docs

Installation

okuri is one binary named okuri. It needs exactly two things: a bucket to own and credentials to reach it.

From source

cargo build --release -p okuri-server

This produces target/release/okuri. Point it at a bucket via environment variables or a config file and start it:

export OKURI_S3_BUCKET=my-bucket
export OKURI_S3_ENDPOINT=http://localhost:9000   # MinIO; omit for AWS S3
export OKURI_S3_ACCESS_KEY=...
export OKURI_S3_SECRET_KEY=...
export OKURI_RECEIPT_HANDLE_KEY=$(head -c 32 /dev/urandom | base64)
export OKURI_API_KEYS=default:$(head -c 32 /dev/urandom | base64)
export OKURI_SQS_CREDENTIALS=default:AKIDEXAMPLE:$(head -c 32 /dev/urandom | base64)

okuri serve

okuri serve --config okuri.toml (or OKURI_CONFIG=okuri.toml) reads a TOML file instead; see configuration for the full reference and for what each of the required keys above does.

Container image

The repository’s Dockerfile builds a distroless image (gcr.io/distroless/cc-debian12:nonroot) whose entrypoint is the binary:

docker build -t okuri:dev .
docker run -p 8080:8080 -p 9090:9090 \
  -e OKURI_S3_BUCKET=... \
  -e OKURI_S3_ENDPOINT=... \
  -e OKURI_S3_ACCESS_KEY=... \
  -e OKURI_S3_SECRET_KEY=... \
  -e OKURI_RECEIPT_HANDLE_KEY=... \
  -e OKURI_API_KEYS=... \
  -e OKURI_SQS_CREDENTIALS=... \
  okuri:dev

Ports

The two listeners are separate so one can be exposed without the other.

Object stores

Any S3-compatible store works. Tested and supported today:

• AWS S3. Leave endpoint unset; credentials may come from the provider chain (instance role, environment, credentials file).
• MinIO. Set endpoint to the MinIO address.
• Cloudflare R2. Set endpoint to your account’s R2 endpoint.

GCS and Azure Blob support is planned.

Toolchain note

okuri pins its Rust toolchain in rust-toolchain.toml (Rust 1.97.1, edition 2024). rustup picks this up automatically when building from source.