleteBucket; same-owner idempotent CreateBucket; GetBucketLocation returns stored LocationConstraint |
| ListBuckets | ✓ | ✓ | v3.56.0: tenant-scoped (caller's cost_center only); pagination added v1.30.2 |
| S3 Object Versioning (PutBucketVersioning / delete markers / null-version semantics) | ✗ | ✓ | Added v1.7.0; null-version GET semantics fixed v1.26.4; suspend guard on Object Lock buckets |
| Object Lock — Compliance mode | ✗ | ✓ | Added v1.7.0; no override until retention expires; per-tenant isolated v2.3.0 |
| Object Lock — Governance mode | ✗ | ✓ | Added v1.7.0; bypass requires x-amz-bypass-governance-retention header + audit entry |
| S3 Legal Hold | ✗ | ✓ | Added v1.7.0 |
| S3 Lifecycle (age-based expiration / noncurrent cleanup / orphan abort) | ✗ | ✓ | Added v1.7.0; background executor; lifecycle sweep inserts delete marker on versioned buckets |
| S3 Lifecycle (date-based / ExpiredObjectDeleteMarker) | ✗ | ✓ | Added v1.30.2; x-amz-expiration response header added v2.2.0 |
| S3 Object Tagging | ✗ | ✓ | Added v1.10.0; 10-tag limit per object |
| S3 Bucket Tagging | ✗ | ✓ | Added v1.10.0 |
| ACL operations (GetBucketAcl / PutBucketAcl / GetObjectAcl / PutObjectAcl) | ~ | ✓ | Added v1.8.0 |
| Bucket Encryption config (PutBucketEncryption / GetBucketEncryption / DeleteBucketEncryption) | ✗ | ✓ | Added v1.8.0; AES256 applied; aws:kms returns 501 (was silently accepted in MinIO, never applied) |
| CORS config (PutBucketCors / GetBucketCors / DeleteBucketCors) | ✗ | ✓ | Added v1.8.0 |
| Bucket Policy (store + full condition enforcement) | ✗ | ✓ | Store v1.5.0; enforcement v1.11.0; full Conditions (StringLike, ArnLike, IpAddress, etc.) v2.2.0–v2.3.0 |
| GetBucketPolicyStatus (IsPublic) | ✗ | ✓ | Added v2.2.0; BUG-258 under-reported IsPublic fixed v2.3.0 |
| S3 Event Notifications (webhook delivery) | ✗ | ✓ | Added v1.16.0; SSRF protection; 4-attempt retry with backoff; HMAC-signed |
| S3 Event Notifications (Kafka publisher) | ✗ | ✓ | Added v1.10.0; buffered channel, non-blocking |
| Conditional Writes (If-None-Match:* CAS create / If-Match optimistic lock) | ✗ | ✓ | Added v1.10.0 |
| Conditional reads (full RFC 7232: If-Match / If-None-Match / If-Modified-Since / If-Unmodified-Since) | ✗ | ✓ | Added v1.26.5; §6 precedence rules enforced |
| POST Object (RFC 1867 / HTML form upload / POST policy) | ✗ | ✓ | Added v1.30.0; SigV4 POST policy auth; ${filename} substitution; 204/201/303 response variants |
| Presigned URLs (governed via STS credentials) | ✗ | ✓ | Added v1.25.0; expiry clamped to credential remaining lifetime |
| SigV4 — standard | ~ | ✓ | v1.1.0: MinIO fork had basic SigV4. v3.56.0: clean-room extraction v1.3.0 |
| SigV4 — presigned + streaming | ~ | ✓ | Added v1.3.0 |
| SigV4 — UNSIGNED-PAYLOAD-TRAILER (boto3 ≥1.36) | ✗ | ✓ | Added v1.26.2; without this, chunk framing was stored as raw object bytes |
| SigV2 (legacy client support) | ~ | ✓ | Added v1.31.7; 11 SigV2 test variants pass |
| Object metadata forwarding (x-amz-meta-*) | ~ | ✓ | Added v1.5.0 |
| Content-MD5 validation on PutObject | ~ | ✓ | Added v1.31.6 |
| encoding-type=url on ListObjectsV1/V2 | ✗ | ✓ | Added v1.30.2 |
| High-fanout prefix performance (e.g. .git/objects/ store) | ✗ | ✓ | Fixed v1.56.0; indexed half-open range bounds; 1,812ms → 3.5ms (500× speedup) |
| IAM / Identity & Access Management | |||
| IAM user management (create / list / delete / enable / disable) | ~ | ✓ | v1.1.0: MinIO user model only. v3.56.0: S3 IAM from scratch v1.6.0; enable/disable without delete v1.9.0 |
| IAM policy evaluation (deny-overrides-allow, Conditions) | ✗ | ✓ | Added v1.6.0; Conditions (StringEquals, ArnLike, IpAddress, NotAction, etc.) v2.2.0–v2.3.0 |
| IAM Groups | ~ | ✓ | v1.1.0: MinIO groups. v3.56.0: clean S3 IAM groups v1.9.0; group-aware evaluation unions direct + group policies |
| Service Accounts (scoped credentials, ceiling enforced) | ✗ | ✓ | Added v1.9.0; SA policy intersected with parent via EvaluateWithCeiling(); secret shown once on creation |
| Canned policies | ~ | ✓ | v1.1.0: 3 built-in (MinIO). v3.56.0: 4 canned (ReadOnly 14 actions, WriteOnly 8, ReadWrite, FullAccess) |
| IAM policy explain endpoint (per-statement breakdown) | ✗ | ✓ | POST /admin/v1/policies/explain; added v1.21.0; uses same evaluation path as runtime — cannot diverge |
| IAM denial reason codes | ✗ | ✓ | Added v1.21.0: ceiling_exceeded, scoped_policy_deny, no_matching_allow, explicit_deny |
| IAM role provisioning via AWS ?Action= dialect (boto3 / CLI / Terraform) | ✗ | ✓ | Added v2.2.0; 11 verbs: CreateRole, GetRole, DeleteRole, ListRoles, PutRolePolicy, GetRolePolicy, DeleteRolePolicy, CreateOpenIDConnectProvider, GetOpenIDConnectProvider, DeleteOpenIDConnectProvider, ListOpenIDConnectProviders |
| OIDC provider management | ✗ | ✓ | Added v2.2.0; conditions enforced against signature-verified claim set; fail-closed |
| Admin API rate limiting (100 req/min per-IP, 500 req/min global) | ✗ | ✓ | Added v1.6.0 |
| Muse-gate (HTTP 402 on suspended billing) | ✗ | ✓ | Added v1.26.0; grace state allows reads; runs after SigV4 on all three auth paths |
| STS / Temporary Credentials | |||
| AssumeRole (TTL-bounded temporary credentials) | ✗ | ✓ | Added v1.5.0; 900–43200s TTL; AES-256-GCM encrypted at rest |
| AssumeRoleWithWebIdentity (OIDC federation) | ✗ | ✓ | Added v2.2.0; role trust chain evaluated against signature-verified OIDC claims; fail-closed |
| GetSessionToken | ✗ | ✓ | Added v2.2.0; permanent-AK only; 900–43200s DurationSeconds |
| GetCallerIdentity | ✗ | ✓ | Added v1.31.9; root / IAM sub-user / assumed-role ARN shapes; BUG-253 fixed v2.3.0 |
| STS bucket-scoped credentials | ✗ | ✓ | Added v1.21.0; scoped_policy_deny on cross-bucket use |
| STS credential revocation cascade (delete user/SA → delete all derived tokens) | ✗ | ✓ | Added v1.21.0 |
| STS role ceiling (role's own permissions_policy as session ceiling) | ✗ | ✓ | Added v2.3.0; snapshotted into ceiling_policy at mint; shadow-user workaround removed |
| Multi-Tenancy | |||
| Per-request tenant identity resolution (cost_center from calling credential) | ✗ | ✓ | Added v2.2.0 (E1); prior model collapsed every credential to one gateway owner at boot |
| Per-tenant storage namespace (no bucket name collision between tenants) | ✗ | ✓ | Added v2.2.0 (E3); objects live under <bucketBase>/<cost_center>/<bucket>; migration s3gw-054 |
| Tenant lifecycle CRUD (create / suspend / reactivate / delete) | ✗ | ✓ | Added v2.3.0 (OU1); s3_tenants table (migration s3gw-056); force-delete = tombstone |
| Per-tenant quota enforcement (bytes + object count) | ✗ | ✓ | Added v2.3.0 (OU2/E5); 403 QuotaExceeded on writes; reads/deletes always serve; fail-open if costlog down |
| Per-tenant rate limiting (HTTP 503 SlowDown, noisy-tenant isolation) | ✗ | ✓ | Added v2.2.0 (E6); CostCenterLimiter; noisy tenant throttled without affecting neighbors |
| Per-tenant usage + audit export (JSON or CSV) | ✗ | ✓ | Added v2.3.0 (OU3); GET /admin/v1/usage, /audit, /buckets per cost_center |
| Per-tenant billing API (bytes_in / bytes_out / bytes_stored / request_count) | ✗ | ✓ | Added v2.3.0 (E4); per-tenant rollup for billing period |
| Credential-table Row Level Security (FORCE ROW LEVEL SECURITY, fail-closed) | ✗ | ✓ | Added v2.3.0 (OU6); s3gw_runtime NOLOGIN role; forgotten thread yields 0 rows, never all-tenant |
| Box self-identification at boot (stamps own cost_center from HostIO token) | ✗ | ✓ | Added v2.3.0 (OU8); billing and enforcement can never disagree about box identity |
| Per-tenant VPD placement binding (cost_center → host set, fail-closed) | ✗ | ✓ | Added v2.2.0 (store + matcher, E8); upload-time enforcement closed v2.3.0; sub-quorum → too-few-hosts error |
| Per-tenant Object Lock / WORM isolation | ✗ | ✓ | Added v2.3.0 (E7); all SQL statements thread cost_center; tenant A cannot alter tenant B's WORM config |
| VPD / Provider Selection | |||
| Geographic provider selection (continent / XNS region presets) | ✓ | ✓ | v1.1.0: present but client-evaluated. v3.56.0: server-authoritative |
| Country-level CEL expression builder | ~ | ✓ | v1.1.0: dev route, not linked from nav. v3.56.0: promoted, server-authoritative |
| Distance-based filtering (Haversine, configurable lat/lng) | ~ | ✓ | v1.1.0: dev-only sub-route. v3.56.0: Distance Dimension added v3.30.0; real bounding-box compose |
| VPD evaluation server-authoritative (client-side CEL re-implementations removed) | ✗ | ✓ | Fixed v3.44.0; grep-gate test enforces absence of client-side CEL |
| Host performance ranking (numeric score CEL expression, ranked host list) | ✗ | ✓ | Added v2.3.0 / v3.55.0; optional second CEL expression; hosts ranked highest-score-first |
| Tier-B host performance tags (host.downtime_recent / host.uptime_recent / host.accepting_contracts) | ✗ | ✓ | Added v2.3.0; windowed 21-day downtime/uptime; null-padded for hosts with no scan |
| Egress health detection engine (ok / client_network_degraded / fleet_degraded) | ✗ | ✓ | Added v2.2.0 (M1–M4); windowed EgressTracker; GET /v1/hostio/health egress_stats |
| Per-tenant VPD binding store | ✗ | ✓ | POST /v1/hostio/SetTenantExpressions; added v2.2.0; upload-time enforcement closed v2.3.0 |
| Observability & Monitoring | |||
| Prometheus: s3gateway requests_total + request_duration_seconds | ✗ | ✓ | Added v1.2.0 |
| Prometheus: bytes_transferred_total (direction, route) | ✗ | ✓ | Added v1.4.0 |
| Prometheus: HostIO egress health series | ✗ | ✓ | Added v3.49.0; /metrics moved to admin :9101 at v1.31.6 to prevent auth bypass |
| BridgeExporter PM2 process (:9091, 16 self-health series) | ✗ | ✓ | Added v3.25.0; HostIO health, Gateway, PM2 stats, Postgres every 30s |
| Node Health monitoring dashboard (uPlot native) | ✗ | ✓ | Added v3.25.0–v3.27.0; real-time CPU/memory/disk for host OS and container |
| Service Health monitoring dashboard | ✗ | ✓ | Added v3.25.0–v3.27.0; per-service up/down status |
| S3/API Health monitoring dashboard | ✗ | ✓ | Added v3.25.0–v3.27.0; request rate, error rates by operation, latency |
| Storage & Placement monitoring dashboard | ✗ | ✓ | Added v3.27.0–v3.28.0; sector placement, host availability, write activity |
| Repair & Durability monitoring dashboard | ✗ | ✓ | Added v3.27.0–v3.28.0; repair queue depth, active jobs, durability score |
| Sentry error tracking (per-fingerprint dedup, rate-limited) | ✗ | ✓ | Added v2.0.0; three projects (client, BFF, s3gateway); one event per 5-min per signature; LRU 200 |
| Loki audit push (S3GW_AUDIT_LOKI_PUSH_URL) | ✗ | ✓ | Added v2.1.0; unset = on-box only; non-HTTPS off-box target logs startup warning |
| Network-condition degradation banner (UI, auto-clears) | ✗ | ✓ | Added v3.49.0; fires only on client_network_degraded; per-file upload errors connect to banner |
| Monitoring chart Y-axis formatted (IEC GiB/MiB/KiB) | ✗ | ✓ | Fixed v3.39.4; raw integers replaced |
| Alert delivery spine (Alertmanager routing to the operator) | ✗ | ✓ | Added v2.7.0; firing rules reach the operator instead of evaluating into a void; thresholds .env-tunable |
| Watchdog dead-man's-switch (monitoring stack self-reporting) | ✗ | ✓ | Added v2.7.0; the operator is told when the monitoring stack itself dies |
| Application logs in Loki + native Log Search | ✗ | ✓ | Added v2.7.0; every service's logs searchable in-product, not just the audit stream |
| Security Hardening | |||
| Credential storage encryption (AES-256-GCM + HKDF-SHA256) | ✗ | ✓ | Added v1.3.0; permanent creds; STS token secrets v1.5.0; session_token at rest v2.2.0 |
| Durable audit log (PostgreSQL dual-write, retention tiers) | ✗ | ✓ | Added v1.24.0; control-plane events 365d, data-plane 90d; GET /admin/v1/audit/meta |
| XChaCha20 native storage-layer encryption (always-on) | ~ | ✓ | Always-on at storage layer; S3 SSE API is an interface contract on top |
| SSE contract enforcement (AES256 applied / aws:kms 501 / SSE-C 501) | ✗ | ✓ | Added v1.18.0; aws:kms was silently accepted in MinIO and never applied |
| Admin API loopback isolation (:9101 binds 127.0.0.1 only) | ✗ | ✓ | Clean-room architecture; never exposed off-box; BFF proxies operator operations |
| Sentry PII firewall (bucket names + object keys scrubbed) | ✗ | ✓ | Added v2.2.0 + v3.47.1; BeforeSend scrubs path/query/body/cookies; 5xx uses mux route name |
| Credential-table Row Level Security (FORCE RLS, fail-closed) | ✗ | ✓ | Added v2.3.0; defense-in-depth: costlog events table also gets RLS (LD7) |
| SSRF protection on webhook delivery (DialContext blocklist) | ✗ | ✓ | Added v1.16.0; loopback / RFC1918 / link-local blocked |
| JWT audience enforcement in BFF (fail-closed at startup) | ✗ | ✓ | Added v3.41.7; server refuses to start if audience validation would be silently disabled |
| Shell injection prevention in BFF (execFile + allowlist) | ✗ | ✓ | SEC-156 remediated v3.38.0; all execAsync with bucketName/mountPath replaced |
| Global rate limiter (600/min) + login rate limiter (20 per 15 min) | ✗ | ✓ | SEC-046 added v3.38.0; Joi-backed request validation middleware |
| WORM Compliance override guard | ✗ | ✓ | Compliance: no override until retention expires; Governance: bypass requires header + audit entry |
| Billing & Metering | |||
| Per-tenant usage metering (Postgres costlog, every op attributed to cost_center) | ✗ | ✓ | Added v2.3.0 (E4); bytes_in/bytes_out/bytes_stored/request_count; Delete calls StatObject before removal |
| Billing snapshot worker (HMAC-SHA256 signed, 24h snapshot to corp scraper) | ✗ | ✓ | Added v1.29.0; rejects http:// at startup; CC from same TokenSource as HostIO |
| Logical vs physical bytes tracking (dedup-aware billing) | ✗ | ✓ | Added v1.19.0; GET /admin/v1/usage exposes both logical and physical |
| Per-tenant byte quota enforcement (fail-open if costlog down) | ✗ | ✓ | Added v2.3.0 (E5); fail-open only when costlog is down; never false 403 |
| Muse-gate (HTTP 402 MuseGate402 on suspended billing) | ✗ | ✓ | Added v1.26.0; grace state allows reads; gate runs after SigV4 on all three auth paths |
| Storage Engine | |||
| Streaming PutObject (fixed memory ceiling, no io.ReadAll) | ✗ | ✓ | Added v1.4.0; 50 MB baseline + 96 MB per concurrent upload |
| Sector-set reference counting for logical copy (dedup) | ✗ | ✓ | Added v1.19.0; Acquire/Release/Inspect; refcount-aware lifecycle executor |
| WriteStream RPC for multipart (no RAM buffer for entire part) | ✗ | ✓ | Added v1.27.0; POST /v1/hostio/writestream; prevents full-part RAM buffer |
| Ranged GET >96 MiB (streamObject path, no buffer cap) | ✗ | ✓ | Fixed v1.26.8; requests >96 MiB routed to streamObject; no more 416 InvalidRange |
| Multipart session persistence across gateway restart | ✗ | ✓ | Added v1.31.6; multipart_sessions DB table; in-flight uploads survive process restart |
| Host connection governor (bounded weighted semaphore) | ✗ | ✓ | Added v2.0.0; HOSTIO_MAX_CONCURRENT_HOST_CONNECTIONS; previously unbounded in v1.1.0 |
| Backfill legacy MinIO objects (run-once watermark) | ✗ | ✓ | Added v1.26.11; watermarked v2.0.0; previously ran on every start, causing deleted objects to reappear |
| Infrastructure & Deployment | |||
| Multi-arch Docker image (amd64 + arm64) | ✗ | ✓ | Fixed: ARG TARGETARCH without default; prior arm64 produced exec-format-dead images |
| Alpha / beta / release publish pipeline (deploy.py publish-alpha) | ✗ | ✓ | Fleet-safety: only pushes releases.scpri.me tags; promote copies registry digest, never rebuilds |
| Let's Encrypt auto-renewal in container (crond + acme.sh on volume) | ✗ | ✓ | Added v3.41.9; previously certs expired silently at 90 days; renewal state now volume-persisted |
| S3 endpoint architecture (:9000 plain HTTP always, :9443 HTTPS additive) | ✗ | ✓ | Added v3.41.0; installing a cert previously flipped :9000 to HTTPS-only |
| HTTP server timeouts (ReadHeader 10s / Read 600s / Idle 120s) | ✗ | ✓ | Added v1.27.0 on HostIO and Gateway |
| Seed-auth workflow (capture/replay hostioauth for wipe-resistant onboarding) | ✗ | ✓ | deploy.py capture-auth saves token to git-ignored secret; fresh/nightly auto-seed; never committed |
| sqlite3 vendored prebuilts (x64 + arm64) | ✗ | ✓ | Added June 2026; no GitHub fetch; CI ~165s vs 20+ min; egress-independent |
| Embedded database self-restart (supervised Postgres watchdog) | ✗ | ✓ | Added v2.7.0; a downed database restarts itself instead of leaving storage stuck until a reboot |
| Developer Tooling (MCP) | |||
| MCP server binary (xns-mcp-server, ships in container) | ✗ | ✓ | Built from relayer monorepo v1.10.0 (March 27); requires S3GW_MCP_CRED_ENC_KEY + S3GW_MCP_AUTH_DB_CFG_PATH |
| Per-principal MCP authentication | ✗ | ✓ | Added v1.22.1 |
| MCP resources/list + resources/read + prompts | ✗ | ✓ | Added v1.23.0 |
| Per-tenant MCP feature gate | ✗ | ✓ | Added v1.23.0; clean exit if tenant_features.mcp_enabled = false |
| UI / Operator UX | |||
| Route count | ~ (11, 3 unlinked) | ✓ (38) | Growth: monitoring (5), webhooks, cloud sync, tenant mgmt, IAM surface expansion, certificates |
| MinIO / ETCD config fields in UI | ✓ | ✗ | Removed entirely; no MinIO or ETCD trace in .109 configuration or service metrics |
| Service metrics: MINIO + ETCD as named processes | ✓ | ✗ | .235 System page listed MINIO and ETCD; .109 shows HostIO, Gateway, S3Gateway, PostgreSQL |
| File manager: exact bucket statistics (not "1000+" or "Unknown") | ✗ | ✓ | Fixed v3.43.0; SQL aggregate in milliseconds vs capped per-bucket enumeration |
| Audit Log page (action filter + time presets + "Changes only" toggle) | ✗ | ✓ | Added v3.52.0–v3.54.0; 1h/24h/7d/Custom presets |
| Webhooks / S3 Event Notifications management UI | ✗ | ✓ | Full rule builder: event types, target URL, auth, prefix/suffix filter, enable/disable per rule |
| Cloud Sync UI (local path → S3 bucket, Backup or Archive mode) | ✗ | ✓ | Added v3.30.0; 12-route REST API; rclone size pre-flight; live streaming progress |
| Disk Management UI (UUID-based lifecycle: mount/unmount/format/eject/rescan) | ✗ | ✓ | Added v3.33.0–v3.34.0; bulk "Format & mount all" v3.52.0 |
| Monitoring dashboards (5 native uPlot, no Grafana dependency) | ✗ | ✓ | Added v3.25.0–v3.28.0 |
| Tenant Management panel (create / suspend / reactivate / quota / rate-limit) | ✗ | ✓ | Added v3.56.0; gated on box-owner session; six new BFF proxy routes to admin :9101 |
| VPD builder: score expression + ranked provider preview | ✗ | ✓ | Added v3.55.0; optional numeric CEL textarea; ranked host list renders when score present |
| VPD builder: pin specific providers by public key (up to 50) | ✗ | ✓ | Added in .109; not present in .235 |
| Service Account management UI (create, secret displayed once) | ✗ | ✓ | Service Accounts tab in /iam |
| IAM group membership + group policy management UI | ~ | ✓ | v1.1.0: groups tab present. v3.56.0: fully wired to backend v3.50.0; four new proxy routes |
| Recent Access Denials panel in IAM UI | ✗ | ✓ | Shows denied IAM requests: timestamp, principal, resource, action |
| Presigned URL share (copy-to-clipboard, object detail panel) | ✗ | ✓ | BUG-071 fixed v3.54.0 |
| Light theme (design-system token flip, persisted in localStorage) | ~ | ✓ | v1.1.0: dark toggle in Settings. v3.56.0: full design-system light theme v3.53.0; sun/moon toggle in sidebar |
| Connection details empty-state card (endpoint URL + access key) | ✗ | ✓ | Added v3.52.0; shown when no buckets exist; "Create new bucket" CTA with versioning toggle |
| Session recovery on 401 (silent token refresh + retry) | ✗ | ✓ | BUG-221 fixed v3.41.8; all window.UI.logout() calls (undefined global) replaced |
| Gateway / HostIO port defaults below kernel ephemeral range | ✗ | ✓ | Fixed v3.45.2; 34554→5500, 37809→3480; prevents crash-loop on fast restart |
| Erasure coding ratio fields in config UI | ✓ | ✗ | Intentionally removed; EC is .env-only config, not operator-tunable through the dashboard |
The biggest changes
Nine things that are completely different
Across the Relayer app and the new S3 Gateway — the wins that matter most to customers.
App
File manager rebuilt
Multipart uploads with no size ceiling, real-time progress, per-file error messages. Large files no longer buffer in RAM.
App
IAM built right into the UI
Create users, groups, access keys, and per-bucket policies from the dashboard — no MinIO CLI, no hand-written JSON.
App
TLS actually auto-renews now
The Let's Encrypt renewal daemon was never started. Certs silently expired at 90 days. Fixed — and renewal state now survives container rebuilds.
App
Five native monitoring dashboards
Node Health, Service Health, S3-API latency, Storage & Placement, and Repair & Durability — all with live charts and a time-range picker.
S3 Gateway
S3 Gateway 2.0 is generally available
Built from scratch March–June 2026. Spec-correct PUT/GET/DELETE at scale, concurrent writes, all AWS SDK default modes. Released June 16, 2026.
S3 Gateway
Multipart uploads survive restarts
Sessions persist across process restarts. Part re-uploads are idempotent. Browser form upload (POST policy) works including boto3 presigned-post.
S3 Gateway
Full IAM + STS + OIDC in one port
Users, groups, service accounts, temporary credentials, OIDC federation, and 11 IAM role + OIDC-provider provisioning verbs — all on the S3 data-plane port. No SDK changes.
S3 Gateway
Checksums that tools expect
CRC32, CRC32C, SHA-256, and more — validated end-to-end. AWS CLI v2, restic, and rclone no longer fail with KeyError on their default settings.
S3 Gateway
Object versioning and WORM compliance
Version-aware byte storage (each version is a distinct object), legal hold, compliance-mode retention — enforced on deletes and lifecycle expiration.
The Relayer app · late 2025 onward
A complete rebuild of the customer interface
From v3.0.2 (November 2025) to v3.56.0 (June 2026) on the app layer. Here are the changes that end-users feel.
File management
- Multipart uploads with no size ceiling — large files stream instead of buffering in RAM
- Upload progress always visible; per-file error messages on failure
- Bucket stats are instant at any scale — exact counts and sizes load in milliseconds, not minutes
- Object detail panel — click any file to see versions, retention locks, and restore history
- Backup now covers the S3 and IAM database — bucket configs, users, and credentials were silently excluded before
Identity and security
- IAM page: manage S3 users, groups, access keys, and policies entirely from the dashboard
- Per-bucket scoped policies — assign read-only or read-write roles from the Create Policy modal
- Service accounts tab for machine identities with templated policies
- Session recovery on token expiry — 401 silently refreshes and retries; a visible sign-in prompt appears only if that fails
- Signed-in user badge in sidebar with one-click sign-out from anywhere
TLS and connectivity
- Let's Encrypt auto-renew fixed — renewal daemon was never started; certs silently expired at 90 days
- Renewal state survives container rebuilds — acme.sh state is now volume-persisted
- HTTPS no longer breaks plain-HTTP S3 clients — HTTP stays on port 9000 always; HTTPS is additive on 9443
- CORS fixed for custom domains — running the Relayer at a public hostname no longer rejects its own API calls
Monitoring and observability
- Five native monitoring dashboards: Node Health, Service Health, S3-API Health, Storage & Placement, Repair & Durability
- All charts show human-readable units (IEC bytes, not raw integers)
- Upload concurrency is auto-managed — the UI measures your connection and sets a safe value; no manual tuning
Disk management and first-boot
- Attach, format (xfs/ext4), and mount external drives from the UI — mounts persist across container restarts
- Fresh installs now reliably start all storage services on first boot
- Dashboard shows a calm "Starting up" state instead of red alerts in the first 3 minutes
For node operators
- Live provider map — world map of the global host network, health color-coded, with contract and network summary
- Provider selection tools (VPD) — weight providers by speed, reliability, and geography; geographic bounding boxes now reach the backend correctly
Multi-tenancy
- Multiple named tenants on a single Relayer instance — isolated S3 namespaces, credentials, quotas, and audit trails per tenant
- Per-tenant quota enforcement: over-quota tenants get 403 on writes; reads and deletes always serve
- Per-tenant rate limiting: noisy tenants get HTTP 503 SlowDown while neighbors keep running at full speed
- Tenant lifecycle management from the UI: create, suspend, reactivate, and set quota/rate limits from the Tenant Management panel
- Per-tenant usage export: bytes in, bytes out, bytes stored, request count — JSON or CSV
Webhooks & automation
- S3 event notifications: create rules that POST to any HTTPS endpoint when objects are created, removed, or accessed
- Filter by event type, key prefix, or suffix — one rule per use case
- Cloud Sync: mount a local file system path and sync it to an S3 bucket in Backup mode (keeps local copy) or Archive mode (moves to bucket, removes local after confirmed upload)
- Live sync progress with streaming status: advancing / stalled / idle / unavailable
Security improvements
- Shell injection removed from all bucket and file operations (SEC-156)
- Global rate limiter (600 req/min) and strict login rate limiter (20 per 15 min) protect the API
- JWT audience enforcement — the server refuses to start if audience validation would be silently disabled
- Credential-table Row Level Security: a misconfigured thread yields zero rows, never returns all tenants' data
S3 Gateway 2.0 · built March–June 2026
A B2B-grade S3 endpoint, built from scratch
The S3 Gateway did not exist before March 2026. It reached 2.0.0 general availability on June 16, 2026. Here is what it does.
Core compatibility
- Spec-correct PUT, GET, DELETE — including large files, concurrent writes, and all AWS SDK v2 default modes (chunked uploads, checksum trailers)
- Bulk delete batched in a single transaction — 1,000-key delete dropped from ~30 seconds to sub-second
- Bucket listings that work at scale — no empty-page bugs, no 30-second timeouts on large prefixes (git .objects/ stores, rclone destinations)
- Virtual-hosted-style addressing:
bucket.s3.example.com/keyin addition to path-style
Multipart and large objects
- Full multipart lifecycle including abort, list-parts, and orphan cleanup
- Sessions persist across process restarts — no more NoSuchUpload after a container bounce
- Part re-uploads are idempotent — safe to retry any part
- Browser form upload (POST policy / RFC 1867) — boto3
generate_presigned_postworks
IAM, STS, and OIDC
- Full IAM surface: users, groups, service accounts, inline and managed policies
- STS AssumeRole with temporary credentials scoped to a bucket
- OIDC federation (AssumeRoleWithWebIdentity) — verified against Terraform and Vault
- Cross-account role assumption with trust-policy evaluation and ExternalId guard
- 11 IAM role + OIDC-provider provisioning verbs (CreateRole, GetRole, DeleteRole, ListRoles, PutRolePolicy, GetRolePolicy, DeleteRolePolicy, CreateOpenIDConnectProvider, GetOpenIDConnectProvider, DeleteOpenIDConnectProvider, ListOpenIDConnectProviders) served on the S3 data-plane port — no second port, no SDK changes
Versioning, WORM, and data integrity
- Full object versioning — each version stores its own bytes; GET ?versionId=X returns the exact data for that version
- Object Lock: legal hold and compliance-mode retention enforced on deletes and lifecycle expiration
- Flexible checksums (CRC32, CRC32C, CRC64NVME, SHA-1, SHA-256) — AWS CLI v2, restic, and rclone work without errors on their default settings
- Conditional writes: If-None-Match:* (create-only) and If-Match:etag (optimistic lock)
Bucket policy, CORS, and access control
- Stored bucket policies enforced on every request — IP CIDR conditions, prefix wildcards, deny-overrides-allow
- Public Access Block — blocks wildcard-principal policies at write time
- CORS enforcement and correct preflight handling — presigned-URL browser uploads unblocked
- Authorization bypass closed on tagging and multipart paths
Audit and AI integration
- Durable audit log (PostgreSQL) — every S3 event retained for 90–365 days; SIEM export via HMAC-signed webhook
- MCP server for AI clients (Claude, Cursor) — 8 tools with per-principal IAM enforcement and full audit integration
- S3 event notifications via webhook — filter by event type, prefix, suffix; HMAC-signed delivery
Ready to try the new XNS?
$6.00/TB-mo, $0 egress uncapped, 30-day minimum retention. Change one endpoint and everything that speaks S3 already works.
Claims on this page last verified