Deployment

Run s3BEAR locally with Docker Compose, or in production on Kubernetes with the Helm chart.

Local development (Docker Compose)

Prerequisites: Docker & Docker Compose, and a .env file in the project root (copy from .env.example).

cp .env.example .env   # fill in Azure + AWS credentials if needed
docker compose -f docker-compose.dev.yml up -d

Services & ports

Default admin credentials

Email:    [email protected]
Password: admin

Change secrets.defaultAdminPassword in production.

Rebuild after code changes

# Backend
docker build -t s3bear-backend:1.0.1 ./backend && \
  docker compose -f docker-compose.dev.yml up -d backend

# Frontend
docker build -t s3bear-frontend:1.0.1 ./frontend && \
  docker compose -f docker-compose.dev.yml up -d frontend

Database migrations

Migrations run automatically on container start via the backend-migrate init service. To run them manually:

docker compose -f docker-compose.dev.yml exec backend alembic upgrade head

Kubernetes deployment (Helm)

For prerequisites, a production values.yaml, the complete chart-to-environment mapping, upgrades, and verification commands, see Quick Start.

Install from the OCI registry (recommended)

helm install s3bear oci://registry-1.docker.io/bearcomp/s3bear \
  --version 1.0.3 \
  --namespace s3bear --create-namespace \
  --set secrets.secretKey="$(openssl rand -hex 32)" \
  --set secrets.databaseUrl="postgresql+asyncpg://user:pass@postgres:5432/s3bear" \
  --set secrets.databaseUrlSync="postgresql://user:pass@postgres:5432/s3bear" \
  --set secrets.awsAccessKeyId="AKID..." \
  --set secrets.awsSecretAccessKey="ASAK..." \
  --set config.awsEndpointUrl="http://minio.minio-ns.svc:9000" \
  --set config.presignedUrlBase="https://minio.example.com" \
  --set ingress.host="s3bear.example.com"

Install from a local chart

helm install s3bear ./helm/s3bear \
  --namespace s3bear --create-namespace \
  -f my-values.yaml

Key Helm values

config:
  # Internal S3 endpoint (backend → storage). In-cluster service DNS.
  awsEndpointUrl: "http://minio.minio-ns.svc:9000"

  # External S3 URL (browser → storage). REQUIRED for multipart upload.
  presignedUrlBase: "https://minio.example.com"

  multipartPartSizeMb: "10"      # 10MB parts
  presignedUrlExpiry: "3600"     # 1 hour
  allowedOrigins: '["https://s3bear.example.com"]'

Production checklist

• secrets.secretKey ≥ 32 random chars (used to sign JWTs)
• External PostgreSQL (postgresql.enabled: false) + backups
• config.presignedUrlBase points to a publicly reachable S3-compatible endpoint
• CORS configured on the storage layer — see CORS Setup
• config.allowedOrigins matches your frontend domain
• ingress.tls.enabled: true with a valid cert
• Strong secrets.defaultAdminPassword
• Azure Entra credentials populated if SSO is required

Related: Quick Start · Configuration · CORS Setup · Troubleshooting