前言
因为腾讯云最近新推出了轻量应用服务器的云硬盘，相对于CVM的云硬盘性能几乎一模一样，而且因为上新做活动3年的1TB云硬盘只要59.7元，直接让轻量变身超级大盘鸡，我就寻思着能不能拿这硬盘整点花活，正巧听说了有个开源且成熟的对象储存系统MinIO，索性就拿来试试水……
首先系统选择的是Debian 11.1
MinIO offers high-performance, S3 compatible object storage. Native to Kubernetes, MinIO is the only object storage suite available on every public cloud, every Kubernetes distribution, the private cloud and the edge. MinIO is software-defined and is 100% open source under GNU AGPL v3.
Docker安装
安装docker，这里使用官方的安装脚本，安装源为阿里云
代码语言：javascript复制curl -fsSL https://get.docker.com | bash -s docker --mirror AliyunDocker安装MinIO
代码语言：javascript复制docker run -p 9000:9000 -p 9001:9001 --name minio1 -v /home/minio/data:/data -e "MINIO_ROOT_USER=Your_Login_User_Name" -e "MINIO_ROOT_PASSWORD=Your_Login_User_Password" quay.io/minio/minio server /data --console-address ":9001"在执行完成后，浏览器访问服务器IP地址:9001即可登录MinIO的Web控制台
反向代理
安装Nginx，可以随个人喜好，这里我直接安装在本机环境内了
代码语言：javascript复制apt install -y openssl libssl-dev libpcre3 libpcre3-devwget http://nginx.org/download/nginx-1.21.6.tar.gztar -xvzf nginx-1.21.6.tar.gzcd nginx-1.21.6./configure --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-stream --with-stream_ssl_module --with-http_realip_module --with-http_gzip_static_modulemake instllln -s /usr/local/nginx/sbin/nginx /usr/bin/nginx配置Systemd守护
代码语言：javascript复制vi /usr/lib/systemd/system/nginx.service[Unit]Description=nginx - high performance web server Documentation=http://nginx.org/en/docs/After=network.target remote-fs.target nss-lookup.target[Service]Type=forkingPIDFile=/usr/local/nginx/logs/nginx.pidExecStartPre=/usr/local/nginx/sbin/nginx -t -c /usr/local/nginx/conf/nginx.confExecStart=/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.confExecReload=/bin/kill -s HUP $MAINPIDExecStop=/bin/kill -s QUIT $MAINPIDPrivateTmp=true[Install]WantedBy=multi-user.target启动Nginx
代码语言：javascript复制systemctl start nginx编辑NGINX反向代理配置文件(默认)
代码语言：javascript复制server { listen 80; server_name example.com; # To allow special characters in headers ignore_invalid_headers off; # Allow any size file to be uploaded. # Set to a value such as 1000m; to restrict file size to a specific value client_max_body_size 0; # To disable buffering proxy_buffering off; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_connect_timeout 300; # Default is HTTP/1, keepalive is only enabled in HTTP/1.1 proxy_http_version 1.1; proxy_set_header Connection ""; chunked_transfer_encoding off; proxy_pass http://localhost:9000; # If you are using docker-compose this would be the hostname i.e. minio # Health Check endpoint might go here. See https://www.nginx.com/resources/wiki/modules/healthcheck/ # /minio/health/live; }}如果你想要将储存桶与Web控制台使用同域名，则应按下面的配置文件编辑反向代理
代码语言：javascript复制server { listen 80; server_name example.com; # To allow special characters in headers ignore_invalid_headers off; # Allow any size file to be uploaded. # Set to a value such as 1000m; to restrict file size to a specific value client_max_body_size 0; # To disable buffering proxy_buffering off; # Proxy requests to the bucket "photos" to MinIO server running on port 9000 location /photos/ { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_connect_timeout 300; # Default is HTTP/1, keepalive is only enabled in HTTP/1.1 proxy_http_version 1.1; proxy_set_header Connection ""; chunked_transfer_encoding off; proxy_pass http://localhost:9000; } # Proxy any other request to the application server running on port 9001 location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_connect_timeout 300; # Default is HTTP/1, keepalive is only enabled in HTTP/1.1 proxy_http_version 1.1; proxy_set_header Connection ""; chunked_transfer_encoding off; proxy_pass http://localhost:9001; }请将server_name换成你自己的域名
ACME.SH签发证书
安装ACME.SH
代码语言：javascript复制curl https://get.acme.sh | sh -s email=your_email_adress重载环境
代码语言：javascript复制source .profile添加DNSPOD API密钥
代码语言：javascript复制export DP_Id="xxxxxx"export DP_Key="xxxxxxxxxxxx"DNSPOD密钥创建位置在我的账号-API密钥-DNSPod Token ID通常为6随机6位数
签发证书(通配符)
代码语言：javascript复制acme.sh --dns dns_dp --issue -d example.com -d *.example.com安装证书
代码语言：javascript复制acme.sh --installcert -d example.com --key-file /usr/local/nginx/cert/example.com/privkey.pem --fullchain-file /usr/local/nginx/cert/example.com/fullchain.pem编辑nginx配置文件，增加SSL配置
代码语言：javascript复制 ssl on; ssl_certificate /usr/local/nginx/cert/example.com/fullchain.pem; ssl_certificate_key /usr/local/nginx/cert/example.com/privkey.pem; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on;重启NGINX
代码语言：javascript复制systemctl restart nginx将储存桶设置为公开永久可读
设置完这么多，到真正用的时候发现传上去的文件公开不可读？
这是因为MinIO的储存桶默认没有公开访问权限
如果想要设置为储存桶公开可读，首先进入MinIO的Web控制台，点击Buckets-Manage-Access Rules-Add Access Rules,新建一个如下图所示的策略后点击Save保存即可
此时你输入IP:9000/Buckets_Name/FileName即可直接下载/查看文件，如果已配置NGINX代理，那么输入域名/Buckets_Name/FileName即可直接下载/查看文件。
