feat: integrate S3 object storage for Forgejo via IAM permissions and environment configuration

aws_cdk/lib/aws_cdk-stack.ts

@@ -53,6 +53,21 @@ export class AwsCdkStack extends cdk.Stack {
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryReadOnly'));
 
+    // S3 access for Forgejo storage
+    role.addToPolicy(new iam.PolicyStatement({
+      actions: [
+        's3:ListBucket',
+        's3:GetBucketLocation',
+        's3:GetObject',
+        's3:PutObject',
+        's3:DeleteObject',
+      ],
+      resources: [
+        'arn:aws:s3:::forgeocodestorage-764709663363-ap-south-2-an',
+        'arn:aws:s3:::forgeocodestorage-764709663363-ap-south-2-an/*',
+      ],
+    }));
+
     // 3. Define the EC2 Instance (t4g.medium)
     const instance = new ec2.Instance(this, 'internalsInstance', {
       vpc,

forgejo/.env.example

@@ -6,3 +6,10 @@ FORGEJO_DB_HOST=your_mysql_host:3306
 FORGEJO_DB_NAME=your_mysql_db_name
 FORGEJO_DB_USER=your_mysql_user
 FORGEJO_DB_PASSWORD=your_mysql_password
+
+# S3 Configuration
+FORGEJO_S3_ENDPOINT=s3.ap-south-2.amazonaws.com
+FORGEJO_S3_BUCKET=your-forgejo-s3-bucket
+AWS_REGION=ap-south-2
+AWS_ACCESS_KEY_ID=your_aws_access_key_id
+AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key

forgejo/docker-compose.yml

@@ -22,6 +22,15 @@ services:
       
       # Disable public registration (prevent outside signups)
       - FORGEJO__service__DISABLE_REGISTRATION=true
+      
+      # S3 Object Storage Configuration (for Attachments, LFS, Packages)
+      - FORGEJO__storage__STORAGE_TYPE=minio
+      - FORGEJO__storage__MINIO_ENDPOINT=${FORGEJO_S3_ENDPOINT:-s3.amazonaws.com}
+      - FORGEJO__storage__MINIO_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
+      - FORGEJO__storage__MINIO_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+      - FORGEJO__storage__MINIO_BUCKET=${FORGEJO_S3_BUCKET}
+      - FORGEJO__storage__MINIO_LOCATION=${AWS_REGION:-ap-south-2}
+      - FORGEJO__storage__MINIO_USE_SSL=true
     ports:
       # Expose Forgejo HTTP port publicly
       - "3000:3000"