# Connect MinIO to WordPress

To offload WordPress media to your own MinIO server, install Offloft, create a bucket and a user that can reach only that bucket with the mc client, then give the files a public https address. Never give Offloft the admin keys. Offloft tests everything before serving.

## 1. Create the bucket

With the MinIO client (mc), add an alias for your server once; mc asks for the admin access key and secret key. Then create the bucket.

**Bucket names:** lowercase letters, numbers and hyphens, 3 to 63 characters.

Add the alias:

```
mc alias set offloft https://your-endpoint
```

Create the bucket:

```
mc mb offloft/my-site-media
```

## 2. Create a user with access to this bucket only

Save the policy below as offloft-my-site-media.json. It allows exactly what Offloft does, on "my-site-media" only.

Create the policy, create a user (choose a new access key and a long random secret key), and attach the policy to the user with the commands below.

Enter that access key and secret key in Offloft, with your server's address as the endpoint. *Never give Offloft the admin keys.*

Policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OffloftListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-site-media"]
    },
    {
      "Sid": "OffloftManageFiles",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": ["arn:aws:s3:::my-site-media/*"]
    }
  ]
}
```

Create the policy:

```
mc admin policy create offloft offloft-my-site-media offloft-my-site-media.json
```

Create the user:

```
mc admin user add offloft NEW_ACCESS_KEY NEW_SECRET_KEY
```

Attach the policy:

```
mc admin policy attach offloft offloft-my-site-media --user NEW_ACCESS_KEY
```

## 3. Let visitors read the files

MinIO buckets are private. The command below lets anyone download a file whose address they know; it does not let them upload, change or delete anything.

Run it once for "my-site-media".

Allow downloads:

```
mc anonymous set download offloft/my-site-media
```

## 4. Give the files a public https address

Visitors need to reach the files over https. Put a reverse proxy such as nginx in front of MinIO on media.yoursite.com, with a certificate for that domain, passing requests to the MinIO server.

With path-style addresses, files live at https://media.yoursite.com/my-site-media/…; use that as the delivery address in Offloft.

Delivery address:

```
https://media.yoursite.com/my-site-media
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

MinIO answers cross-origin requests from any site unless told otherwise. To allow only your site, set the environment variable below on the MinIO server and restart it.

Server setting:

```
MINIO_API_CORS_ALLOW_ORIGIN=https://yoursite.com
```

## Permissions Offloft needs

A policy that allows s3:ListBucket on the bucket, and s3:PutObject, s3:GetObject, s3:DeleteObject and s3:AbortMultipartUpload on its files, attached to a user made for this site. Never give Offloft the admin keys.

## Serving your files

MinIO buckets are private, so allow anonymous downloads for this bucket. Visitors also need to reach files over https, so put a reverse proxy such as nginx in front of MinIO. With path-style addresses, files live under your domain and the bucket name.

## Questions

### Can I use my MinIO admin keys?

No, please do not. Create a user with access to this bucket only.

### Can visitors change or list my files?

No. The download permission lets anyone download a file whose address they know. It does not let them upload, change or delete anything.

### Why do I need https?

Browsers block http images on https pages. Put a reverse proxy with a certificate in front of MinIO.

Source: https://www.offloft.com/setup/minio