Access Keys and S3 Clients

NAS Reborn speaks the standard S3 protocol, so ordinary S3 tools work with it. Access is simple, with no users and no permissions matrix, just access keys.

One rule

A request is allowed when it reads from a public folder, or when it carries a valid signature from one of your access keys that reaches that folder. That is the entire access model. A new key reaches everything, so you usually create several keys for the sake of revocation. Give each client its own labeled key and you can cut one client off later without touching the others.

Scoping a key

You can also narrow a key to part of the tree. On the screen of the key, turn All folders off and tick the folders it may sign for. The list starts out with everything that exists right now, so switching it off takes nothing away on the spot. A folder created later stays out until you tick it as well.

What a key cannot reach is simply not there for it. The folder answers 404 NoSuchBucket, it is missing from a bucket listing, and creating a bucket of that name is refused, so a scoped key cannot make a folder it would then be unable to see. Nothing says "denied", since a refusal would confirm that the folder exists.

Scoping works on every key and every tier, and is not part of the Pro unlock.

Managing keys

• A fresh install comes with one key labeled "admin key". You create more in Settings → Authentication, where each key gets an ID and a secret ready to paste into a client, and a label naming the client it is for.
• Each key shows when it was last used, which makes it easy to spot stale keys that are safe to revoke.
• To reveal a stored secret again you need Face ID, Touch ID or the device passcode.
• The free tier includes one key and more come with the Pro unlock.

S3 Files: one tap

S3 Files, from the same developer, puts S3 buckets in the Files app and Finder, and NAS Reborn configures it without any copy-pasting. On the detail screen of a folder, tap Add to S3 Files… and the share sheet takes it from there. You can open it in S3 Files on the same device or AirDrop it to your iPad or Mac.

The credentials never travel in the shared file. They move through iCloud Keychain with end-to-end encryption, which is why both devices must be signed into the same iCloud account with iCloud Keychain enabled. The handoff is valid for 24 hours and works exactly once. NAS Reborn keeps a dedicated key labeled "S3 Files" for this, so revoking that one key unpairs S3 Files and nothing else.

rclone

The server is path-style, so the bucket name goes in the path and not in the hostname. This rclone configuration works:

[nasreborn]
type = s3
provider = Other
endpoint = https://yourserver.nas2.dk
access_key_id = YOUR_KEY_ID
secret_access_key = YOUR_SECRET
force_path_style = true
region = us-east-1

You then list a folder with rclone ls nasreborn:photos and mirror one with rclone sync ~/photos nasreborn:photos, which also makes rclone a good scheduled backup of the server from any computer.

Cyberduck and other tools

In Cyberduck you choose an S3 connection, set the server to your hostname on port 443, and enter a key ID and secret. Most S3 clients work the same way, and when there is a path-style or "virtual host style" option you should choose path-style. Multipart uploads work, so large files are no problem.

Sharing single files

To hand someone a single file from a private folder you use a presigned link. This is a URL granting access to exactly that file until it expires, and the receiving end needs no key and no account. The server honors presigned links generated by standard S3 tools, such as the Share command in Cyberduck or rclone link.