S3-compatible storage adapter powered by ExAws.

tus single-node constraint

The S3 tus backing (upload_part_stream/5) buffers each PATCH's sub-5-MiB tail remainder on node-local disk under Rindle.tmp/tus/, while the authoritative cross-PATCH bookkeeping (offset, upload_id, committed parts) lives in the shared DB. Because the tail buffer is node-local, the S3 tus backing REQUIRES single-node or sticky-session routing: a resumed PATCH must reach the same node that holds the in-progress tail buffer.

A cross-node resume — where the DB implies buffered bytes (a non-empty upload_id together with EITHER at least one committed part OR a persisted offset greater than length(parts) * @s3_min_part_size) but the expected tail file is absent on this node — is detected and fails loudly with {:error, :tus_tail_missing} rather than silently re-slicing from a fresh empty tail (which would corrupt the assembled object). This covers the pre-first-part window too: a first PATCH under 5 MiB buffers a node-local tail without committing any part (parts: [], offset > 0), so a misrouted resume in that window also fails loudly instead of dropping the buffered bytes. A brand-new FIRST PATCH (offset == 0) is never falsely guarded. Multi-node operators MUST pin tus PATCHes to a single node (sticky sessions) or accept this loud failure on misrouted resumes.

Public (browser-facing) delivery endpoint

Browser-facing presigned URLs (url/2, presigned_put/3, presigned_upload_part/5) are signed using the :ex_aws, :s3 config by default. When the cluster-internal S3 endpoint differs from the endpoint the browser can reach — split-horizon DNS, a public/CDN/edge host, or a dev Docker setup where the server talks to minio:9000 in-network but the browser must use a published localhost:<port> — configure a :public_endpoint for this adapter:

config :rindle, Rindle.Storage.S3,
  bucket: "my-bucket",
  public_endpoint: [scheme: "https://", host: "cdn.example.com", port: 443]

Only :scheme, :host, and :port are read, and they apply ONLY to presigned URL signing — server-side store/download/head/multipart ops keep using the :ex_aws, :s3 endpoint. Because the S3 signature binds the host header (SignedHeaders=host), the configured public host MUST be exactly the host the browser requests. Leave it unset for identical pre-existing behaviour.