# Hep.gg Cloud Storage

S3-compatible object storage on two instances. Buckets are per-user; each
bucket has its own service-account key pair.

Endpoints:
  primary    https://s3.hep.gg                 (backed up; region ca-central-hydra-1)
  secondary  https://ca-east-hydra-1.s3.hep.gg (best-effort; region ca-east-hydra-1)

Auth: standard S3 signature v4 using your per-bucket access key + secret.
Strict SDKs require the matching region tag (above).

## Common commands

AWS CLI:
  aws --endpoint-url https://s3.hep.gg \
      --region ca-central-hydra-1 \
      s3 ls s3://my-bucket/

rclone config:
  type = s3
  provider = Other
  endpoint = https://s3.hep.gg
  region = ca-central-hydra-1
  force_path_style = true

## Hep.gg dashboard (cookie auth)
  GET    /api/v1/storage/buckets
  POST   /api/v1/storage/buckets               { name, instance, visibility? }
  PATCH  /api/v1/storage/buckets/:id           { visibility }
  DELETE /api/v1/storage/buckets/:id
  GET    /api/v1/storage/buckets/:id/key
  POST   /api/v1/storage/buckets/:id/key/rotate
  GET    /api/v1/storage/overview
  GET    /api/v1/storage/credits/bundles
  POST   /api/v1/storage/credits/checkout      { bundle }