Add object storage behind a load balancer

By the end you will have an S3 endpoint you can point aws or rclone at. You will decide one thing early: whether it is reachable from the internet.

Prerequisites

For	You need
Any store	A subnet with a gateway attached
A published endpoint	A load balancer in the same private network
TLS on that endpoint	A domain whose DNS is hosted here

The gateway requirement is not optional and is checked at creation: storage nodes fetch their own configuration from the panel, so a subnet with no egress produces a store that installs and then waits forever. The panel refuses instead.

data tier subnets can never have egress, so a store cannot live in one.

1. Create the store

Nesne Depolama → Depo Oluştur (Object storage → Create store).

Field	What to choose
Ad (Name)	Lower-case
Düğüm sayısı (Nodes)	1 — no redundancy, fine for development and rebuildable artefacts. 3 — replicated, survives losing one machine
Paket / disk	Plan and data disk size
Özel ağ / subnet	A subnet with a gateway
Yük dengeleyici (Load balancer)	Optional; leave empty for a private-only store
Uç nokta adı (Endpoint host)	Optional; a hostname such as s3.example.com

While a three-node store comes up

Nodes announce themselves, then the layout is applied. During that window each node reports what it is waiting for — “nodes still announcing themselves (2/3)” — rather than an error. That is a normal installation in progress, not a fault.

2. Create a bucket and an access key

Open the store.

• Bucket ekle (Add bucket) — a name.
• Anahtar oluştur (Create key) — then grant it read, write or owner on the bucket.

The secret is shown once. The panel does not store it. Copy it before closing the dialog.

3. Use it

The store page shows the endpoint. Its scheme reflects reality: https://… only when a certificate is actually ready. Typing a hostname is not enough — promising HTTPS while the certificate is still being issued would make your very first copy-pasted command fail with a TLS error.

export AWS_ACCESS_KEY_ID=…
export AWS_SECRET_ACCESS_KEY=…

aws --endpoint-url https://s3.example.com s3 ls
aws --endpoint-url https://s3.example.com s3 cp ./file.bin s3://my-bucket/

rclone, mc and the SDKs work the same way. Garage implements the parts of the S3 API that matter for object storage; it is not a full reimplementation of every AWS feature.

Choosing where the endpoint lives

Private only. No load balancer. The endpoint is the store’s private address, reachable from your network — and from your laptop if you use a Zero Trust gateway. Nothing is published.

Internal load balancer. A load balancer with Dışarıya açık unticked. You get hostname-based routing and valid TLS on a private address — the certificate challenge is a DNS record, so nothing needs to be reachable from the internet. This is the right choice for internal services more often than people expect.

Public. A load balancer with a public address. The endpoint is on the internet.

You can change your mind: a load balancer can be published or made internal later.

Why the endpoint goes through a load balancer at all

Garage speaks plain HTTP and does not terminate TLS. Rather than put a second TLS implementation on the storage nodes — a second certificate store, a second renewal path, a certificate re-obtained every time a node is rebuilt — the endpoint terminates at the load balancer, which already does that for everything else. One TLS point, one certificate store, one renewal mechanism.

Troubleshooting

The store stays in “kuruluyor”. Almost always the subnet has no gateway. The nodes cannot reach the panel to fetch their configuration.

The endpoint is http:// and I set a hostname. The certificate is not ready yet. Check the load balancer listener for its status or error.

SignatureDoesNotMatch. The endpoint URL must match what you configured; do not mix the private address and the hostname across a session.

A node reports “waiting”. On a three-node store during installation, that is normal. If it persists for many minutes, look at the store’s error line rather than the node’s waiting line.