# Connect Scaleway Object Storage to WordPress

To offload WordPress media to Scaleway Object Storage, install Offloft, create a private bucket, then create an IAM application with an API key for your project. Offloft makes each file it uploads public, so nobody can list the whole bucket. It tests the connection and delivery before serving.

## 1. Create the bucket

In the Scaleway console, go to **Object Storage** and select **Create bucket**.

**Region:** pick the one closest to most of your visitors (for example fr-par) and enter the same region in Offloft.

**Visibility:** leave it **Private**. Offloft makes each file it uploads public, so nobody can list the whole bucket.

Bucket name:

```
my-site-media
```

## 2. Create an API key for Object Storage

In **IAM**, create an application for this site and give it a policy with the **ObjectStorageFullAccess** permission set, limited to the project that holds "my-site-media".

Open the application's **API keys** tab and generate a key. When asked, set this project as the preferred project for Object Storage.

Copy the **Access Key** and the **Secret Key** into Offloft. *Scaleway shows the secret only once.*

To keep the key away from other buckets in the same project, add a bucket policy that grants this application access to "my-site-media" only.

## 3. Let visitors read the files

Files are private unless each file is marked public. Offloft marks every file it uploads as public; the delivery check confirms it works. There is nothing to switch on.

Files uploaded by other tools stay private until you change their visibility in the console.

## 4. Serve files from your own domain with Edge Services (optional)

Open the bucket, go to its **Edge Services** tab and create a pipeline for it.

Add media.yoursite.com as a custom domain. At your DNS provider, add a CNAME record for media.yoursite.com pointing to the endpoint Scaleway shows (ending in .svc.edge.scw.cloud), and let Scaleway create a Let's Encrypt certificate.

In Offloft, use https://media.yoursite.com as the delivery address.

Delivery address:

```
https://media.yoursite.com
```

## 5. Allow your site to read files (CORS) (optional)

This step is optional. Images on your pages load without it. You need it only when your site's own scripts read files from storage, for example image editors, web fonts or 3D viewers. The rule below lets only your site read files, and only read them.

Scaleway sets CORS through its S3 API. With the AWS CLI configured for this key, run the command below.

AWS CLI command:

```
aws s3api put-bucket-cors --bucket my-site-media --endpoint-url https://your-endpoint --cors-configuration '{"CORSRules":[{"AllowedOrigins":["https://yoursite.com"],"AllowedMethods":["GET","HEAD"],"AllowedHeaders":["*"],"MaxAgeSeconds":3600}]}'
```

## Permissions Offloft needs

An IAM application with a policy using the ObjectStorageFullAccess permission set, limited to the project that holds this bucket.

## Serving your files

Files are private unless each file is marked public, and Offloft marks every file it uploads. To use your own domain, create an Edge Services pipeline for the bucket. The delivery check loads a small test image from the address you enter.

## Questions

### Should the bucket be public?

No. Leave Visibility on Private. Offloft makes each file it uploads public, so nobody can list the whole bucket.

### What about files uploaded by other tools?

They stay private until you change their visibility in the console.

### How do I use my own domain?

With Edge Services: create a pipeline for the bucket, add your domain, and point a CNAME record at the endpoint Scaleway shows.

Source: https://www.offloft.com/setup/scaleway