# Connect Akamai (Linode) Object Storage to WordPress

To offload WordPress media to Akamai (Linode) Object Storage, install Offloft, create a bucket and a limited access key in Cloud Manager, then copy the key into Offloft. Offloft marks each uploaded file as public. If you want your own domain, label the bucket with it from the start.

## 1. Create the bucket

In Cloud Manager, go to **Object Storage** and select **Create Bucket**.

**Label:** lowercase letters, numbers, hyphens and periods. If you want files served from your own domain (see the domain step), the label must be that full domain name, for example media.yoursite.com.

**Region:** pick the one closest to most of your visitors and enter the same region in Offloft.

Bucket label:

```
my-site-media
```

## 2. Create an access key for this bucket

Go to **Object Storage**, open the **Access Keys** tab and select **Create Access Key**. Pick the bucket's region.

Turn on **Limited Access** and set "my-site-media" to **Read/Write**, leaving every other bucket at **None**. *A key's permissions cannot be changed later; you would make a new key.*

Copy the **Access Key** and the **Secret Key** into Offloft, then select **I Have Saved My Secret Key**. *The secret is shown only once.*

## 3. Let visitors read the files

Files are private unless each file is marked public. Offloft marks every file it uploads as public; the delivery check confirms it works. There is nothing to switch on.

Leave the bucket's own access setting on **Private**, so visitors can open a file but cannot list the bucket.

## 4. Serve files from your own domain (optional)

This needs a bucket labelled with the full domain name, for example media.yoursite.com (a subdomain; the bare domain does not work).

At your DNS provider, add a CNAME record for media.yoursite.com pointing to media.yoursite.com.your-region.linodeobjects.com.

In Cloud Manager, open the bucket's **SSL/TLS** tab, paste your certificate and private key for the domain and select **Upload Certificate**.

In Offloft, use https://media.yoursite.com as the delivery address.

CNAME target:

```
media.yoursite.com.your-region.linodeobjects.com
```

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Object Storage sets CORS through its S3 API. With the AWS CLI configured for this key, run the command below.

AWS CLI command:

```
aws s3api put-bucket-cors --bucket my-site-media --endpoint-url https://your-endpoint --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://yoursite.com"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
```

## Permissions Offloft needs

An access key with Limited Access: Read/Write on this bucket, None on the others. A key's permissions can't be changed later; you would make a new key.

## Serving your files

Files are private unless each file is marked public, and Offloft marks every file it uploads. To serve from your own domain, the bucket label must be that full domain name, with a CNAME record and an uploaded certificate. The delivery check confirms it works.

## Questions

### Can I add my own domain to an existing bucket?

It needs a bucket labelled with the full domain name, and a subdomain, not the bare domain. Decide before you create the bucket.

### Should the bucket be private?

Yes. Leave the bucket's own access setting on Private, so visitors can open a file but can't list the bucket.

### Can I change a key later?

Not its permissions. If they need to change, create a new key.

Source: https://www.offloft.com/setup/akamai-linode