Buckets, versioning & lifecycle
Create buckets backed by a RustFS claim with visibility and region; enable or suspend versioning; set per-bucket lifecycle rules that expire and transition objects deterministically at the injected clock.
The headline
RustFS, productized as public S3/R2 — with zero-egress-to-edge accounting.
What it does
A bucket is a RustFS claim. SS-02 fronts the platform's proven object substrate as a public, S3-compatible product: buckets with versioning and lifecycle, objects with prefix/delimiter listing, multipart uploads, scoped access keys and presigned URLs — plus a native S3 wire-protocol gateway with AWS SigV4 so real S3 clients connect directly. Egress is classified by destination: bytes served to our own SS-27 edge are intra-edge and zero-rated; only bytes that leave the platform are billable.
Sub-capabilities
Create buckets backed by a RustFS claim with visibility and region; enable or suspend versioning; set per-bucket lifecycle rules that expire and transition objects deterministically at the injected clock.
Put and delete objects with control-plane metadata (size, content-type, user metadata); list with prefix + delimiter folder rollup and pagination; enumerate all versions including delete markers.
Initiate, upload parts (strictly ascending), list in-progress uploads, complete or abort — the S3 multipart contract, for objects too large for a single PUT.
Issue scoped S3 access keys (the R2 API token; secret shown once), revoke them, presign a GET or PUT over an HMAC canonical string with a TTL, and verify a presigned request server-side.
A native /s3 gateway speaks the S3 REST dialect with AWS Signature V4 auth — ListBuckets, CreateBucket, ListObjectsV2, GetObject/PutObject, multipart — so aws-cli, boto3 and S3 SDKs point straight at it, tenant resolved from the access key.
Every byte served is recorded and classified: egress_intra_edge_bytes (served to SS-27, zero-rated) versus egress_external_bytes (billable). Usage is accounted, not estimated, per bucket and tenant-wide.
Endpoints
A representative slice of the 58 operations on SS-02. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.
/api/v1/bucketsList the tenant's buckets./api/v1/bucketsCreate a bucket (RustFS claim): versioning, visibility, region./api/v1/buckets/{bucket}/versioningEnable or suspend bucket versioning./api/v1/buckets/{bucket}/objectsList objects with prefix + delimiter and pagination./api/v1/buckets/{bucket}/objects/{key}Put an object (control-plane metadata)./api/v1/buckets/{bucket}/versionsList object versions incl. delete markers./api/v1/buckets/{bucket}/lifecycleSet per-bucket lifecycle rules./api/v1/buckets/{bucket}/uploadsInitiate a multipart upload./api/v1/buckets/{bucket}/uploads/{upload}/parts/{part}Upload a part; returns the part etag./api/v1/buckets/{bucket}/uploads/{upload}/completeComplete a multipart upload./api/v1/object/access-keysIssue an S3 access key (secret shown once)./api/v1/buckets/{bucket}/presignPresign a GET or PUT (HMAC, TTL-bounded)./api/v1/object/presign/verifyVerify a presigned request (TTL + signature)./api/v1/buckets/{bucket}/usagePer-bucket usage: stored, objects, zero-rated vs billable egress./api/v1/buckets/{bucket}/egressRecord egress (intra-edge zero-rated; external billable)./s3/{bucket}/{key}S3 wire gateway — PutObject / UploadPart (SigV4).Worked example
Store an asset, mint a scoped access key, and presign a GET. When that URL is served through our own SS-27 edge, the bytes are classified intra-edge and never billed.
# 1. Create a versioned bucket (a RustFS claim)
curl -X POST "$BASE/buckets" -H "$AUTH" -H "$TENANT" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{"name":"site-assets","versioning":true,"region":"eu-sov-1"}'
# 2. Put an object (or use any S3 SDK against /s3)
curl -X PUT "$BASE/buckets/site-assets/objects/app.v42.js" \
-H "$AUTH" -H "$TENANT" -H "Content-Type: application/javascript" \
--data-binary @app.v42.js
# 3. Presign a GET (TTL-bounded, HMAC over a canonical string)
curl -X POST "$BASE/buckets/site-assets/presign" \
-H "$AUTH" -H "$TENANT" \
-d '{"method":"GET","key":"app.v42.js","ttl_seconds":300}'
# → { "url": "https://api.edge.nexocloud.io/s3/site-assets/app.v42.js?X-Sig=...",
# "expires_at": "..." }
# 4. Read usage — the two egress lines are separate and explicit
curl "$BASE/buckets/site-assets/usage" -H "$AUTH" -H "$TENANT"
# → { "stored_bytes": ..., "objects": ...,
# "egress_intra_edge_bytes": 41230012, // served via SS-27 → $0
# "egress_external_bytes": 0 } // left the platform → billableThe presigned URL resolves through the S3 wire gateway. Because SS-27 is the same platform, delivery to the edge is intra-edge — recorded as zero-rated, not credited after the fact.
Architecture placement
Object storage sits at the origin of the plane — the same RustFS substrate that already backs SS-04/05/09/11/14/15, now fronted as a public product.
Keep exploring
Functions with immutable versions, rollback and a real WASM datapath — plus tiered cache and edge WAF.
Deep-dive →Signed zones, health-based steering, and 99.999% serve-stale through an origin incident.
Deep-dive →Mesh overlay, native WireGuard, full SASE and SD-WAN — unified by the UPO policy compiler.
Deep-dive →Gateway admission and edge WAF at the perimeter; detections-as-code and guard-railed containment behind it.
Deep-dive →PoPs, BGP sessions, anycast policies and failover drills — the GitOps-managed footprint the edge runs on.
Deep-dive →