From b4770f04a2649f3e2dd0791e4d4876f31d393182 Mon Sep 17 00:00:00 2001
From: vickytechkey <vichunice@gmail.com>
Date: Sat, 8 Aug 2026 18:06:16 +0530
Subject: [PATCH] feat: integrate S3 object storage for Forgejo via IAM
 permissions and environment configuration

---
 aws_cdk/lib/aws_cdk-stack.ts | 15 +++++++++++++++
 forgejo/.env.example         |  7 +++++++
 forgejo/docker-compose.yml   |  9 +++++++++
 3 files changed, 31 insertions(+)

diff --git a/aws_cdk/lib/aws_cdk-stack.ts b/aws_cdk/lib/aws_cdk-stack.ts
index e1f7d9b..2df757c 100644
--- a/aws_cdk/lib/aws_cdk-stack.ts
+++ b/aws_cdk/lib/aws_cdk-stack.ts
@@ -53,6 +53,21 @@ export class AwsCdkStack extends cdk.Stack {
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryReadOnly'));
 
+    // S3 access for Forgejo storage
+    role.addToPolicy(new iam.PolicyStatement({
+      actions: [
+        's3:ListBucket',
+        's3:GetBucketLocation',
+        's3:GetObject',
+        's3:PutObject',
+        's3:DeleteObject',
+      ],
+      resources: [
+        'arn:aws:s3:::forgeocodestorage-764709663363-ap-south-2-an',
+        'arn:aws:s3:::forgeocodestorage-764709663363-ap-south-2-an/*',
+      ],
+    }));
+
     // 3. Define the EC2 Instance (t4g.medium)
     const instance = new ec2.Instance(this, 'internalsInstance', {
       vpc,
diff --git a/forgejo/.env.example b/forgejo/.env.example
index 6bfa34d..a8b22e8 100644
--- a/forgejo/.env.example
+++ b/forgejo/.env.example
@@ -6,3 +6,10 @@ FORGEJO_DB_HOST=your_mysql_host:3306
 FORGEJO_DB_NAME=your_mysql_db_name
 FORGEJO_DB_USER=your_mysql_user
 FORGEJO_DB_PASSWORD=your_mysql_password
+
+# S3 Configuration
+FORGEJO_S3_ENDPOINT=s3.ap-south-2.amazonaws.com
+FORGEJO_S3_BUCKET=your-forgejo-s3-bucket
+AWS_REGION=ap-south-2
+AWS_ACCESS_KEY_ID=your_aws_access_key_id
+AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key
diff --git a/forgejo/docker-compose.yml b/forgejo/docker-compose.yml
index 1ffacbe..57e4f5f 100644
--- a/forgejo/docker-compose.yml
+++ b/forgejo/docker-compose.yml
@@ -22,6 +22,15 @@ services:
       
       # Disable public registration (prevent outside signups)
       - FORGEJO__service__DISABLE_REGISTRATION=true
+      
+      # S3 Object Storage Configuration (for Attachments, LFS, Packages)
+      - FORGEJO__storage__STORAGE_TYPE=minio
+      - FORGEJO__storage__MINIO_ENDPOINT=${FORGEJO_S3_ENDPOINT:-s3.amazonaws.com}
+      - FORGEJO__storage__MINIO_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
+      - FORGEJO__storage__MINIO_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+      - FORGEJO__storage__MINIO_BUCKET=${FORGEJO_S3_BUCKET}
+      - FORGEJO__storage__MINIO_LOCATION=${AWS_REGION:-ap-south-2}
+      - FORGEJO__storage__MINIO_USE_SSL=true
     ports:
       # Expose Forgejo HTTP port publicly
       - "3000:3000"