Run self-hosted S3-compatible storage on a VPS with MinIO

MinIO is a lightweight, S3-compatible object storage server. Running MinIO on a VPS gives you a private S3 endpoint for app uploads, backups from other servers or development, using the same tools and SDKs as the big clouds.

Before you start

• A Linux VPS with enough disk for your data (a separate data disk is ideal; see mount a new disk).
• A domain or subdomain, e.g. s3.example.com, pointing to the VPS.
• Nginx installed for HTTPS.
• Read object storage explained for the concepts.
• Check MinIO's current licence and release notes; its editions and packaging have changed over time.

Install MinIO

Download the server binary from MinIO's official download page, then:

sudo install -m 755 minio /usr/local/bin/minio

sudo useradd -r -s /sbin/nologin minio-user && sudo mkdir -p /srv/minio && sudo chown minio-user: /srv/minio

Configure it

Create /etc/default/minio:

MINIO_VOLUMES="/srv/minio"
MINIO_OPTS="--address 127.0.0.1:9000 --console-address 127.0.0.1:9001"
MINIO_ROOT_USER="admin-change-me"
MINIO_ROOT_PASSWORD="a-long-random-password"

Restrict it: sudo chmod 600 /etc/default/minio.

Create a systemd service

/etc/systemd/system/minio.service:

[Unit]
Description=MinIO
After=network-online.target

[Service]
User=minio-user
Group=minio-user
EnvironmentFile=/etc/default/minio
ExecStart=/usr/local/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
Restart=always
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload && sudo systemctl enable --now minio

Put it behind Nginx with HTTPS

server {
    listen 443 ssl;
    server_name s3.example.com;
    client_max_body_size 0;
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:9000;
    }
}

Add certificate lines (for example from Let's Encrypt with certbot) and reload Nginx. Keep the console on 9001 private and reach it through an SSH tunnel.

Create buckets and access keys

Install the mc client, then:

mc alias set myminio https://s3.example.com admin-change-me 'a-long-random-password'

mc mb myminio/backups

Create a separate user for each app or server with a policy limited to its bucket, rather than sharing the root credentials. See the MinIO documentation for mc admin user and policy commands in your version.

Use it from other tools

Any S3 client works with the endpoint https://s3.example.com and path-style addressing. For server backups see rclone to S3.

Troubleshooting

• SignatureDoesNotMatch behind Nginx: the Host header is not passed through unchanged.
• Uploads fail at 1 MB: set client_max_body_size 0;.
• Service will not start: check journalctl -u minio and folder ownership.

Frequently asked questions

Is a single VPS enough for important backups?

It is one copy at one location. Keep another copy elsewhere, and use a multi-drive or multi-node setup for redundancy.

Can I host static files from MinIO?

Yes, with a public-read bucket policy, ideally behind a CDN.

MinIO or Ceph?

MinIO is simpler for single servers; Ceph suits large clusters. See Ceph.

Next steps

• Object storage explained
• Back up with rclone
• Install Nginx (LEMP)