The headline

Object storage — S3/R2

RustFS, productized as public S3/R2 — with zero-egress-to-edge accounting.

SS-02 DBaaS owning service58 operations6 sub-capabilities

What it does

Object storage — S3/R2

A bucket is a RustFS claim. SS-02 fronts the platform's proven object substrate as a public, S3-compatible product: buckets with versioning and lifecycle, objects with prefix/delimiter listing, multipart uploads, scoped access keys and presigned URLs — plus a native S3 wire-protocol gateway with AWS SigV4 so real S3 clients connect directly. Egress is classified by destination: bytes served to our own SS-27 edge are intra-edge and zero-rated; only bytes that leave the platform are billable.

Sub-capabilities

The real surface, grouped.

Buckets, versioning & lifecycle

Create buckets backed by a RustFS claim with visibility and region; enable or suspend versioning; set per-bucket lifecycle rules that expire and transition objects deterministically at the injected clock.

Objects & prefix/delimiter listing

Put and delete objects with control-plane metadata (size, content-type, user metadata); list with prefix + delimiter folder rollup and pagination; enumerate all versions including delete markers.

Multipart uploads

Initiate, upload parts (strictly ascending), list in-progress uploads, complete or abort — the S3 multipart contract, for objects too large for a single PUT.

Access keys & presigned URLs

Issue scoped S3 access keys (the R2 API token; secret shown once), revoke them, presign a GET or PUT over an HMAC canonical string with a TTL, and verify a presigned request server-side.

S3 wire gateway (SigV4)

A native /s3 gateway speaks the S3 REST dialect with AWS Signature V4 auth — ListBuckets, CreateBucket, ListObjectsV2, GetObject/PutObject, multipart — so aws-cli, boto3 and S3 SDKs point straight at it, tenant resolved from the access key.

Zero-egress-to-edge accounting

Every byte served is recorded and classified: egress_intra_edge_bytes (served to SS-27, zero-rated) versus egress_external_bytes (billable). Usage is accounted, not estimated, per bucket and tenant-wide.

Endpoints

Real method + path — SS-02 DBaaS.

A representative slice of the 58 operations on SS-02. Base: https://api.edge.nexocloud.io/api/v1. Auth is an SS-01 bearer token plus X-Tenant-Id.

GET/api/v1/bucketsList the tenant's buckets.
POST/api/v1/bucketsCreate a bucket (RustFS claim): versioning, visibility, region.
PUT/api/v1/buckets/{bucket}/versioningEnable or suspend bucket versioning.
GET/api/v1/buckets/{bucket}/objectsList objects with prefix + delimiter and pagination.
PUT/api/v1/buckets/{bucket}/objects/{key}Put an object (control-plane metadata).
GET/api/v1/buckets/{bucket}/versionsList object versions incl. delete markers.
PUT/api/v1/buckets/{bucket}/lifecycleSet per-bucket lifecycle rules.
POST/api/v1/buckets/{bucket}/uploadsInitiate a multipart upload.
PUT/api/v1/buckets/{bucket}/uploads/{upload}/parts/{part}Upload a part; returns the part etag.
POST/api/v1/buckets/{bucket}/uploads/{upload}/completeComplete a multipart upload.
POST/api/v1/object/access-keysIssue an S3 access key (secret shown once).
POST/api/v1/buckets/{bucket}/presignPresign a GET or PUT (HMAC, TTL-bounded).
POST/api/v1/object/presign/verifyVerify a presigned request (TTL + signature).
GET/api/v1/buckets/{bucket}/usagePer-bucket usage: stored, objects, zero-rated vs billable egress.
POST/api/v1/buckets/{bucket}/egressRecord egress (intra-edge zero-rated; external billable).
PUT/s3/{bucket}/{key}S3 wire gateway — PutObject / UploadPart (SigV4).

Full endpoint catalog →

Worked example

Presign an R2 object — served with zero egress

Store an asset, mint a scoped access key, and presign a GET. When that URL is served through our own SS-27 edge, the bytes are classified intra-edge and never billed.

SS-02 DBaaS · bash
# 1. Create a versioned bucket (a RustFS claim)
curl -X POST "$BASE/buckets" -H "$AUTH" -H "$TENANT" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"name":"site-assets","versioning":true,"region":"eu-sov-1"}'

# 2. Put an object (or use any S3 SDK against /s3)
curl -X PUT "$BASE/buckets/site-assets/objects/app.v42.js" \
  -H "$AUTH" -H "$TENANT" -H "Content-Type: application/javascript" \
  --data-binary @app.v42.js

# 3. Presign a GET (TTL-bounded, HMAC over a canonical string)
curl -X POST "$BASE/buckets/site-assets/presign" \
  -H "$AUTH" -H "$TENANT" \
  -d '{"method":"GET","key":"app.v42.js","ttl_seconds":300}'
#  → { "url": "https://api.edge.nexocloud.io/s3/site-assets/app.v42.js?X-Sig=...",
#      "expires_at": "..." }

# 4. Read usage — the two egress lines are separate and explicit
curl "$BASE/buckets/site-assets/usage" -H "$AUTH" -H "$TENANT"
#  → { "stored_bytes": ..., "objects": ...,
#      "egress_intra_edge_bytes": 41230012,   // served via SS-27 → $0
#      "egress_external_bytes":  0 }           // left the platform → billable

The presigned URL resolves through the S3 wire gateway. Because SS-27 is the same platform, delivery to the edge is intra-edge — recorded as zero-rated, not credited after the fact.

Architecture placement

Where it sits on the plane.

Object storage sits at the origin of the plane — the same RustFS substrate that already backs SS-04/05/09/11/14/15, now fronted as a public product.

Engine
RustFS via SS-02 claims — no new service, no new engine; a bucket is a claim.
Wire
Native /s3 gateway with AWS SigV4; tenant resolved from the access key.
Egress edge
Served to SS-27 → intra-edge, zero-rated in the SS-60 usage ledger.
Keys
Access-key secrets and DSNs are Vault-backed (SS-05); the raw credential never leaves Vault.