Files

backd itself stores no files. A realm that wants documents to carry files (an avatar, receipts, attachments) brings its own S3-compatible storage, from a closed list of providers: AWS S3, MinIO, Cloudflare R2 and DigitalOcean Spaces. The bucket stays private: files are only ever reached through backd, under the same access rules as the document they belong to.

Pages: connecting storage, file fields, uploads and downloads, rules for files, keeping storage tidy, files in apps, security, and files in functions.

The ideas#

• Every file belongs to a document field. There is no file area outside documents: a public asset or a personal file space is an ordinary collection whose documents carry the file.
• Storage is a realm’s concern. Each realm declares its own bucket, with its own keys; there is no instance-wide storage.
• A closed list of providers. What each provider can do is data in one place in backd: a provider that isn’t on the list fails the configuration check instead of failing in production, and backd never probes a service to find out what it supports.
• Only what every provider has: put, get (with ranges), head, delete, listing (for a manual reconcile only) and presigned links, all signed with AWS Signature Version 4.
• Encryption at rest is the bucket’s default, set at the provider. backd sends no encryption headers and has no setting for it; backd storage check reports the bucket’s status where the provider exposes it.

Start with Connecting storage and the page of your provider, then File fields, Uploads and downloads and Rules for files.