ExStorageService.CloudCache.Config (ex_storage_service v0.6.2)

Per-bucket cloud cache configuration backed by Concord KV.

When enabled, a bucket acts as a gateway to a remote S3-compatible store (AWS S3, Cloudflare R2, MinIO, or any S3-compatible endpoint). Writes go directly to the remote; reads are served from a local LRU disk cache that is populated on demand.

Configuration is stored under "cloud_cache:{bucket}" in Concord. The secret access key is AES-256-CTR encrypted using the same ESS_MASTER_KEY as IAM secrets.

Providers

Provider	Endpoint	Notes
`:aws`	Auto: `https://s3.{region}.amazonaws.com`	Override with custom endpoint
`:r2`	Required: account-specific R2 URL	Region should be `"auto"`
`:minio`	Required: `http://host:9000`	Path-style access, any region
`:s3_compat`	Required: provider endpoint URL	Generic S3-compatible backend

Summary

Types

provider()

t()

Functions

decrypt_secret(encrypted_b64)

Decrypt an AES-256-CTR encrypted secret.

delete_config(bucket)

Delete cloud cache config for a bucket.

encrypt_secret(plaintext)

Encrypt a plaintext secret using the master key.

endpoint_url(config)

Derive the S3 endpoint URL from the config.

get_active_config(bucket)

Check if cloud cache is enabled for a bucket. Returns the config if enabled, :disabled otherwise.

get_config(bucket)

Get cloud cache config for a bucket.

plaintext_secret(arg1)

Decrypt the stored secret and return the plaintext secret access key.

set_config(bucket, params)

Set (create or update) cloud cache config for a bucket.

Types

provider()

@type provider() :: :aws | :r2 | :minio | :s3_compat

t()

@type t() :: %ExStorageService.CloudCache.Config{
  access_key_id: String.t(),
  bucket: String.t(),
  cache_enabled: boolean(),
  cache_max_bytes: non_neg_integer(),
  enabled: boolean(),
  encrypted_secret: String.t(),
  endpoint: String.t() | nil,
  provider: provider(),
  region: String.t()
}

Functions

decrypt_secret(encrypted_b64)

@spec decrypt_secret(String.t()) :: String.t()

Decrypt an AES-256-CTR encrypted secret.

delete_config(bucket)

@spec delete_config(String.t()) :: :ok | {:error, term()}

Delete cloud cache config for a bucket.

encrypt_secret(plaintext)

@spec encrypt_secret(String.t()) :: String.t()

Encrypt a plaintext secret using the master key.

endpoint_url(config)

@spec endpoint_url(t()) :: String.t()

Derive the S3 endpoint URL from the config.

:aws — auto-builds https://s3.{region}.amazonaws.com if no endpoint given
:r2 — uses endpoint field directly (account-specific URL)
:minio — uses endpoint field directly (e.g. http://host:9000)
:s3_compat — uses endpoint field directly

get_active_config(bucket)

@spec get_active_config(String.t()) :: {:ok, t()} | :disabled

Check if cloud cache is enabled for a bucket. Returns the config if enabled, :disabled otherwise.

get_config(bucket)

@spec get_config(String.t()) :: {:ok, t()} | {:error, :not_found | term()}

Get cloud cache config for a bucket.

Returns {:ok, %Config{}} if configured, {:error, :not_found} otherwise.

plaintext_secret(arg1)

@spec plaintext_secret(t()) :: String.t()

Decrypt the stored secret and return the plaintext secret access key.

set_config(bucket, params)

@spec set_config(String.t(), map() | keyword()) :: :ok | {:error, term()}

Set (create or update) cloud cache config for a bucket.

params is a map or keyword list with the config fields. If secret_access_key is provided in plaintext, it will be encrypted.