VaultS3

WHAT IS IT?

VaultS3 is an S3-compatible object storage server written in Go and shipped as a single binary. You start it with no config file: it creates its directories, prints an admin secret on first boot, then exposes the S3 API and its web dashboard on port 9000. On disk, objects stay ordinary files and the index is a BoltDB file, so rclone sync or aws s3 sync is enough to walk away.

WHY IS IT INTERESTING?

• An S3 API that is measured, not claimed: 80+ operations, SigV4, multipart, range requests, conditional requests, checksums and presigned URLs. Compatibility is tested against ceph/s3-tests, the suite the rest of the ecosystem is graded on.
• Dashboard in the box: file browser, drag-and-drop upload, stats, IAM, audit, search and backups, translated into English, German, French and Chinese.
• Full access control: IAM users, groups and policies, OIDC/JWT SSO, LDAP, STS, per-bucket CORS, IP allowlists and an audit trail. Policy evaluation is default-deny.
• Encryption at rest: AES-256-GCM, SSE-S3, SSE-KMS and SSE-C, with per-bucket keys, rotation and crypto-shredding.
• Durability and clustering: Reed-Solomon erasure coding with a background healer, Raft-replicated metadata, and active-active replication whose conflicts resolve through vector clocks.
• Search and integrations: full-text over metadata and tags, optional semantic search and RAG retrieval with no external vector database, and notifications to Webhook, Kafka, NATS, Redis, AMQP, PostgreSQL or Elasticsearch.
• Bring your existing data: buckets import from MinIO, SeaweedFS, Garage, Ceph, AWS, R2, Wasabi or B2, keeping dates, metadata, policies and tags.
• Maturity stated per lane: single-node, erasure coding and tiering are called stable, Raft clustering and active-active are beta. The README lists its known edge cases instead of hiding them, and the project has a single maintainer.

USE CASES

• Replace a bucket billed per request and per GB egressed with storage on your own machine, when traffic costs more than volume.
• Act as the S3 target for Restic, rclone or any aws s3 client for backups.
• Give a dev or CI application an object backend, with no cloud account and no keys to rotate.
• Keep data on hardware you control when the constraint is regulatory or contractual.
• Put object storage on the same network as its clients, with no egress charges.

Every release publishes .deb, .rpm and .apk packages, static binaries for Linux, macOS and Windows, an SPDX SBOM per platform, and a Sigstore provenance bundle you can verify offline. An external white-box security assessment in August 2026 reported 14 findings, all fixed in 4.4.56.