DEV Community

Cover image for Deploying Lioran S3 with Docker, Caddy and HTTPS
Swaraj Puppalwar
Swaraj Puppalwar

Posted on Edited on

Deploying Lioran S3 with Docker, Caddy and HTTPS

#selfhosted #rust #devops #docker

Lioran S3 V1 Pre-Alpha is distributed as a pre-built Docker image.

You do not need to clone the source repository, install Rust, compile the server, or configure a Rust build environment.

The deployment model is simple:

Internet
   |
   | HTTPS :443
   v
Caddy
   |
   | HTTP
   v
Lioran S3
   |
   +--> Persistent Object Data
   |
   +--> RocksDB Metadata
Enter fullscreen mode Exit fullscreen mode

Lioran S3 runs as the storage service while Caddy handles public HTTPS and TLS certificate management.

Lioran S3 V1 Pre-Alpha is intended for evaluation and testing. Validate durability, recovery, security, and operational behavior before storing important data.

1. Requirements

You need:

  • Docker
  • a persistent disk or Docker volume
  • port 27118 available for the Lioran S3 server
  • optionally, a domain name and Caddy for HTTPS

Verify Docker:

docker --version
Enter fullscreen mode Exit fullscreen mode

2. Pull the Lioran S3 Image

The current V1 Pre-Alpha image is:

liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

Pull it:

docker pull liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

No source checkout or Rust toolchain is required.

3. Running the Server

There are two straightforward deployment options.

Option A: Docker Single Command

Create a persistent data directory:

mkdir -p data
Enter fullscreen mode Exit fullscreen mode

Then start Lioran S3:

docker run -d \
  --name bastion-server \
  --restart unless-stopped \
  -p 27118:27118 \
  -v "$(pwd)/data:/data" \
  -e BASTION_ENV=production \
  -e BASTION_HOST=0.0.0.0 \
  -e BASTION_PORT=27118 \
  -e BASTION_DATA_DIR=/data \
  -e BASTION_ADMIN_USERNAME=admin \
  -e BASTION_ADMIN_PASSWORD='YourStrongPasswordHere123!' \
  -e BASTION_DURABILITY=strict \
  liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

Replace:

YourStrongPasswordHere123!
Enter fullscreen mode Exit fullscreen mode

with a strong unique password.

Do not use example credentials on an Internet-facing deployment.

Windows PowerShell

PowerShell uses the backtick as its line-continuation character.

Create the data directory:

New-Item -ItemType Directory -Force -Path "${PWD}\data"
Enter fullscreen mode Exit fullscreen mode

Run Lioran S3:

docker run -d `
  --name bastion-server `
  --restart unless-stopped `
  -p 27118:27118 `
  -v "${PWD}\data:/data" `
  -e BASTION_ENV=production `
  -e BASTION_HOST=0.0.0.0 `
  -e BASTION_PORT=27118 `
  -e BASTION_DATA_DIR=/data `
  -e BASTION_ADMIN_USERNAME=admin `
  -e BASTION_ADMIN_PASSWORD=YourStrongPasswordHere123! `
  -e BASTION_DURABILITY=strict `
  liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

4. Docker Compose

For a persistent server deployment, Docker Compose makes the configuration easier to maintain.

Create:

docker-compose.yml
Enter fullscreen mode Exit fullscreen mode

with:

services:
  bastion:
    image: liorans3/liorans3:pre-alpha
    container_name: bastion-server
    restart: unless-stopped

    ports:
      - "27118:27118"

    environment:
      BASTION_ENV: production
      BASTION_HOST: 0.0.0.0
      BASTION_PORT: 27118
      BASTION_DATA_DIR: /data

      BASTION_ADMIN_USERNAME: admin
      BASTION_ADMIN_PASSWORD: "YourStrongPasswordHere123!"

      BASTION_DURABILITY: strict

    volumes:
      - bastion-data:/data

volumes:
  bastion-data:
    driver: local
Enter fullscreen mode Exit fullscreen mode

Start the server:

docker compose up -d
Enter fullscreen mode Exit fullscreen mode

Check its status:

docker compose ps
Enter fullscreen mode Exit fullscreen mode

Follow logs:

docker compose logs -f bastion
Enter fullscreen mode Exit fullscreen mode

Stop the deployment:

docker compose down
Enter fullscreen mode Exit fullscreen mode

The named volume remains persistent when the container is stopped or recreated.

To inspect it:

docker volume ls
Enter fullscreen mode Exit fullscreen mode

5. Verify the Server

Once the container is running, check:

docker ps
Enter fullscreen mode Exit fullscreen mode

You should see bastion-server listening on port 27118.

Test the health endpoint:

curl -f http://127.0.0.1:27118/health
Enter fullscreen mode Exit fullscreen mode

You can also inspect metrics:

curl http://127.0.0.1:27118/metrics
Enter fullscreen mode Exit fullscreen mode

If the health endpoint responds successfully, the storage server is reachable.

6. Persistent Storage

The /data directory must be persistent.

With a bind mount:

-v "$(pwd)/data:/data"
Enter fullscreen mode Exit fullscreen mode

the data lives directly on the host.

With Docker Compose:

volumes:
  - bastion-data:/data
Enter fullscreen mode Exit fullscreen mode

Docker manages the persistent volume.

Do not run a real storage deployment without persistent /data storage.

Destroying a container must not mean destroying your object store.

7. Durability Mode

For stronger crash-consistency behavior:

BASTION_DURABILITY=strict
Enter fullscreen mode Exit fullscreen mode

Example:

environment:
  BASTION_DURABILITY: strict
Enter fullscreen mode Exit fullscreen mode

Strict durability introduces stronger synchronization boundaries before writes are considered durable.

This may reduce maximum write throughput compared with less aggressive synchronization behavior.

For infrastructure testing, benchmark both throughput and failure recovery rather than measuring throughput alone.

8. Put Lioran S3 Behind Caddy

For an Internet-facing deployment, avoid treating the native HTTP listener as your TLS endpoint.

Use:

Client
   |
   | HTTPS
   v
Caddy :443
   |
   | HTTP
   v
Lioran S3 :27118
Enter fullscreen mode Exit fullscreen mode

Suppose your domain is:

storage.example.com
Enter fullscreen mode Exit fullscreen mode

A minimal Caddy configuration is:

storage.example.com {
    reverse_proxy 127.0.0.1:27118
}
Enter fullscreen mode Exit fullscreen mode

Caddy can then handle:

  • HTTPS
  • TLS certificates
  • certificate renewal
  • public HTTP/HTTPS traffic
  • reverse proxying to Lioran S3

Your public health endpoint becomes:

curl -f https://storage.example.com/health
Enter fullscreen mode Exit fullscreen mode

and metrics:

curl https://storage.example.com/metrics
Enter fullscreen mode Exit fullscreen mode

9. Better Network Isolation

If Caddy is running directly on the same host, you do not necessarily need to expose Lioran S3 on every network interface.

Instead of:

ports:
  - "27118:27118"
Enter fullscreen mode Exit fullscreen mode

you can bind the published port to localhost:

ports:
  - "127.0.0.1:27118:27118"
Enter fullscreen mode Exit fullscreen mode

Now:

Internet
   X
   |
Lioran S3 :27118
Enter fullscreen mode Exit fullscreen mode

is not directly exposed through the host's public interface.

Traffic instead follows:

Internet
   |
   v
Caddy :443
   |
   v
127.0.0.1:27118
   |
   v
Lioran S3
Enter fullscreen mode Exit fullscreen mode

This is generally a cleaner deployment when Caddy runs on the same machine.

10. Production-Style Compose Configuration

A more complete deployment can look like:

services:
  bastion:
    image: liorans3/liorans3:pre-alpha
    container_name: bastion-server
    restart: unless-stopped

    ports:
      - "127.0.0.1:27118:27118"

    environment:
      BASTION_ENV: production
      BASTION_HOST: 0.0.0.0
      BASTION_PORT: 27118
      BASTION_DATA_DIR: /data

      BASTION_ADMIN_USERNAME: admin
      BASTION_ADMIN_PASSWORD: "CHANGE_THIS_PASSWORD"

      BASTION_DURABILITY: strict

      BASTION_PUBLIC_URL: "https://storage.example.com"
      BASTION_CORS_ORIGINS: "https://app.example.com"
      BASTION_SIGNING_SECRET: "CHANGE_THIS_TO_A_LONG_RANDOM_SECRET"

    volumes:
      - bastion-data:/data

volumes:
  bastion-data:
Enter fullscreen mode Exit fullscreen mode

Generate strong secrets instead of copying example values.

11. Public URL

When the server is exposed through a public hostname, configure:

BASTION_PUBLIC_URL=https://storage.example.com
Enter fullscreen mode Exit fullscreen mode

This allows externally generated URLs to use the public hostname instead of an internal listener address.

12. CORS

If a browser application communicates directly with Lioran S3, configure the allowed origin:

BASTION_CORS_ORIGINS=https://app.example.com
Enter fullscreen mode Exit fullscreen mode

Avoid wildcard origins on an Internet-facing deployment unless that behavior is specifically required.

13. Signing Secret

Configure a persistent signing secret:

BASTION_SIGNING_SECRET=YOUR_LONG_RANDOM_SECRET
Enter fullscreen mode Exit fullscreen mode

Do not regenerate this value every time the container starts.

For example:

openssl rand -hex 32
Enter fullscreen mode Exit fullscreen mode

can be used on systems with OpenSSL installed to generate a random value.

Store secrets outside source control.

14. Updating Lioran S3

Pull the latest image associated with the pre-alpha tag:

docker pull liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

For Docker Compose:

docker compose pull
docker compose up -d
Enter fullscreen mode Exit fullscreen mode

Then verify:

docker compose ps
Enter fullscreen mode Exit fullscreen mode

and:

curl -f http://127.0.0.1:27118/health
Enter fullscreen mode Exit fullscreen mode

For reproducible deployments, prefer pinning an immutable release identifier when one is available rather than relying indefinitely on a moving tag.

15. Logs and Diagnostics

Container logs:

docker logs -f bastion-server
Enter fullscreen mode Exit fullscreen mode

Recent logs:

docker logs --tail 200 bastion-server
Enter fullscreen mode Exit fullscreen mode

Resource usage:

docker stats bastion-server
Enter fullscreen mode Exit fullscreen mode

Health:

curl http://127.0.0.1:27118/health
Enter fullscreen mode Exit fullscreen mode

Metrics:

curl http://127.0.0.1:27118/metrics
Enter fullscreen mode Exit fullscreen mode

If the Lioran S3 CLI is installed, system diagnostics can also be queried through the CLI.

16. Restart Testing

Storage infrastructure should survive something less polite than a graceful shutdown.

Restart the container:

docker restart bastion-server
Enter fullscreen mode Exit fullscreen mode

Then verify:

curl -f http://127.0.0.1:27118/health
Enter fullscreen mode Exit fullscreen mode

Also verify that previously stored objects remain readable.

For pre-alpha evaluation, test:

  • clean restart
  • forced termination
  • interrupted uploads
  • container recreation
  • low disk space
  • large objects
  • concurrent reads and writes
  • host restart
  • persistent-volume recovery

A green Docker status alone does not prove storage durability.

Deployment Checklist

Before exposing Lioran S3 publicly:

  • use a strong administrator password
  • persist /data
  • enable restart policies
  • put the server behind HTTPS
  • avoid exposing port 27118 publicly when unnecessary
  • configure the public URL
  • restrict CORS
  • configure a persistent signing secret
  • select the intended durability mode
  • monitor disk capacity
  • test large uploads
  • test interrupted transfers
  • test container restarts
  • verify stored objects after restart
  • monitor /health
  • collect /metrics
  • keep backups where appropriate
  • pin deployment versions when possible

Minimal Deployment

If you simply want Lioran S3 running locally:

docker run -d \
  --name bastion-server \
  --restart unless-stopped \
  -p 27118:27118 \
  -v "$(pwd)/data:/data" \
  -e BASTION_ENV=production \
  -e BASTION_ADMIN_USERNAME=admin \
  -e BASTION_ADMIN_PASSWORD='CHANGE_ME_NOW' \
  -e BASTION_DURABILITY=strict \
  liorans3/liorans3:pre-alpha
Enter fullscreen mode Exit fullscreen mode

Then:

curl http://127.0.0.1:27118/health
Enter fullscreen mode Exit fullscreen mode

That's enough to get the pre-built Lioran S3 V1 Pre-Alpha server running without cloning or compiling the source.

For an Internet-facing deployment, put the service behind Caddy or another properly configured reverse proxy and keep the data directory persistent.

Lioran S3 is developed by Lioran Developer Solutions (LDS) under Lioran Group, led by Swaraj Puppalwar.

Documentation: https://docs.liorans3.sbs

Product: https://liorans3.sbs

Top comments (0)