Bump version to 0.9.1

Merge pull request 'CLI help, comments & messages: make clear that full-length node ID = public key' (#688 ) from rename-public-key into main
Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/688
2026-08-13 15:46:53 +00:00 · 2024-01-16 16:28:17 +01:00 · 2024-01-16 13:33:43 +00:00 · 2024-01-16 14:04:11 +01:00 · 2024-01-16 11:33:27 +00:00 · 2024-01-16 12:12:27 +01:00
70 changed files with 3439 additions and 648 deletions
@@ -0,0 +1,3 @@
+[target.x86_64-unknown-linux-gnu]
+linker = "clang"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
@@ -1198,7 +1198,7 @@ dependencies = [

 [[package]]
 name = "garage"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "assert-json-diff",
 "async-trait",
@@ -1227,6 +1227,7 @@ dependencies = [
 "hyper",
 "k2v-client",
 "kuska-sodiumoxide",
+ "mktemp",
 "netapp",
 "opentelemetry",
 "opentelemetry-otlp",
@@ -1249,7 +1250,7 @@ dependencies = [

 [[package]]
 name = "garage_api"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "async-trait",
 "base64 0.21.3",
@@ -1295,7 +1296,7 @@ dependencies = [

 [[package]]
 name = "garage_block"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "arc-swap",
 "async-compression",
@@ -1321,7 +1322,7 @@ dependencies = [

 [[package]]
 name = "garage_db"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "clap 4.4.0",
 "err-derive",
@@ -1336,7 +1337,7 @@ dependencies = [

 [[package]]
 name = "garage_model"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -1364,7 +1365,7 @@ dependencies = [

 [[package]]
 name = "garage_rpc"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -1399,7 +1400,7 @@ dependencies = [

 [[package]]
 name = "garage_table"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -1421,7 +1422,7 @@ dependencies = [

 [[package]]
 name = "garage_util"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "arc-swap",
 "async-trait",
@@ -1455,7 +1456,7 @@ dependencies = [

 [[package]]
 name = "garage_web"
-version = "0.8.4"
+version = "0.9.1"
 dependencies = [
 "err-derive",
 "futures",
@@ -33,7 +33,7 @@ args@{
  ignoreLockHash,
 }:
 let
-  nixifiedLockHash = "3f325a8a549c43a788ff702e65f6de2d42ad19a46067248e29108e90212ca2f5";
+  nixifiedLockHash = "f8da48e74313b18ee372a07d6a7d63a27c7effde24ed8599dfb91ea311df10f8";
  workspaceSrc = if args.workspaceSrc == null then ./. else args.workspaceSrc;
  currentLockHash = builtins.hashFile "sha256" (workspaceSrc + /Cargo.lock);
  lockHashIgnored = if ignoreLockHash
@@ -57,16 +57,16 @@ in
 {
  cargo2nixVersion = "0.11.0";
  workspace = {
-    garage_db = rustPackages.unknown.garage_db."0.8.4";
-    garage_util = rustPackages.unknown.garage_util."0.8.4";
-    garage_rpc = rustPackages.unknown.garage_rpc."0.8.4";
+    garage_db = rustPackages.unknown.garage_db."0.9.1";
+    garage_util = rustPackages.unknown.garage_util."0.9.1";
+    garage_rpc = rustPackages.unknown.garage_rpc."0.9.1";
    format_table = rustPackages.unknown.format_table."0.1.1";
-    garage_table = rustPackages.unknown.garage_table."0.8.4";
-    garage_block = rustPackages.unknown.garage_block."0.8.4";
-    garage_model = rustPackages.unknown.garage_model."0.8.4";
-    garage_api = rustPackages.unknown.garage_api."0.8.4";
-    garage_web = rustPackages.unknown.garage_web."0.8.4";
-    garage = rustPackages.unknown.garage."0.8.4";
+    garage_table = rustPackages.unknown.garage_table."0.9.1";
+    garage_block = rustPackages.unknown.garage_block."0.9.1";
+    garage_model = rustPackages.unknown.garage_model."0.9.1";
+    garage_api = rustPackages.unknown.garage_api."0.9.1";
+    garage_web = rustPackages.unknown.garage_web."0.9.1";
+    garage = rustPackages.unknown.garage."0.9.1";
    k2v-client = rustPackages.unknown.k2v-client."0.0.4";
  };
  "registry+https://github.com/rust-lang/crates.io-index".addr2line."0.21.0" = overridableMkRustCrate (profileName: rec {
@@ -1705,9 +1705,9 @@ in
    };
  });
  
-  "unknown".garage."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/garage");
    features = builtins.concatLists [
@@ -1734,14 +1734,14 @@ in
      format_table = (rustPackages."unknown".format_table."0.1.1" { inherit profileName; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_api = (rustPackages."unknown".garage_api."0.8.4" { inherit profileName; }).out;
-      garage_block = (rustPackages."unknown".garage_block."0.8.4" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
-      garage_model = (rustPackages."unknown".garage_model."0.8.4" { inherit profileName; }).out;
-      garage_rpc = (rustPackages."unknown".garage_rpc."0.8.4" { inherit profileName; }).out;
-      garage_table = (rustPackages."unknown".garage_table."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
-      garage_web = (rustPackages."unknown".garage_web."0.8.4" { inherit profileName; }).out;
+      garage_api = (rustPackages."unknown".garage_api."0.9.1" { inherit profileName; }).out;
+      garage_block = (rustPackages."unknown".garage_block."0.9.1" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
+      garage_model = (rustPackages."unknown".garage_model."0.9.1" { inherit profileName; }).out;
+      garage_rpc = (rustPackages."unknown".garage_rpc."0.9.1" { inherit profileName; }).out;
+      garage_table = (rustPackages."unknown".garage_table."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
+      garage_web = (rustPackages."unknown".garage_web."0.9.1" { inherit profileName; }).out;
      git_version = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".git-version."0.3.5" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      sodiumoxide = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".kuska-sodiumoxide."0.2.5-0" { inherit profileName; }).out;
@@ -1771,15 +1771,16 @@ in
      http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."0.2.9" { inherit profileName; }).out;
      hyper = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper."0.14.27" { inherit profileName; }).out;
      k2v_client = (rustPackages."unknown".k2v-client."0.0.4" { inherit profileName; }).out;
+      mktemp = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".mktemp."0.5.0" { inherit profileName; }).out;
      serde_json = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".serde_json."1.0.105" { inherit profileName; }).out;
      sha2 = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".sha2."0.10.7" { inherit profileName; }).out;
      static_init = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".static_init."1.0.3" { inherit profileName; }).out;
    };
  });
  
-  "unknown".garage_api."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_api."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_api";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/api");
    features = builtins.concatLists [
@@ -1798,11 +1799,11 @@ in
      form_urlencoded = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".form_urlencoded."1.2.0" { inherit profileName; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_block = (rustPackages."unknown".garage_block."0.8.4" { inherit profileName; }).out;
-      garage_model = (rustPackages."unknown".garage_model."0.8.4" { inherit profileName; }).out;
-      garage_rpc = (rustPackages."unknown".garage_rpc."0.8.4" { inherit profileName; }).out;
-      garage_table = (rustPackages."unknown".garage_table."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_block = (rustPackages."unknown".garage_block."0.9.1" { inherit profileName; }).out;
+      garage_model = (rustPackages."unknown".garage_model."0.9.1" { inherit profileName; }).out;
+      garage_rpc = (rustPackages."unknown".garage_rpc."0.9.1" { inherit profileName; }).out;
+      garage_table = (rustPackages."unknown".garage_table."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      hmac = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hmac."0.12.1" { inherit profileName; }).out;
      http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."0.2.9" { inherit profileName; }).out;
@@ -1832,9 +1833,9 @@ in
    };
  });
  
-  "unknown".garage_block."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_block."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_block";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/block");
    features = builtins.concatLists [
@@ -1848,10 +1849,10 @@ in
      bytesize = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".bytesize."1.3.0" { inherit profileName; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
-      garage_rpc = (rustPackages."unknown".garage_rpc."0.8.4" { inherit profileName; }).out;
-      garage_table = (rustPackages."unknown".garage_table."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
+      garage_rpc = (rustPackages."unknown".garage_rpc."0.9.1" { inherit profileName; }).out;
+      garage_table = (rustPackages."unknown".garage_table."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      opentelemetry = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".opentelemetry."0.17.0" { inherit profileName; }).out;
      rand = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rand."0.8.5" { inherit profileName; }).out;
@@ -1864,9 +1865,9 @@ in
    };
  });
  
-  "unknown".garage_db."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_db."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_db";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/db");
    features = builtins.concatLists [
@@ -1896,9 +1897,9 @@ in
    };
  });
  
-  "unknown".garage_model."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_model."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_model";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/model");
    features = builtins.concatLists [
@@ -1917,11 +1918,11 @@ in
      err_derive = (buildRustPackages."registry+https://github.com/rust-lang/crates.io-index".err-derive."0.3.1" { profileName = "__noProfile"; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_block = (rustPackages."unknown".garage_block."0.8.4" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
-      garage_rpc = (rustPackages."unknown".garage_rpc."0.8.4" { inherit profileName; }).out;
-      garage_table = (rustPackages."unknown".garage_table."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_block = (rustPackages."unknown".garage_block."0.9.1" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
+      garage_rpc = (rustPackages."unknown".garage_rpc."0.9.1" { inherit profileName; }).out;
+      garage_table = (rustPackages."unknown".garage_table."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      netapp = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".netapp."0.10.0" { inherit profileName; }).out;
      opentelemetry = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".opentelemetry."0.17.0" { inherit profileName; }).out;
@@ -1934,9 +1935,9 @@ in
    };
  });
  
-  "unknown".garage_rpc."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_rpc."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_rpc";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/rpc");
    features = builtins.concatLists [
@@ -1958,8 +1959,8 @@ in
      format_table = (rustPackages."unknown".format_table."0.1.1" { inherit profileName; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      gethostname = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".gethostname."0.4.3" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      itertools = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".itertools."0.10.5" { inherit profileName; }).out;
@@ -1982,9 +1983,9 @@ in
    };
  });
  
-  "unknown".garage_table."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_table."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_table";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/table");
    dependencies = {
@@ -1993,9 +1994,9 @@ in
      bytes = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".bytes."1.4.0" { inherit profileName; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.28" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
-      garage_rpc = (rustPackages."unknown".garage_rpc."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
+      garage_rpc = (rustPackages."unknown".garage_rpc."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      hexdump = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hexdump."0.1.1" { inherit profileName; }).out;
      opentelemetry = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".opentelemetry."0.17.0" { inherit profileName; }).out;
@@ -2007,9 +2008,9 @@ in
    };
  });
  
-  "unknown".garage_util."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_util."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_util";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/util");
    features = builtins.concatLists [
@@ -2025,7 +2026,7 @@ in
      digest = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".digest."0.10.7" { inherit profileName; }).out;
      err_derive = (buildRustPackages."registry+https://github.com/rust-lang/crates.io-index".err-derive."0.3.1" { profileName = "__noProfile"; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
-      garage_db = (rustPackages."unknown".garage_db."0.8.4" { inherit profileName; }).out;
+      garage_db = (rustPackages."unknown".garage_db."0.9.1" { inherit profileName; }).out;
      hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
      hexdump = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hexdump."0.1.1" { inherit profileName; }).out;
      http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."0.2.9" { inherit profileName; }).out;
@@ -2051,18 +2052,18 @@ in
    };
  });
  
-  "unknown".garage_web."0.8.4" = overridableMkRustCrate (profileName: rec {
+  "unknown".garage_web."0.9.1" = overridableMkRustCrate (profileName: rec {
    name = "garage_web";
-    version = "0.8.4";
+    version = "0.9.1";
    registry = "unknown";
    src = fetchCrateLocal (workspaceSrc + "/src/web");
    dependencies = {
      err_derive = (buildRustPackages."registry+https://github.com/rust-lang/crates.io-index".err-derive."0.3.1" { profileName = "__noProfile"; }).out;
      futures = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures."0.3.28" { inherit profileName; }).out;
-      garage_api = (rustPackages."unknown".garage_api."0.8.4" { inherit profileName; }).out;
-      garage_model = (rustPackages."unknown".garage_model."0.8.4" { inherit profileName; }).out;
-      garage_table = (rustPackages."unknown".garage_table."0.8.4" { inherit profileName; }).out;
-      garage_util = (rustPackages."unknown".garage_util."0.8.4" { inherit profileName; }).out;
+      garage_api = (rustPackages."unknown".garage_api."0.9.1" { inherit profileName; }).out;
+      garage_model = (rustPackages."unknown".garage_model."0.9.1" { inherit profileName; }).out;
+      garage_table = (rustPackages."unknown".garage_table."0.9.1" { inherit profileName; }).out;
+      garage_util = (rustPackages."unknown".garage_util."0.9.1" { inherit profileName; }).out;
      http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."0.2.9" { inherit profileName; }).out;
      hyper = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper."0.14.27" { inherit profileName; }).out;
      hyperlocal = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyperlocal."0.8.0" { inherit profileName; }).out;
@@ -18,14 +18,14 @@ default-members = ["src/garage"]

 [workspace.dependencies]
 format_table = { version = "0.1.1", path = "src/format-table" }
-garage_api = { version = "0.8.4", path = "src/api" }
-garage_block = { version = "0.8.4", path = "src/block" }
-garage_db = { version = "0.8.4", path = "src/db", default-features = false }
-garage_model = { version = "0.8.4", path = "src/model", default-features = false }
-garage_rpc = { version = "0.8.4", path = "src/rpc" }
-garage_table = { version = "0.8.4", path = "src/table" }
-garage_util = { version = "0.8.4", path = "src/util" }
-garage_web = { version = "0.8.4", path = "src/web" }
+garage_api = { version = "0.9.1", path = "src/api" }
+garage_block = { version = "0.9.1", path = "src/block" }
+garage_db = { version = "0.9.1", path = "src/db", default-features = false }
+garage_model = { version = "0.9.1", path = "src/model", default-features = false }
+garage_rpc = { version = "0.9.1", path = "src/rpc" }
+garage_table = { version = "0.9.1", path = "src/table" }
+garage_util = { version = "0.9.1", path = "src/util" }
+garage_web = { version = "0.9.1", path = "src/web" }
 k2v-client = { version = "0.0.4", path = "src/k2v-client" }

 [profile.dev]
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Garage Adminstration API v0</title>
+    <!-- needed for adaptive design -->
+    <meta charset="utf-8"/>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link href="./css/redoc.css" rel="stylesheet">
+
+    <!--
+    Redoc doesn't change outer page styles
+    -->
+    <style>
+      body {
+        margin: 0;
+        padding: 0;
+      }
+    </style>
+  </head>
+  <body>
+    <redoc spec-url='./garage-admin-v1.yml'></redoc>
+    <script src="./redoc.standalone.js"> </script>
+  </body>
+</html>
@@ -37,30 +37,84 @@ import (
    "context"
    "fmt"
    "os"
+    "strings"
    garage "git.deuxfleurs.fr/garage-sdk/garage-admin-sdk-golang"
 )

 func main() {
-    // Set Host and other parameters
+    // Initialization
    configuration := garage.NewConfiguration()
    configuration.Host = "127.0.0.1:3903"
-
-
-    // We can now generate a client
    client := garage.NewAPIClient(configuration)
-
-    // Authentication is handled through the context pattern
    ctx := context.WithValue(context.Background(), garage.ContextAccessToken, "s3cr3t")

-    // Send a request
-    resp, r, err := client.NodesApi.GetNodes(ctx).Execute()
-    if err != nil {
-        fmt.Fprintf(os.Stderr, "Error when calling `NodesApi.GetNodes``: %v\n", err)
-        fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
+    // Nodes
+    fmt.Println("--- nodes ---")
+    nodes, _, _ := client.NodesApi.GetNodes(ctx).Execute()
+    fmt.Fprintf(os.Stdout, "First hostname: %v\n", nodes.KnownNodes[0].Hostname)
+    capa := int64(1000000000)
+    change := []garage.NodeRoleChange{
+	    garage.NodeRoleChange{NodeRoleUpdate: &garage.NodeRoleUpdate {
+	        Id: *nodes.KnownNodes[0].Id,
+	        Zone: "dc1",
+	        Capacity: *garage.NewNullableInt64(&capa),
+	        Tags: []string{ "fast", "amd64" },
+	    }},
    }
+    staged, _, _ := client.LayoutApi.AddLayout(ctx).NodeRoleChange(change).Execute()
+    msg, _, _ := client.LayoutApi.ApplyLayout(ctx).LayoutVersion(*garage.NewLayoutVersion(staged.Version + 1)).Execute()
+    fmt.Printf(strings.Join(msg.Message, "\n")) // Layout configured

-    // Process the response
-    fmt.Fprintf(os.Stdout, "Target hostname: %v\n", resp.KnownNodes[resp.Node].Hostname)
+    health, _, _ := client.NodesApi.GetHealth(ctx).Execute()
+    fmt.Printf("Status: %s, nodes: %v/%v, storage: %v/%v, partitions: %v/%v\n", health.Status, health.ConnectedNodes, health.KnownNodes, health.StorageNodesOk, health.StorageNodes, health.PartitionsAllOk, health.Partitions)
+
+    // Key
+    fmt.Println("\n--- key ---")
+    key := "openapi-key"
+    keyInfo, _, _ := client.KeyApi.AddKey(ctx).AddKeyRequest(garage.AddKeyRequest{Name: *garage.NewNullableString(&key) }).Execute()
+    defer client.KeyApi.DeleteKey(ctx).Id(*keyInfo.AccessKeyId).Execute()
+    fmt.Printf("AWS_ACCESS_KEY_ID=%s\nAWS_SECRET_ACCESS_KEY=%s\n", *keyInfo.AccessKeyId, *keyInfo.SecretAccessKey.Get())
+
+    id := *keyInfo.AccessKeyId
+    canCreateBucket := true
+    updateKeyRequest := *garage.NewUpdateKeyRequest()
+    updateKeyRequest.SetName("openapi-key-updated")
+    updateKeyRequest.SetAllow(garage.UpdateKeyRequestAllow { CreateBucket: &canCreateBucket })
+    update, _, _ := client.KeyApi.UpdateKey(ctx).Id(id).UpdateKeyRequest(updateKeyRequest).Execute()
+    fmt.Printf("Updated %v with key name %v\n", *update.AccessKeyId, *update.Name)
+
+    keyList, _, _ := client.KeyApi.ListKeys(ctx).Execute()
+    fmt.Printf("Keys count: %v\n", len(keyList))
+
+    // Bucket
+    fmt.Println("\n--- bucket ---")
+    global_name := "global-ns-openapi-bucket"
+    local_name := "local-ns-openapi-bucket"
+    bucketInfo, _, _ := client.BucketApi.CreateBucket(ctx).CreateBucketRequest(garage.CreateBucketRequest{
+        GlobalAlias: &global_name,
+        LocalAlias: &garage.CreateBucketRequestLocalAlias {
+            AccessKeyId: keyInfo.AccessKeyId,
+	    Alias: &local_name,
+        },
+    }).Execute()
+    defer client.BucketApi.DeleteBucket(ctx).Id(*bucketInfo.Id).Execute()
+    fmt.Printf("Bucket id: %s\n", *bucketInfo.Id)
+
+    updateBucketRequest := *garage.NewUpdateBucketRequest()
+    website := garage.NewUpdateBucketRequestWebsiteAccess()
+    website.SetEnabled(true)
+    website.SetIndexDocument("index.html")
+    website.SetErrorDocument("errors/4xx.html")
+    updateBucketRequest.SetWebsiteAccess(*website)
+    quotas := garage.NewUpdateBucketRequestQuotas()
+    quotas.SetMaxSize(1000000000)
+    quotas.SetMaxObjects(999999999)
+    updateBucketRequest.SetQuotas(*quotas)
+    updatedBucket, _, _ := client.BucketApi.UpdateBucket(ctx).Id(*bucketInfo.Id).UpdateBucketRequest(updateBucketRequest).Execute()
+    fmt.Printf("Bucket %v website activation: %v\n", *updatedBucket.Id, *updatedBucket.WebsiteAccess)
+
+    bucketList, _, _ := client.BucketApi.ListBuckets(ctx).Execute()
+    fmt.Printf("Bucket count: %v\n", len(bucketList))
 }
 ```

@@ -31,9 +31,9 @@ npm install --save git+https://git.deuxfleurs.fr/garage-sdk/garage-admin-sdk-js.
 A short example:

 ```javascript
-const garage = require('garage_administration_api_v0garage_v0_8_0');
+const garage = require('garage_administration_api_v1garage_v0_9_0');

-const api = new garage.ApiClient("http://127.0.0.1:3903/v0");
+const api = new garage.ApiClient("http://127.0.0.1:3903/v1");
 api.authentications['bearerAuth'].accessToken = "s3cr3t";

 const [node, layout, key, bucket] = [
@@ -80,7 +80,7 @@ from garage_admin_sdk.apis import *
 from garage_admin_sdk.models import *

 configuration = garage_admin_sdk.Configuration(
-  host = "http://localhost:3903/v0",
+  host = "http://localhost:3903/v1",
  access_token = "s3cr3t"
 )

@@ -94,13 +94,14 @@ print(f"running garage {status.garage_version}, node_id {status.node}")

 # Change layout of this node
 current = layout.get_layout()
-layout.add_layout({
-  status.node: NodeClusterInfo(
+layout.add_layout([
+  NodeRoleChange(
+    id = status.node,
    zone = "dc1",
-    capacity = 1,
+    capacity = 1000000000,
    tags = [ "dev" ],
  )
-})
+])
 layout.apply_layout(LayoutVersion(
  version = current.version + 1
 ))
@@ -146,7 +146,7 @@ Keep the Key ID and the Secret key in a pad, they will be needed later.

 We need two buckets, one for normal videos (named peertube-video) and one for webtorrent videos (named peertube-playlist).
 ```bash
-garage bucket create peertube-video
+garage bucket create peertube-videos
 garage bucket create peertube-playlist
 ```

@@ -216,7 +216,7 @@ object_storage:

  # Same settings but for webtorrent videos
  videos:
-    bucket_name: 'peertube-video'
+    bucket_name: 'peertube-videos'
    prefix: ''
    # You must fill this field to make Peertube use our reverse proxy/website logic
    base_url: 'http://peertube-videos.web.garage.localhost'
@@ -38,7 +38,7 @@ Our website serving logic is as follow:

 Now we need to infer the URL of your website through your bucket name.
 Let assume:
-  - we set `root_domain = ".web.example.com"` in `garage.toml` ([ref](@/documentation/reference-manual/configuration.md#root_domain))
+  - we set `root_domain = ".web.example.com"` in `garage.toml` ([ref](@/documentation/reference-manual/configuration.md#web_root_domain))
  - our bucket name is `garagehq.deuxfleurs.fr`.

 Our bucket will be served if the Host field matches one of these 2 values (the port is ignored):
@@ -19,9 +19,10 @@ To run a real-world deployment, make sure the following conditions are met:

 - You have at least three machines with sufficient storage space available.

- Each machine has a public IP address which is reachable by other machines. It
-  is highly recommended that you use IPv6 for this end-to-end connectivity. If
-  IPv6 is not available, then using a mesh VPN such as
+- Each machine has an IP address which makes it directly reachable by all other machines.
+  In many cases, nodes will be behind a NAT and will not each have a public
+  IPv4 addresses. In this case, is recommended that you use IPv6 for this
+  end-to-end connectivity if it is available. Otherwise, using a mesh VPN such as
  [Nebula](https://github.com/slackhq/nebula) or
  [Yggdrasil](https://yggdrasil-network.github.io/) are approaches to consider
  in addition to building out your own VPN tunneling.
@@ -42,7 +43,7 @@ For our example, we will suppose the following infrastructure with IPv6 connecti
 | Brussels | Mars    | fc00:F::1  | 1.5 TB     |

 Note that Garage will **always** store the three copies of your data on nodes at different
-locations. This means that in the case of this small example, the available capacity
+locations. This means that in the case of this small example, the usable capacity
 of the cluster is in fact only 1.5 TB, because nodes in Brussels can't store more than that.
 This also means that nodes in Paris and London will be under-utilized.
 To make better use of the available hardware, you should ensure that the capacity
@@ -84,14 +85,14 @@ to store 2 TB of data in total.
 ## Get a Docker image

 Our docker image is currently named `dxflrs/garage` and is stored on the [Docker Hub](https://hub.docker.com/r/dxflrs/garage/tags?page=1&ordering=last_updated).
-We encourage you to use a fixed tag (eg. `v0.8.0`) and not the `latest` tag.
-For this example, we will use the latest published version at the time of the writing which is `v0.8.0` but it's up to you
+We encourage you to use a fixed tag (eg. `v0.9.1`) and not the `latest` tag.
+For this example, we will use the latest published version at the time of the writing which is `v0.9.1` but it's up to you
 to check [the most recent versions on the Docker Hub](https://hub.docker.com/r/dxflrs/garage/tags?page=1&ordering=last_updated).

 For example:

 ```
-sudo docker pull dxflrs/garage:v0.8.0
+sudo docker pull dxflrs/garage:v0.9.1
 ```

 ## Deploying and configuring Garage
@@ -156,12 +157,13 @@ docker run \
  -v /etc/garage.toml:/etc/garage.toml \
  -v /var/lib/garage/meta:/var/lib/garage/meta \
  -v /var/lib/garage/data:/var/lib/garage/data \
-  dxflrs/garage:v0.8.0
+  dxflrs/garage:v0.9.1
 ```

-It should be restarted automatically at each reboot.
-Please note that we use host networking as otherwise Docker containers
-can not communicate with IPv6.
+With this command line, Garage should be started automatically at each boot.
+Please note that we use host networking as otherwise the network indirection
+added by Docker would prevent Garage nodes from communicating with one another
+(especially if using IPv6).

 If you want to use `docker-compose`, you may use the following `docker-compose.yml` file as a reference:

@@ -169,7 +171,7 @@ If you want to use `docker-compose`, you may use the following `docker-compose.y
 version: "3"
 services:
  garage:
-    image: dxflrs/garage:v0.8.0
+    image: dxflrs/garage:v0.9.1
    network_mode: "host"
    restart: unless-stopped
    volumes:
@@ -178,10 +180,12 @@ services:
      - /var/lib/garage/data:/var/lib/garage/data
 ```

-Upgrading between Garage versions should be supported transparently,
-but please check the relase notes before doing so!
-To upgrade, simply stop and remove this container and
-start again the command with a new version of Garage.
+If you wish to upgrade your cluster, make sure to read the corresponding
+[documentation page](@/documentation/operations/upgrading.md) first, as well as
+the documentation relevant to your version of Garage in the case of major
+upgrades.  With the containerized setup proposed here, the upgrade process
+will require stopping and removing the existing container, and re-creating it
+with the upgraded version.

 ## Controling the daemon

@@ -265,12 +269,12 @@ of a role that is assigned to each active cluster node.
 For our example, we will suppose we have the following infrastructure
 (Capacity, Identifier and Zone are specific values to Garage described in the following):

-| Location | Name    | Disk Space | `Capacity` | `Identifier` | `Zone` |
-|----------|---------|------------|------------|--------------|--------------|
-| Paris    | Mercury | 1 TB       | `10`       | `563e`     | `par1`       |
-| Paris    | Venus   | 2 TB       | `20`       | `86f0`     | `par1`       |
-| London   | Earth   | 2 TB       | `20`       | `6814`     | `lon1`       |
-| Brussels | Mars    | 1.5 TB     | `15`       | `212f`     | `bru1`       |
+| Location | Name    | Disk Space | Identifier | Zone (`-z`) | Capacity (`-c`) |
+|----------|---------|------------|------------|-------------|-----------------|
+| Paris    | Mercury | 1 TB       | `563e`     | `par1`      | `1T`            |
+| Paris    | Venus   | 2 TB       | `86f0`     | `par1`      | `2T`            |
+| London   | Earth   | 2 TB       | `6814`     | `lon1`      | `2T`            |
+| Brussels | Mars    | 1.5 TB     | `212f`     | `bru1`      | `1.5T`          |

 #### Node identifiers

@@ -292,6 +296,8 @@ garage status
 It will display the IP address associated with each node;
 from the IP address you will be able to recognize the node.

+We will now use the `garage layout assign` command to configure the correct parameters for each node.
+
 #### Zones

 Zones are simply a user-chosen identifier that identify a group of server that are grouped together logically.
@@ -301,29 +307,29 @@ In most cases, a zone will correspond to a geographical location (i.e. a datacen
 Behind the scene, Garage will use zone definition to try to store the same data on different zones,
 in order to provide high availability despite failure of a zone.

+Zones are passed to Garage using the `-z` flag of `garage layout assign` (see below).
+
 #### Capacity

-Garage reasons on an abstract metric about disk storage that is named the *capacity* of a node.
-The capacity configured in Garage must be proportional to the disk space dedicated to the node.
+Garage needs to know the storage capacity (disk space) it can/should use on
+each node, to be able to correctly balance data.

-Capacity values must be **integers** but can be given any signification.
-Here we chose that 1 unit of capacity = 100 GB.
+Capacity values are expressed in bytes and are passed to Garage using the `-c` flag of `garage layout assign` (see below).

-Note that the amount of data stored by Garage on each server may not be strictly proportional to
-its capacity value, as Garage will priorize having 3 copies of data in different zones,
-even if this means that capacities will not be strictly respected. For example in our above examples,
-nodes Earth and Mars will always store a copy of everything each, and the third copy will
-have 66% chance of being stored by Venus and 33% chance of being stored by Mercury.
+#### Tags
+
+You can add additional tags to nodes using the `-t` flag of `garage layout assign` (see below).
+Tags have no specific meaning for Garage and can be used at your convenience.

 #### Injecting the topology

 Given the information above, we will configure our cluster as follow:

 ```bash
-garage layout assign 563e -z par1 -c 10 -t mercury
-garage layout assign 86f0 -z par1 -c 20 -t venus
-garage layout assign 6814 -z lon1 -c 20 -t earth 
-garage layout assign 212f -z bru1 -c 15 -t mars 
+garage layout assign 563e -z par1 -c 1T -t mercury
+garage layout assign 86f0 -z par1 -c 2T -t venus
+garage layout assign 6814 -z lon1 -c 2T -t earth 
+garage layout assign 212f -z bru1 -c 1.5T -t mars 
 ```

 At this point, the changes in the cluster layout have not yet been applied.
@@ -333,6 +339,7 @@ To show the new layout that will be applied, call:
 garage layout show
 ```

+Make sure to read carefully the output of `garage layout show`.
 Once you are satisfied with your new layout, apply it with:

 ```bash
@@ -12,7 +12,7 @@ An introduction to building cluster layouts can be found in the [production depl
 In Garage, all of the data that can be stored in a given cluster is divided
 into slices which we call *partitions*. Each partition is stored by
 one or several nodes in the cluster
-(see [`replication_mode`](@/documentation/reference-manual/configuration.md#replication-mode)).
+(see [`replication_mode`](@/documentation/reference-manual/configuration.md#replication_mode)).
 The layout determines the correspondence between these partition,
 which exist on a logical level, and actual storage nodes.

@@ -84,9 +84,8 @@ admin_token = "$(openssl rand -base64 32)"
 EOF
 ```

-Now that your configuration file has been created, you can put
-it in the right place. By default, garage looks at **`/etc/garage.toml`.**
-
+Now that your configuration file has been created, you may save it to the directory of your choice.
+By default, Garage looks for **`/etc/garage.toml`.**
 You can also store it somewhere else, but you will have to specify `-c path/to/garage.toml`
 at each invocation of the `garage` binary (for example: `garage -c ./garage.toml server`, `garage -c ./garage.toml status`).

@@ -103,12 +102,14 @@ your data to be persisted properly.

 ### Launching the Garage server

-Use the following command to launch the Garage server with our configuration file:
+Use the following command to launch the Garage server:

 ```
-garage server
+garage -c path/to/garage.toml server
 ```

+If you have placed the `garage.toml` file in `/etc` (its default location), you can simply run `garage server`.
+
 You can tune Garage's verbosity as follows (from less verbose to more verbose):

 ```
@@ -126,7 +127,7 @@ Log level `debug` can help you check why your S3 API calls are not working.
 The `garage` utility is also used as a CLI tool to configure your Garage deployment.
 It uses values from the TOML configuration file to find the Garage daemon running on the
 local node, therefore if your configuration file is not at `/etc/garage.toml` you will
-again have to specify `-c path/to/garage.toml`.
+again have to specify `-c path/to/garage.toml` at each invocation.

 If the `garage` CLI is able to correctly detect the parameters of your local Garage node,
 the following command should be enough to show the status of your cluster:
@@ -140,7 +141,7 @@ This should show something like this:
 ```
 ==== HEALTHY NODES ====
 ID                 Hostname  Address         Tag                   Zone  Capacity
-563e1ac825ee3323…  linuxbox  127.0.0.1:3901  NO ROLE ASSIGNED
+563e1ac825ee3323   linuxbox  127.0.0.1:3901  NO ROLE ASSIGNED
 ```

 ## Creating a cluster layout
@@ -153,12 +154,12 @@ For our test deployment, we are using only one node. The way in which we configu
 it does not matter, you can simply write:

 ```bash
-garage layout assign -z dc1 -c 1 <node_id>
+garage layout assign -z dc1 -c 1G <node_id>
 ```

 where `<node_id>` corresponds to the identifier of the node shown by `garage status` (first column).
 You can enter simply a prefix of that identifier.
-For instance here you could write just `garage layout assign -z dc1 -c 1 563e`.
+For instance here you could write just `garage layout assign -z dc1 -c 1G 563e`.

 The layout then has to be applied to the cluster, using:

@@ -13,8 +13,11 @@ We will bump the version numbers prefixed to each API endpoint at each time the
 or semantics change, meaning that code that relies on these endpoint will break
 when changes are introduced.

-The Garage administration API was introduced in version 0.7.2, this document
-does not apply to older versions of Garage.
+Versions:
+ - Before Garage 0.7.2 - no admin API
+ - Garage 0.7.2 - admin APIv0
+ - Garage 0.9.0 - admin APIv1, deprecate admin APIv0
+


 ## Access control
@@ -131,7 +134,9 @@ $ curl -so /dev/null -w "%{http_code}" http://localhost:3903/check?domain=exampl

 ### Cluster operations

-These endpoints are defined on a dedicated [Redocly page](https://garagehq.deuxfleurs.fr/api/garage-admin-v0.html). You can also download its [OpenAPI specification](https://garagehq.deuxfleurs.fr/api/garage-admin-v0.yml).
+These endpoints have a dedicated OpenAPI spec.
+ - APIv1 - [HTML spec](https://garagehq.deuxfleurs.fr/api/garage-admin-v1.html) - [OpenAPI YAML](https://garagehq.deuxfleurs.fr/api/garage-admin-v1.yml)
+ - APIv0 (deprecated) - [HTML spec](https://garagehq.deuxfleurs.fr/api/garage-admin-v0.html) - [OpenAPI YAML](https://garagehq.deuxfleurs.fr/api/garage-admin-v0.yml)

 Requesting the API from the command line can be as simple as running:

@@ -8,6 +8,8 @@ weight = 20
 Here is an example `garage.toml` configuration file that illustrates all of the possible options:

 ```toml
+replication_mode = "3"
+
 metadata_dir = "/var/lib/garage/meta"
 data_dir = "/var/lib/garage/data"
 metadata_fsync = true
@@ -21,8 +23,6 @@ sled_cache_capacity = "128MiB"
 sled_flush_every_ms = 2000
 lmdb_map_size = "1T"

-replication_mode = "3"
-
 compression_level = 1

 rpc_secret = "4425f5c26c5e11581d3223904324dcb5b5d5dfb14e5e7f35e38c595424f5f1e6"
@@ -77,157 +77,64 @@ The following gives details about each available configuration option.

 ## Available configuration options

-### `metadata_dir`
+### Index

-The directory in which Garage will store its metadata. This contains the node identifier,
-the network configuration and the peer list, the list of buckets and keys as well
-as the index of all objects, object version and object blocks.
+Top-level configuration options:
+[`block_size`](#block_size),
+[`bootstrap_peers`](#bootstrap_peers),
+[`compression_level`](#compression_level),
+[`data_dir`](#metadata_dir),
+[`data_fsync`](#data_fsync),
+[`db_engine`](#db_engine),
+[`lmdb_map_size`](#lmdb_map_size),
+[`metadata_dir`](#metadata_dir),
+[`metadata_fsync`](#metadata_fsync),
+[`replication_mode`](#replication_mode),
+[`rpc_bind_addr`](#rpc_bind_addr),
+[`rpc_public_addr`](#rpc_public_addr),
+[`rpc_secret`](#rpc_secret),
+[`rpc_secret_file`](#rpc_secret),
+[`sled_cache_capacity`](#sled_cache_capacity),
+[`sled_flush_every_ms`](#sled_flush_every_ms).

-Store this folder on a fast SSD drive if possible to maximize Garage's performance.
+The `[consul_discovery]` section:
+[`api`](#consul_api),
+[`ca_cert`](#consul_ca_cert),
+[`client_cert`](#consul_client_cert),
+[`client_key`](#consul_client_cert),
+[`consul_http_addr`](#consul_http_addr),
+[`meta`](#consul_tags),
+[`service_name`](#consul_service_name),
+[`tags`](#consul_tags),
+[`tls_skip_verify`](#consul_tls_skip_verify),
+[`token`](#consul_token).

-### `data_dir`
+The `[kubernetes_discovery]` section:
+[`namespace`](#kube_namespace),
+[`service_name`](#kube_service_name),
+[`skip_crd`](#kube_skip_crd).

-The directory in which Garage will store the data blocks of objects.
-This folder can be placed on an HDD. The space available for `data_dir`
-should be counted to determine a node's capacity
-when [adding it to the cluster layout](@/documentation/cookbook/real-world.md).
+The `[s3_api]` section:
+[`api_bind_addr`](#s3_api_bind_addr),
+[`root_domain`](#s3_root_domain),
+[`s3_region`](#s3_region).

-Since `v0.9.0`, Garage supports multiple data directories with the following syntax:
+The `[s3_web]` section:
+[`bind_addr`](#web_bind_addr),
+[`root_domain`](#web_root_domain).

-```toml
-data_dir = [
-    { path = "/path/to/old_data", read_only = true },
-    { path = "/path/to/new_hdd1", capacity = "2T" },
-    { path = "/path/to/new_hdd2", capacity = "4T" },
-]
-```
+The `[admin]` section:
+[`api_bind_addr`](#admin_api_bind_addr),
+[`metrics_token`](#admin_metrics_token),
+[`metrics_token_file`](#admin_metrics_token),
+[`admin_token`](#admin_token),
+[`admin_token_file`](#admin_token),
+[`trace_sink`](#admin_trace_sink),

-See [the dedicated documentation page](@/documentation/operations/multi-hdd.md)
-on how to operate Garage in such a setup.

-### `db_engine` (since `v0.8.0`)
+### Top-level configuration options

-By default, Garage uses the Sled embedded database library
-to store its metadata on-disk. Since `v0.8.0`, Garage can use alternative storage backends as follows:
-
-| DB engine | `db_engine` value | Database path |
-| --------- | ----------------- | ------------- |
-| [Sled](https://sled.rs) | `"sled"` | `<metadata_dir>/db/` |
-| [LMDB](https://www.lmdb.tech) | `"lmdb"` | `<metadata_dir>/db.lmdb/` |
-| [Sqlite](https://sqlite.org) | `"sqlite"` | `<metadata_dir>/db.sqlite` |
-
-Performance characteristics of the different DB engines are as follows:
-
- Sled: the default database engine, which tends to produce
-  large data files and also has performance issues, especially when the metadata folder
-  is on a traditional HDD and not on SSD.
- LMDB: the recommended alternative on 64-bit systems,
-  much more space-efficiant and slightly faster. Note that the data format of LMDB is not portable
-  between architectures, so for instance the Garage database of an x86-64
-  node cannot be moved to an ARM64 node. Also note that, while LMDB can technically be used on 32-bit systems,
-  this will limit your node to very small database sizes due to how LMDB works; it is therefore not recommended.
- Sqlite: Garage supports Sqlite as a storage backend for metadata,
-  however it may have issues and is also very slow in its current implementation,
-  so it is not recommended to be used for now.
-
-It is possible to convert Garage's metadata directory from one format to another with a small utility named `convert_db`,
-which can be downloaded at the following locations:
-[for amd64](https://garagehq.deuxfleurs.fr/_releases/convert_db/amd64/convert_db),
-[for i386](https://garagehq.deuxfleurs.fr/_releases/convert_db/i386/convert_db),
-[for arm64](https://garagehq.deuxfleurs.fr/_releases/convert_db/arm64/convert_db),
-[for arm](https://garagehq.deuxfleurs.fr/_releases/convert_db/arm/convert_db).
-The `convert_db` utility is used as folows:
-
-```
-convert-db -a <input db engine> -i <input db path> \
-  		   -b <output db engine> -o <output db path>
-```
-
-Make sure to specify the full database path as presented in the table above,
-and not just the path to the metadata directory.
-
-### `metadata_fsync`
-
-Whether to enable synchronous mode for the database engine or not.
-This is disabled (`false`) by default.
-
-This reduces the risk of metadata corruption in case of power failures,
-at the cost of a significant drop in write performance,
-as Garage will have to pause to sync data to disk much more often
-(several times for API calls such as PutObject).
-
-Using this option reduces the risk of simultaneous metadata corruption on several
-cluster nodes, which could lead to data loss.
-
-If multi-site replication is used, this option is most likely not necessary, as
-it is extremely unlikely that two nodes in different locations will have a 
-power failure at the exact same time.
-
-(Metadata corruption on a single node is not an issue, the corrupted data file
-can always be deleted and reconstructed from the other nodes in the cluster.)
-
-Here is how this option impacts the different database engines:
-
-| Database | `metadata_fsync = false` (default) | `metadata_fsync = true`       |
-|----------|------------------------------------|-------------------------------|
-| Sled     | default options                    | *unsupported*                 |
-| Sqlite   | `PRAGMA synchronous = OFF`         | `PRAGMA synchronous = NORMAL` |
-| LMDB     | `MDB_NOMETASYNC` + `MDB_NOSYNC`    | `MDB_NOMETASYNC`              |
-
-Note that the Sqlite database is always ran in `WAL` mode (`PRAGMA journal_mode = WAL`).
-
-### `data_fsync`
-
-Whether to `fsync` data blocks and their containing directory after they are
-saved to disk.
-This is disabled (`false`) by default.
-
-This might reduce the risk that a data block is lost in rare
-situations such as simultaneous node losing power,
-at the cost of a moderate drop in write performance.
-
-Similarly to `metatada_fsync`, this is likely not necessary
-if geographical replication is used.
-
-### `block_size`
-
-Garage splits stored objects in consecutive chunks of size `block_size`
-(except the last one which might be smaller). The default size is 1MiB and
-should work in most cases. We recommend increasing it to e.g. 10MiB if
-you are using Garage to store large files and have fast network connections
-between all nodes (e.g. 1gbps).
-
-If you are interested in tuning this, feel free to do so (and remember to
-report your findings to us!). When this value is changed for a running Garage
-installation, only files newly uploaded will be affected. Previously uploaded
-files will remain available. This however means that chunks from existing files
-will not be deduplicated with chunks from newly uploaded files, meaning you
-might use more storage space that is optimally possible.
-
-### `sled_cache_capacity`
-
-This parameter can be used to tune the capacity of the cache used by
-[sled](https://sled.rs), the database Garage uses internally to store metadata.
-Tune this to fit the RAM you wish to make available to your Garage instance.
-This value has a conservative default (128MB) so that Garage doesn't use too much
-RAM by default, but feel free to increase this for higher performance.
-
-### `sled_flush_every_ms`
-
-This parameters can be used to tune the flushing interval of sled.
-Increase this if sled is thrashing your SSD, at the risk of losing more data in case
-of a power outage (though this should not matter much as data is replicated on other
-nodes). The default value, 2000ms, should be appropriate for most use cases.
-
-### `lmdb_map_size`
-
-This parameters can be used to set the map size used by LMDB,
-which is the size of the virtual memory region used for mapping the database file.
-The value of this parameter is the maximum size the metadata database can take.
-This value is not bound by the physical RAM size of the machine running Garage.
-If not specified, it defaults to 1GiB on 32-bit machines and 1TiB on 64-bit machines.
-
-### `replication_mode`
+#### `replication_mode` {#replication_mode}

 Garage supports the following replication modes:

@@ -310,7 +217,160 @@ to the cluster while rebalancing is in progress.  In theory, no data should be
 lost as rebalancing is a routine operation for Garage, although we cannot
 guarantee you that everything will go right in such an extreme scenario.

-### `compression_level`
+#### `metadata_dir` {#metadata_dir}
+
+The directory in which Garage will store its metadata. This contains the node identifier,
+the network configuration and the peer list, the list of buckets and keys as well
+as the index of all objects, object version and object blocks.
+
+Store this folder on a fast SSD drive if possible to maximize Garage's performance.
+
+#### `data_dir` {#data_dir}
+
+The directory in which Garage will store the data blocks of objects.
+This folder can be placed on an HDD. The space available for `data_dir`
+should be counted to determine a node's capacity
+when [adding it to the cluster layout](@/documentation/cookbook/real-world.md).
+
+Since `v0.9.0`, Garage supports multiple data directories with the following syntax:
+
+```toml
+data_dir = [
+    { path = "/path/to/old_data", read_only = true },
+    { path = "/path/to/new_hdd1", capacity = "2T" },
+    { path = "/path/to/new_hdd2", capacity = "4T" },
+]
+```
+
+See [the dedicated documentation page](@/documentation/operations/multi-hdd.md)
+on how to operate Garage in such a setup.
+
+#### `db_engine` (since `v0.8.0`) {#db_engine}
+
+Since `v0.8.0`, Garage can use alternative storage backends as follows:
+
+| DB engine | `db_engine` value | Database path |
+| --------- | ----------------- | ------------- |
+| [LMDB](https://www.lmdb.tech) (default since `v0.9.0`) | `"lmdb"` | `<metadata_dir>/db.lmdb/` |
+| [Sled](https://sled.rs) (default up to `v0.8.0`) | `"sled"` | `<metadata_dir>/db/` |
+| [Sqlite](https://sqlite.org) | `"sqlite"` | `<metadata_dir>/db.sqlite` |
+
+Sled was the only database engine up to Garage v0.7.0. Performance issues and
+API limitations of Sled prompted the addition of alternative engines in v0.8.0.
+Since v0.9.0, LMDB is the default engine instead of Sled, and Sled is
+deprecated. We plan to remove Sled in Garage v1.0.
+
+Performance characteristics of the different DB engines are as follows:
+
+- Sled: tends to produce large data files and also has performance issues,
+  especially when the metadata folder is on a traditional HDD and not on SSD.
+
+- LMDB: the recommended database engine on 64-bit systems, much more
+  space-efficient and slightly faster. Note that the data format of LMDB is not
+  portable between architectures, so for instance the Garage database of an
+  x86-64 node cannot be moved to an ARM64 node. Also note that, while LMDB can
+  technically be used on 32-bit systems, this will limit your node to very
+  small database sizes due to how LMDB works; it is therefore not recommended.
+
+- Sqlite: Garage supports Sqlite as an alternative storage backend for
+  metadata, and although it has not been tested as much, it is expected to work
+  satisfactorily.  Since Garage v0.9.0, performance issues have largely been
+  fixed by allowing for a no-fsync mode (see `metadata_fsync`). Sqlite does not
+  have the database size limitation of LMDB on 32-bit systems.
+
+It is possible to convert Garage's metadata directory from one format to another
+using the `garage convert-db` command, which should be used as follows:
+
+```
+garage convert-db -a <input db engine> -i <input db path> \
+                  -b <output db engine> -o <output db path>
+```
+
+Make sure to specify the full database path as presented in the table above
+(third colummn), and not just the path to the metadata directory.
+
+#### `metadata_fsync` {#metadata_fsync}
+
+Whether to enable synchronous mode for the database engine or not.
+This is disabled (`false`) by default.
+
+This reduces the risk of metadata corruption in case of power failures,
+at the cost of a significant drop in write performance,
+as Garage will have to pause to sync data to disk much more often
+(several times for API calls such as PutObject).
+
+Using this option reduces the risk of simultaneous metadata corruption on several
+cluster nodes, which could lead to data loss.
+
+If multi-site replication is used, this option is most likely not necessary, as
+it is extremely unlikely that two nodes in different locations will have a 
+power failure at the exact same time.
+
+(Metadata corruption on a single node is not an issue, the corrupted data file
+can always be deleted and reconstructed from the other nodes in the cluster.)
+
+Here is how this option impacts the different database engines:
+
+| Database | `metadata_fsync = false` (default) | `metadata_fsync = true`       |
+|----------|------------------------------------|-------------------------------|
+| Sled     | default options                    | *unsupported*                 |
+| Sqlite   | `PRAGMA synchronous = OFF`         | `PRAGMA synchronous = NORMAL` |
+| LMDB     | `MDB_NOMETASYNC` + `MDB_NOSYNC`    | `MDB_NOMETASYNC`              |
+
+Note that the Sqlite database is always ran in `WAL` mode (`PRAGMA journal_mode = WAL`).
+
+#### `data_fsync` {#data_fsync}
+
+Whether to `fsync` data blocks and their containing directory after they are
+saved to disk.
+This is disabled (`false`) by default.
+
+This might reduce the risk that a data block is lost in rare
+situations such as simultaneous node losing power,
+at the cost of a moderate drop in write performance.
+
+Similarly to `metatada_fsync`, this is likely not necessary
+if geographical replication is used.
+
+#### `block_size` {#block_size}
+
+Garage splits stored objects in consecutive chunks of size `block_size`
+(except the last one which might be smaller). The default size is 1MiB and
+should work in most cases. We recommend increasing it to e.g. 10MiB if
+you are using Garage to store large files and have fast network connections
+between all nodes (e.g. 1gbps).
+
+If you are interested in tuning this, feel free to do so (and remember to
+report your findings to us!). When this value is changed for a running Garage
+installation, only files newly uploaded will be affected. Previously uploaded
+files will remain available. This however means that chunks from existing files
+will not be deduplicated with chunks from newly uploaded files, meaning you
+might use more storage space that is optimally possible.
+
+#### `sled_cache_capacity` {#sled_cache_capacity}
+
+This parameter can be used to tune the capacity of the cache used by
+[sled](https://sled.rs), the database Garage uses internally to store metadata.
+Tune this to fit the RAM you wish to make available to your Garage instance.
+This value has a conservative default (128MB) so that Garage doesn't use too much
+RAM by default, but feel free to increase this for higher performance.
+
+#### `sled_flush_every_ms` {#sled_flush_every_ms}
+
+This parameters can be used to tune the flushing interval of sled.
+Increase this if sled is thrashing your SSD, at the risk of losing more data in case
+of a power outage (though this should not matter much as data is replicated on other
+nodes). The default value, 2000ms, should be appropriate for most use cases.
+
+#### `lmdb_map_size` {#lmdb_map_size}
+
+This parameters can be used to set the map size used by LMDB,
+which is the size of the virtual memory region used for mapping the database file.
+The value of this parameter is the maximum size the metadata database can take.
+This value is not bound by the physical RAM size of the machine running Garage.
+If not specified, it defaults to 1GiB on 32-bit machines and 1TiB on 64-bit machines.
+
+#### `compression_level` {#compression_level}

 Zstd compression level to use for storing blocks.

@@ -334,7 +394,7 @@ Compression is done synchronously, setting a value too high will add latency to
 This value can be different between nodes, compression is done by the node which receive the
 API call.

-### `rpc_secret`, `rpc_secret_file` or `GARAGE_RPC_SECRET` (env)
+#### `rpc_secret`, `rpc_secret_file` or `GARAGE_RPC_SECRET`, `GARAGE_RPC_SECRET_FILE` (env) {#rpc_secret}

 Garage uses a secret key, called an RPC secret, that is shared between all
 nodes of the cluster in order to identify these nodes and allow them to
@@ -346,7 +406,10 @@ Since Garage `v0.8.2`, the RPC secret can also be stored in a file whose path is
 given in the configuration variable `rpc_secret_file`, or specified as an
 environment variable `GARAGE_RPC_SECRET`.

-### `rpc_bind_addr`
+Since Garage `v0.8.5` and `v0.9.1`, you can also specify the path of a file
+storing the secret as the `GARAGE_RPC_SECRET_FILE` environment variable.
+
+#### `rpc_bind_addr` {#rpc_bind_addr}

 The address and port on which to bind for inter-cluster communcations
 (reffered to as RPC for remote procedure calls).
@@ -355,14 +418,14 @@ the node, even in the case of a NAT: the NAT should be configured to forward the
 port number to the same internal port nubmer. This means that if you have several nodes running
 behind a NAT, they should each use a different RPC port number.

-### `rpc_public_addr`
+#### `rpc_public_addr` {#rpc_public_addr}

 The address and port that other nodes need to use to contact this node for
 RPC calls.  **This parameter is optional but recommended.** In case you have
 a NAT that binds the RPC port to a port that is different on your public IP,
 this field might help making it work.

-### `bootstrap_peers`
+#### `bootstrap_peers` {#bootstrap_peers}

 A list of peer identifiers on which to contact other Garage peers of this cluster.
 These peer identifiers have the following syntax:
@@ -378,43 +441,54 @@ be obtained by running `garage node id` and then included directly in the
 key will be returned by `garage node id` and you will have to add the IP
 yourself.

+### `allow_world_readable_secrets`

-## The `[consul_discovery]` section
+Garage checks the permissions of your secret files to make sure they're not
+world-readable. In some cases, the check might fail and consider your files as
+world-readable even if they're not, for instance when using Posix ACLs.
+
+Setting `allow_world_readable_secrets` to `true` bypass this
+permission verification.
+
+Alternatively, you can set the `GARAGE_ALLOW_WORLD_READABLE_SECRETS`
+environment variable to `true` to bypass the permissions check.
+
+### The `[consul_discovery]` section

 Garage supports discovering other nodes of the cluster using Consul.  For this
 to work correctly, nodes need to know their IP address by which they can be
 reached by other nodes of the cluster, which should be set in `rpc_public_addr`.

-### `consul_http_addr` and `service_name`
+#### `consul_http_addr` {#consul_http_addr}

 The `consul_http_addr` parameter should be set to the full HTTP(S) address of the Consul server.

-### `api`
+#### `api` {#consul_api}

 Two APIs for service registration are supported: `catalog`  and `agent`. `catalog`, the default, will register a service using
 the `/v1/catalog` endpoints, enabling mTLS if `client_cert` and `client_key` are provided. The `agent` API uses the
 `v1/agent` endpoints instead, where an optional `token` may be provided.

-### `service_name`
+#### `service_name` {#consul_service_name}

 `service_name` should be set to the service name under which Garage's
 RPC ports are announced.

-### `client_cert`, `client_key`
+#### `client_cert`, `client_key` {#consul_client_cert}

 TLS client certificate and client key to use when communicating with Consul over TLS. Both are mandatory when doing so.
 Only available when `api = "catalog"`.

-### `ca_cert`
+#### `ca_cert` {#consul_ca_cert}

 TLS CA certificate to use when communicating with Consul over TLS.

-### `tls_skip_verify`
+#### `tls_skip_verify` {#consul_tls_skip_verify}

 Skip server hostname verification in TLS handshake.
 `ca_cert` is ignored when this is set.

-### `token`
+#### `token` {#consul_token}

 Uses the provided token for communication with Consul. Only available when `api = "agent"`.
 The policy assigned to this token should at least have these rules:
@@ -434,49 +508,49 @@ node_prefix "" {
 }
 ```

-### `tags` and `meta`
+#### `tags` and `meta` {#consul_tags}

 Additional list of tags and map of service meta to add during service registration.

-## The `[kubernetes_discovery]` section
+### The `[kubernetes_discovery]` section

 Garage supports discovering other nodes of the cluster using kubernetes custom
 resources. For this to work, a `[kubernetes_discovery]` section must be present
 with at least the `namespace` and `service_name` parameters.

-### `namespace`
+#### `namespace` {#kube_namespace}

 `namespace` sets the namespace in which the custom resources are
 configured.

-### `service_name`
+#### `service_name` {#kube_service_name}

 `service_name` is added as a label to the advertised resources to
 filter them, to allow for multiple deployments in a single namespace.

-### `skip_crd`
+#### `skip_crd` {#kube_skip_crd}

 `skip_crd` can be set to true to disable the automatic creation and
 patching of the `garagenodes.deuxfleurs.fr` CRD. You will need to create the CRD
 manually.


-## The `[s3_api]` section
+### The `[s3_api]` section

-### `api_bind_addr`
+#### `api_bind_addr` {#s3_api_bind_addr}

 The IP and port on which to bind for accepting S3 API calls.
 This endpoint does not suport TLS: a reverse proxy should be used to provide it.

 Alternatively, since `v0.8.5`, a path can be used to create a unix socket with 0222 mode.

-### `s3_region`
+#### `s3_region` {#s3_region}

 Garage will accept S3 API calls that are targetted to the S3 region defined here.
 API calls targetted to other regions will fail with a AuthorizationHeaderMalformed error
 message that redirects the client to the correct region.

-### `root_domain` {#root_domain}
+#### `root_domain` {#s3_root_domain}

 The optional suffix to access bucket using vhost-style in addition to path-style request.
 Note path-style requests are always enabled, whether or not vhost-style is configured.
@@ -488,12 +562,12 @@ using the hostname `my-bucket.s3.garage.eu`.



-## The `[s3_web]` section
+### The `[s3_web]` section

 Garage allows to publish content of buckets as websites. This section configures the
 behaviour of this module.

-### `bind_addr`
+#### `bind_addr` {#web_bind_addr}

 The IP and port on which to bind for accepting HTTP requests to buckets configured
 for website access.
@@ -501,7 +575,7 @@ This endpoint does not suport TLS: a reverse proxy should be used to provide it.

 Alternatively, since `v0.8.5`, a path can be used to create a unix socket with 0222 mode.

-### `root_domain`
+#### `root_domain` {#web_root_domain}

 The optional suffix appended to bucket names for the corresponding HTTP Host.

@@ -510,11 +584,11 @@ will be accessible either with hostname `deuxfleurs.fr.web.garage.eu`
 or with hostname `deuxfleurs.fr`.


-## The `[admin]` section
+### The `[admin]` section

 Garage has a few administration capabilities, in particular to allow remote monitoring. These features are detailed below.

-### `api_bind_addr`
+#### `api_bind_addr` {#admin_api_bind_addr}

 If specified, Garage will bind an HTTP server to this port and address, on
 which it will listen to requests for administration features.
@@ -523,7 +597,7 @@ See [administration API reference](@/documentation/reference-manual/admin-api.md
 Alternatively, since `v0.8.5`, a path can be used to create a unix socket. Note that for security reasons,
 the socket will have 0220 mode. Make sure to set user and group permissions accordingly.

-### `metrics_token`, `metrics_token_file` or `GARAGE_METRICS_TOKEN` (env)
+#### `metrics_token`, `metrics_token_file` or `GARAGE_METRICS_TOKEN`, `GARAGE_METRICS_TOKEN_FILE` (env) {#admin_metrics_token}

 The token for accessing the Metrics endpoint. If this token is not set, the
 Metrics endpoint can be accessed without access control.
@@ -533,8 +607,9 @@ You can use any random string for this value. We recommend generating a random t
 `metrics_token` was introduced in Garage `v0.7.2`.
 `metrics_token_file` and the `GARAGE_METRICS_TOKEN` environment variable are supported since Garage `v0.8.2`.

+`GARAGE_METRICS_TOKEN_FILE` is supported since `v0.8.5` / `v0.9.1`.

-### `admin_token`, `admin_token_file` or `GARAGE_ADMIN_TOKEN` (env)
+#### `admin_token`, `admin_token_file` or `GARAGE_ADMIN_TOKEN`, `GARAGE_ADMIN_TOKEN_FILE` (env) {#admin_token}

 The token for accessing all of the other administration endpoints.  If this
 token is not set, access to these endpoints is disabled entirely.
@@ -544,8 +619,9 @@ You can use any random string for this value. We recommend generating a random t
 `admin_token` was introduced in Garage `v0.7.2`.
 `admin_token_file` and the `GARAGE_ADMIN_TOKEN` environment variable are supported since Garage `v0.8.2`.

+`GARAGE_ADMIN_TOKEN_FILE` is supported since `v0.8.5` / `v0.9.1`.

-### `trace_sink`
+#### `trace_sink` {#admin_trace_sink}

 Optionally, the address of an OpenTelemetry collector.  If specified,
 Garage will send traces in the OpenTelemetry format to this endpoint. These
@@ -52,7 +52,7 @@ This is particularly usefull when nodes are far from one another and talk to one

 Garage supports a variety of replication modes, with 1 copy, 2 copies or 3 copies of your data,
 and with various levels of consistency, in order to adapt to a variety of usage scenarios.
-Read our reference page on [supported replication modes](@/documentation/reference-manual/configuration.md#replication-mode)
+Read our reference page on [supported replication modes](@/documentation/reference-manual/configuration.md#replication_mode)
 to select the replication mode best suited to your use case (hint: in most cases, `replication_mode = "3"` is what you want).

 ### Web server for static websites
@@ -1,13 +1,16 @@
 +++
 title = "Migrating from 0.8 to 0.9"
-weight = 14
+weight = 12
 +++

 **This guide explains how to migrate to 0.9 if you have an existing 0.8 cluster.
 We don't recommend trying to migrate to 0.9 directly from 0.7 or older.**

-**We make no guarantee that this migration will work perfectly:
-back up all your data before attempting it!**
+This migration procedure has been tested on several clusters without issues.
+However, it is still a *critical procedure* that might cause issues.
+**Make sure to back up all your data before attempting it!**
+
+You might also want to read our [general documentation on upgrading Garage](@/documentation/operations/upgrading.md).

 The following are **breaking changes** in Garage v0.9 that require your attention when migrating:

@@ -48,6 +48,10 @@
          pkgsSrc = nixpkgs;
          cargo2nixOverlay = cargo2nix.overlays.default;
          release = false;
-        }).workspaceShell { packages = [ pkgs.rustfmt ]; };
+        }).workspaceShell { packages = with pkgs; [
+          rustfmt
+          clang
+          mold
+        ]; };
      });
 }
@@ -21,4 +21,4 @@ version: 0.4.1
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.8.4"
+appVersion: "v0.9.1"
@@ -0,0 +1 @@
+use nix
@@ -0,0 +1,17 @@
+/target
+/classes
+/checkouts
+profiles.clj
+pom.xml
+pom.xml.asc
+*.jar
+*.class
+/.lein-*
+/.nrepl-port
+/.prepl-port
+.hgignore
+.hg/
+.direnv
+/store
+/store.*
+.vagrant
@@ -0,0 +1,166 @@
+# jepsen.garage
+
+Jepsen checking of Garage consistency properties.
+
+## Usage
+
+Requirements:
+
+- vagrant
+- VirtualBox, configured so that nodes can take an IP in a private network `192.168.56.0/24` (it's the default)
+- a user that can create VirtualBox VMs
+- leiningen
+- gnuplot
+
+Set up VMs before running tests:
+
+```
+vagrant up
+```
+
+Run tests: see commands below.
+
+
+## Results
+
+### Register linear, without timestamp patch
+
+Command: `lein run test --nodes-file nodes.vagrant --time-limit 60 --rate 100  --concurrency 20 --workload reg1 --ops-per-key 100`
+
+Results without timestamp patch:
+
+- Fails with a simple clock-scramble nemesis (`--scenario c`).
+  Explanation: without the timestamp patch, nodes will create objects using their
+  local clock only as a timestamp, so the ordering will be all over the place if
+  clocks are scrambled.
+
+Results with timestamp patch (`--patch tsfix2`):
+
+- No failure with clock-scramble nemesis
+
+- Fails with clock-scramble nemesis + partition nemesis (`--scenario cp`).
+
+**This test is expected to fail.**
+Indeed, S3 objects are not meant to behave like linearizable registers.
+TODO explain using a counter-example
+
+
+### Read-after-write CRDT register model
+
+Command: `lein run test --nodes-file nodes.vagrant --time-limit 60 --rate 100  --concurrency 100 --workload reg2 --ops-per-key 100`
+
+Results without timestamp patch:
+
+- Fails with a simple clock-scramble nemesis (`--scenario c`).
+  Explanation: old values are not overwritten correctly when their timestamps are in the future.
+
+Results with timestamp patch (`--patch tsfix2`):
+
+- No failures with clock-scramble nemesis + partition nemesis (`--scenario cp`).
+  This proves that `tsfix2` (PR#543) does improve consistency.
+
+- **Fails with layout reconfiguration nemesis** (`--scenario r`).
+  Example of a failed run: `garage reg2/20231024T120806.899+0200`.
+  This is the failure mode we are looking for and trying to fix for NLnet task 3.
+
+Results with NLnet task 3 code (commit 707442f5de, `--patch task3a`):
+
+- No failures with `--scenario r` (0 of 10 runs), `--scenario pr` (0 of 10 runs),
+  `--scenario cpr` (0 of 10 runs) and `--scenario dpr` (0 of 10 runs).
+
+- Same with `--patch task3c` (commit `0041b013`, the final version).
+
+
+### Set, basic test (write some items, then read)
+
+Command: `lein run test --nodes-file nodes.vagrant --time-limit 60 --rate 200  --concurrency 200 --workload set1 --ops-per-key 100`
+
+Results without NLnet task3 code (`--patch tsfix2`):
+
+- For now, no failures with clock-scramble nemesis + partition nemesis -> TODO long test run
+
+- Does not seem to fail with only the layout reconfiguation nemesis (<10 runs), although theoretically it could
+
+- **Fails with the partition + layout reconfiguration nemesis** (`--scenario pr`).
+  Example of a failed run: `garage set1/20231024T172214.488+0200` (1 failure in 4 runs).
+  This is the failure mode we are looking for and trying to fix for NLnet task 3.
+
+Results with NLnet task 3 code (commit 707442f5de, `--patch task3a`):
+
+- The tests are buggy and often result in an "unknown" validity status, which
+  is caused by some requests not returning results during network partitions or
+  other nemesis-induced broken cluster states.  However, when the tests were
+  able to finish, there were no failures with scenarios `r`, `pr`, `cpr`,
+  `dpr`.
+
+
+### Set, continuous test (interspersed reads and writes)
+
+Command: `lein run test --nodes-file nodes.vagrant --time-limit 60 --rate 100  --concurrency 100 --workload set2 --ops-per-key 100`
+
+Results without NLnet task3 code (`--patch tsfix2`):
+
+- No failures with clock-scramble nemesis + db nemesis + partition nemesis (`--scenario cdp`) (0 failures in 10 runs).
+
+- **Fails with just layout reconfiguration nemesis** (`--scenario r`).
+  Example of a failed run: `garage set2/20231025T141940.198+0200` (10 failures in 10 runs).
+  This is the failure mode we are looking for and trying to fix for NLnet task 3.
+
+Results with NLnet task3 code (commit 707442f5de, `--patch task3a`):
+
+- No failures with `--scenario r` (0 of 10 runs), `--scenario pr` (0 of 10 runs),
+  `--scenario cpr` (0 of 10 runs) and `--scenario dpr` (0 of 10 runs).
+
+- Same with `--patch task3c` (commit `0041b013`, the final version).
+
+
+## NLnet task 3 final results
+
+- With code from task3 (`--patch task3c`): [reg2 and set2](results/Results-2023-12-13-task3c.png), [set1](results/Results-2023-12-14-task3-set1.png).
+- Without (`--patch tsfix2`): [reg2 and set2](results/Results-2023-12-13-tsfix2.png), set1 TBD.
+
+## Investigating (and fixing) errors
+
+### Segfaults
+
+They are due to the download being interrupted in the middle (^C during first launch on clean VMs), the `garage` binary is truncated.
+Add `:force?` to the `cached-wget!` call in `daemon.clj` to re-download the binary,
+or restar the VMs to clear temporary files.
+
+### In `jepsen.garage`: prefix wierdness
+
+In `store/garage set1/20231019T163358.615+0200`:
+
+```
+INFO [2023-10-19 16:35:20,977] clojure-agent-send-off-pool-207 - jepsen.garage.set list results for prefix set20/ : (set13/0 set13/1 set13/10 set13/11 set13/12 set13/13 set13/14 set13/15 set13/16 set13/17 set13/18 set13/19 set13/2 set13/20 set13/21 set13/22 set13/23 set13/24 set13/25 set13/26 set13/27 set13/28 set13/29 set13/3 set13/30 set13/31 set13/32 set13/33 set13/34 set13/35 set13/36 set13/37 set13/38 set13/39 set13/4 set13/40 set13/41 set13/42 set13/43 set13/44 set13/45 set13/46 set13/47 set13/48 set13/49 set13/5 set13/50 set13/51 set13/52 set13/53 set13/54 set13/55 set13/56 set13/57 set13/58 set13/59 set13/6 set13/60 set13/61 set13/62 set13/63 set13/64 set13/65 set13/66 set13/67 set13/68 set13/69 set13/7 set13/70 set13/71 set13/72 set13/73 set13/74 set13/75 set13/76 set13/77 set13/78 set13/79 set13/8 set13/80 set13/81 set13/82 set13/83 set13/84 set13/85 set13/86 set13/87 set13/88 set13/89 set13/9 set13/90 set13/91 set13/92 set13/93 set13/94 set13/95 set13/96 set13/97 set13/98 set13/99)  (node: http://192.168.56.25:3900 )
+```
+
+After inspecting, the actual S3 call made was with prefix "set13/", so at least this is not an error in Garage itself but in the jepsen code.
+
+Finally found out that this was due to closures not correctly capturing their context in the list function in s3api.clj (wtf clojure?)
+Not sure exactly where it came from but it seems to have been fixed by making list-inner a separate function and not a sub-function,
+and passing all values that were previously in the context (creds and prefix) as additional arguments.
+
+### `reg2` test inconsistency, even with timestamp fix
+
+The reg2 test is our custom checker for CRDT read-after-write on individual object keys, acting as registers which can be updated.
+The test fails without the timestamp fix, which is expected as the clock scrambler will prevent nodes from having a correct ordering of objects.
+
+With the timestamp fix (`--patch tsfix1`), the happenned-before relationship should at least be respected, meaning that when a PutObject call starts
+after another PutObject call has ended, the second call should overwrite the value of the first call, and that value should not be
+readable by future GetObject calls.
+However, we observed inconsistencies even with the timestamp fix.
+
+The inconsistencies seemed to always happenned after writing a nil value, which translates to a DeleteObject call
+instead of a PutObject. By removing the possibility of writing nil values, therefore only doing
+PutObject calls, the issue disappears. There is therefore an issue to fix in DeleteObject.
+
+The issue in DeleteObject seems to have been fixed by commit `c82d91c6bccf307186332b6c5c6fc0b128b1b2b1`, which can be used using `--patch tsfix2`.
+
+
+## License
+
+Copyright © 2023 Alex Auvolat
+
+This program and the accompanying materials are made available under the
+terms of the GNU Affero General Public License v3.0.
@@ -0,0 +1,40 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+#
+
+def vm(config, hostname, ip)
+  config.vm.hostname = hostname
+  config.vm.network "private_network", ip: ip
+end
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "generic/debian10"
+
+  config.vm.provider "virtualbox" do |vb|
+    vb.gui = false
+    vb.memory = "512"
+    vb.customize ["modifyvm", :id, "--vram=12"]
+  end
+
+  config.vm.provision "shell", inline: <<-SHELL
+    echo "root:root" | chpasswd
+    mkdir -p /root/.ssh
+    echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy" >> /root/.ssh/authorized_keys
+  SHELL
+
+  config.vm.define "n1" do |config| vm(config, "n1", "192.168.56.21") end
+  config.vm.define "n2" do |config| vm(config, "n2", "192.168.56.22") end
+  config.vm.define "n3" do |config| vm(config, "n3", "192.168.56.23") end
+  config.vm.define "n4" do |config| vm(config, "n4", "192.168.56.24") end
+  config.vm.define "n5" do |config| vm(config, "n5", "192.168.56.25") end
+  config.vm.define "n6" do |config| vm(config, "n6", "192.168.56.26") end
+  config.vm.define "n7" do |config| vm(config, "n7", "192.168.56.27") end
+
+  config.vm.define "n8" do |config| vm(config, "n8", "192.168.56.28") end
+  config.vm.define "n9" do |config| vm(config, "n9", "192.168.56.29") end
+  config.vm.define "n10" do |config| vm(config, "n10", "192.168.56.30") end
+  config.vm.define "n11" do |config| vm(config, "n11", "192.168.56.31") end
+  config.vm.define "n12" do |config| vm(config, "n12", "192.168.56.32") end
+  config.vm.define "n13" do |config| vm(config, "n13", "192.168.56.33") end
+  config.vm.define "n14" do |config| vm(config, "n14", "192.168.56.34") end
+end
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -x
+
+#for ppatch in task3c task3a tsfix2; do
+for ppatch in tsfix2; do
+	#for psc in c cp cdp r pr cpr dpr; do
+	for psc in cdp r pr cpr dpr; do
+		#for ptsk in reg2 set1 set2; do
+		for ptsk in set1; do
+			for irun in $(seq 10); do
+				lein run test --nodes-file nodes.vagrant \
+					--time-limit 60 --rate 100  --concurrency 100 --ops-per-key 100 \
+					--workload $ptsk --patch $ppatch --scenario $psc
+			done
+		done
+	done
+done
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -x
+
+#for ppatch in task3c tsfix2; do
+for ppatch in tsfix2; do
+	for psc in cdp r pr cpr dpr; do
+		for ptsk in set1; do
+			for irun in $(seq 10); do
+				lein run test --nodes-file nodes2.vagrant \
+					--time-limit 60 --rate 100  --concurrency 100 --ops-per-key 100 \
+					--workload $ptsk --patch $ppatch --scenario $psc
+			done
+		done
+	done
+done
@@ -0,0 +1,13 @@
+docker stop jaeger
+docker rm jaeger
+
+# UI is on localhost:16686
+# otel-grpc collector is on localhost:4317
+# otel-http collector is on localhost:4318
+
+docker run -d --name jaeger \
+  -e COLLECTOR_OTLP_ENABLED=true \
+  -p 4317:4317 \
+  -p 4318:4318 \
+  -p 16686:16686 \
+  jaegertracing/all-in-one:1.50
@@ -0,0 +1,7 @@
+192.168.56.21
+192.168.56.22
+192.168.56.23
+192.168.56.24
+192.168.56.25
+192.168.56.26
+192.168.56.27
@@ -0,0 +1,7 @@
+192.168.56.28
+192.168.56.29
+192.168.56.30
+192.168.56.31
+192.168.56.32
+192.168.56.33
+192.168.56.34
@@ -0,0 +1,10 @@
+(defproject jepsen.garage "0.1.0-SNAPSHOT"
+  :description "Jepsen testing for Garage"
+  :url "https://git.deuxfleurs.fr/Deuxfleurs/garage"
+  :license {:name "AGPLv3"
+            :url "https://www.gnu.org/licenses/agpl-3.0.en.html"}
+  :main jepsen.garage
+  :dependencies [[org.clojure/clojure "1.11.1"]
+                 [jepsen "0.3.3-SNAPSHOT"]
+                 [amazonica "0.3.163"]]
+  :repl-options {:init-ns jepsen.garage})
@@ -0,0 +1,18 @@
+{ pkgs ? import <nixpkgs> {
+  overlays = [
+    (self: super: {
+      jdk = super.jdk11;
+      jre = super.jre11;
+    })
+  ];
+} }:
+pkgs.mkShell {
+  nativeBuildInputs = with pkgs; [
+    leiningen
+    jdk
+    jna
+    vagrant
+    gnuplot
+    graphviz
+  ];
+}
@@ -0,0 +1,105 @@
+(ns jepsen.garage
+  (:require
+    [clojure.string :as str]
+    [jepsen
+     [checker :as checker]
+     [cli :as cli]
+     [generator :as gen]
+     [nemesis :as nemesis]
+     [tests :as tests]]
+    [jepsen.os.debian :as debian]
+    [jepsen.garage
+     [daemon :as grg]
+     [nemesis :as grgNemesis]
+     [reg :as reg]
+     [set :as set]]))
+
+(def workloads
+  "A map of workload names to functions that construct workloads, given opts."
+  {"reg1" reg/workload1
+   "reg2" reg/workload2
+   "set1" set/workload1
+   "set2" set/workload2})
+
+(def scenari
+  "A map of scenari to the associated nemesis"
+  {"c" grgNemesis/scenario-c
+   "cp" grgNemesis/scenario-cp
+   "r"  grgNemesis/scenario-r
+   "pr"  grgNemesis/scenario-pr
+   "cpr"  grgNemesis/scenario-cpr
+   "cdp"  grgNemesis/scenario-cdp
+   "dpr"  grgNemesis/scenario-dpr})
+
+(def patches
+  "A map of patch names to Garage builds"
+  {"default" "v0.9.0"
+   "tsfix1" "d146cdd5b66ca1d3ed65ce93ca42c6db22defc09"
+   "tsfix2" "c82d91c6bccf307186332b6c5c6fc0b128b1b2b1"
+   "task3a" "707442f5de416fdbed4681a33b739f0a787b7834"
+   "task3b" "431b28e0cfdc9cac6c649193cf602108a8b02997"
+   "task3c" "0041b013a473e3ae72f50209d8f79db75a72848b"})
+
+(def cli-opts
+  "Additional command line options."
+  [["-p" "--patch NAME" "Garage patch to use"
+    :default "default"
+    :validate [patches (cli/one-of patches)]]
+   ["-s" "--scenario NAME" "Nemesis scenario to run"
+    :default "cp"
+    :validate [scenari (cli/one-of scenari)]]
+   ["-r" "--rate HZ" "Approximate number of requests per second, per thread."
+    :default  10
+    :parse-fn read-string
+    :validate [#(and (number? %) (pos? %)) "Must be a positive number"]]
+   [nil "--ops-per-key NUM" "Maximum number of operations on any given key."
+    :default  100
+    :parse-fn parse-long
+    :validate [pos? "Must be a positive integer."]]
+   ["-w" "--workload NAME" "Workload of test to run"
+    :default "reg1"
+    :validate [workloads (cli/one-of workloads)]]])
+
+(defn garage-test
+  "Given an options map from the command line runner (e.g. :nodes, :ssh,
+  :concurrency, ...), constructs a test map."
+  [opts]
+  (let [garage-version (get patches (:patch opts))
+        db (grg/db garage-version)
+        workload ((get workloads (:workload opts)) opts)
+        scenario ((get scenari (:scenario opts)) (assoc opts :db db))]
+    (merge tests/noop-test
+           opts
+           {:pure-generators  true
+            :name             (str "garage-" (name (:patch opts)) " " (name (:workload opts)) " " (name (:scenario opts)))
+            :os               debian/os
+            :db               db
+            :client           (:client workload)
+            :generator        (gen/phases
+                                (->>
+                                  (:generator workload)
+                                  (gen/stagger (/ (:rate opts)))
+                                  (gen/nemesis (:generator scenario))
+                                  (gen/time-limit (:time-limit opts)))
+                                (gen/log "Healing cluster")
+                                (gen/nemesis (:final-generator scenario))
+                                (gen/log "Waiting for recovery")
+                                (gen/sleep 10)
+                                (gen/log "Running final generator")
+                                (gen/clients (:final-generator workload))
+                                (gen/log "Generators all done"))
+            :nemesis          (:nemesis scenario)
+            :checker          (checker/compose
+                                {:perf (checker/perf (:perf scenario))
+                                 :workload (:checker workload)})
+            })))
+
+
+(defn -main
+  "Handles command line arguments. Can either run a test, or a web server for
+  browsing results."
+  [& args]
+  (cli/run! (merge (cli/single-test-cmd {:test-fn garage-test
+                                         :opt-spec cli-opts})
+                   (cli/serve-cmd))
+            args))
@@ -0,0 +1,152 @@
+(ns jepsen.garage.daemon
+  (:require [clojure.tools.logging :refer :all]
+            [jepsen [control :as c]
+             [core :as jepsen]
+             [db :as db]]
+            [jepsen.control.util :as cu]))
+
+; CONSTANTS -- HOW GARAGE IS SET UP
+
+(def base-dir "/opt/garage")
+(def data-dir (str base-dir "/data"))
+(def meta-dir (str base-dir "/meta"))
+(def binary (str base-dir "/garage"))
+(def logfile (str base-dir "/garage.log"))
+(def pidfile (str base-dir "/garage.pid"))
+
+(def admin-token "icanhazadmin")
+(def access-key-id "GK8bfb6a51286071c6c9cd8bc3")
+(def secret-access-key "b0be95f71c1c6f16858a9edf395078b75c12ecb6b1c03385c4ae92076e4994a3")
+(def bucket-name "jepsen")
+
+; THE GARAGE DB
+
+(defn install!
+  "Download and install Garage"
+  [node version]
+  (c/su
+    (c/trace
+      (info node "installing garage" version)
+      (c/exec :mkdir :-p base-dir)
+      (let [url (str "https://garagehq.deuxfleurs.fr/_releases/" version "/x86_64-unknown-linux-musl/garage")
+            cache (cu/cached-wget! url)]
+        (c/exec :cp cache binary))
+      (c/exec :chmod :+x binary))))
+
+(defn configure!
+  "Configure Garage"
+  [node]
+  (c/su
+    (c/trace
+      (cu/write-file!
+        (str "rpc_secret = \"0fffabe52542c2b89a56b2efb7dfd477e9dafb285c9025cbdf1de7ca21a6b372\"\n"
+             "rpc_bind_addr = \"0.0.0.0:3901\"\n"
+             "rpc_public_addr = \"" node ":3901\"\n"
+             "db_engine = \"lmdb\"\n"
+             "replication_mode = \"2\"\n"
+             "data_dir = \"" data-dir "\"\n"
+             "metadata_dir = \"" meta-dir "\"\n"
+             "[s3_api]\n"
+             "s3_region = \"us-east-1\"\n"
+             "api_bind_addr = \"0.0.0.0:3900\"\n"
+             "[k2v_api]\n"
+             "api_bind_addr = \"0.0.0.0:3902\"\n"
+             "[admin]\n"
+             "api_bind_addr = \"0.0.0.0:3903\"\n"
+             "admin_token = \"" admin-token "\"\n"
+             "trace_sink = \"http://192.168.56.1:4317\"\n")
+        "/etc/garage.toml"))))
+
+(defn connect-node!
+  "Connect a Garage node to the rest of the cluster"
+  [test node]
+  (c/trace
+    (let [node-id (c/exec binary :node :id :-q)]
+      (info node "node id:" node-id)
+      (c/on-many (:nodes test)
+                 (c/exec binary :node :connect node-id)))))
+
+(defn configure-node!
+  "Configure a Garage node to be part of a cluster layout"
+  [test node]
+  (c/trace
+    (let [node-id (c/exec binary :node :id :-q)]
+      (c/on (jepsen/primary test)
+          (c/exec binary :layout :assign (subs node-id 0 16) :-c :1G :-z :dc1 :-t node)))))
+
+(defn finalize-config!
+  "Apply the layout and create a key/bucket pair in the cluster"
+  [node]
+  (c/trace
+    (c/exec binary :layout :apply :--version 1)
+    (info node "garage status:" (c/exec binary :status))
+    (c/exec binary :key :import access-key-id secret-access-key :--yes)
+    (c/exec binary :bucket :create bucket-name)
+    (c/exec binary :bucket :allow :--read :--write bucket-name :--key access-key-id)
+    (info node "key info: " (c/exec binary :key :info access-key-id))))
+
+(defn db
+  "Garage DB for a particular version"
+  [version]
+  (reify db/DB
+    (setup! [_ test node]
+      (install! node version)
+      (configure! node)
+      (cu/start-daemon!
+        {:logfile logfile
+         :pidfile pidfile
+         :chdir base-dir
+         :env {:RUST_LOG "garage=debug,garage_api=trace"}}
+        binary
+        :server)
+      (c/exec :sleep 3)
+
+      (jepsen/synchronize test)
+      (connect-node! test node)
+
+      (jepsen/synchronize test)
+      (configure-node! test node)
+
+      (jepsen/synchronize test)
+      (when (= node (jepsen/primary test))
+        (finalize-config! node)))
+
+    (teardown! [_ test node]
+      (info node "tearing down garage" version)
+      (c/su
+        (cu/stop-daemon! binary pidfile)
+        (c/exec :rm :-rf logfile)
+        (c/exec :rm :-rf data-dir)
+        (c/exec :rm :-rf meta-dir)))
+
+    db/Pause
+    (pause! [_ test node]
+      (cu/grepkill! :stop binary))
+    (resume! [_ test node]
+      (cu/grepkill! :cont binary))
+
+    db/Kill
+    (kill! [_ test node]
+      (cu/stop-daemon! binary pidfile))
+    (start! [_ test node]
+      (cu/start-daemon!
+        {:logfile logfile
+         :pidfile pidfile
+         :chdir base-dir
+         :env {:RUST_LOG "garage=debug,garage_api=trace"}}
+        binary
+        :server))
+
+    db/LogFiles
+    (log-files [_ test node]
+      [logfile])))
+
+(defn creds
+  "Obtain Garage credentials for node"
+  [node]
+  {:access-key access-key-id
+   :secret-key secret-access-key
+   :endpoint (str "http://" node ":3900")
+   :bucket bucket-name
+   :client-config {:path-style-access-enabled true}})
+
@@ -0,0 +1,142 @@
+(ns jepsen.garage.nemesis
+  (:require [clojure.tools.logging :refer :all]
+            [jepsen [control :as c]
+             [core :as jepsen]
+             [generator :as gen]
+             [nemesis :as nemesis]]
+            [jepsen.nemesis.combined :as combined]
+            [jepsen.garage.daemon :as grg]
+            [jepsen.control.util :as cu]))
+
+; ---- reconfiguration nemesis ----
+
+(defn configure-present!
+  "Configure node to be active in new cluster layout"
+  [test nodes]
+  (info "configure-present!" nodes)
+  (let [node-ids (c/on-many nodes (c/exec grg/binary :node :id :-q))
+        node-id-strs (map (fn [[_ v]] (subs v  0 16)) node-ids)]
+    (c/on
+      (jepsen/primary test)
+      (apply c/exec (concat [grg/binary :layout :assign :-c :1G] node-id-strs)))))
+
+(defn configure-absent!
+  "Configure nodes to be active in new cluster layout"
+  [test nodes]
+  (info "configure-absent!" nodes)
+  (let [node-ids (c/on-many nodes (c/exec grg/binary :node :id :-q))
+        node-id-strs (map (fn [[_ v]] (subs v  0 16)) node-ids)]
+    (c/on
+      (jepsen/primary test)
+      (apply c/exec (concat [grg/binary :layout :assign :-g] node-id-strs)))))
+
+(defn finalize-config!
+  "Apply the proposed cluster layout"
+  [test]
+  (let [layout-show (c/on (jepsen/primary test) (c/exec grg/binary :layout :show))
+        [_ layout-next-version] (re-find #"apply --version (\d+)\n" layout-show)]
+    (if layout-next-version
+      (do
+        (info "layout show: " layout-show "; next-version: " layout-next-version)
+        (c/on (jepsen/primary test)
+              (c/exec grg/binary :layout :apply :--version layout-next-version)))
+      (info "no layout changes to apply"))))
+
+(defn reconfigure-subset
+  "Reconfigure cluster with only a subset of nodes"
+  [cnt]
+  (reify nemesis/Nemesis
+    (setup! [this test] this)
+
+    (invoke! [this test op] op
+      (case (:f op)
+        :start
+          (let [[keep-nodes remove-nodes]
+                (->> (:nodes test)
+                     shuffle
+                     (split-at cnt))]
+            (info "layout split: keep " keep-nodes ", remove " remove-nodes)
+            (configure-present! test keep-nodes)
+            (configure-absent! test remove-nodes)
+            (finalize-config! test)
+            (assoc op :value keep-nodes))
+        :stop
+          (do
+            (info "layout un-split: all nodes=" (:nodes test))
+            (configure-present! test (:nodes test))
+            (finalize-config! test)
+            (assoc op :value (:nodes test)))))
+
+    (teardown! [this test] this)))
+
+; ---- nemesis scenari ----
+
+(defn nemesis-op
+  "A generator for a single nemesis operation"
+  [op]
+  (fn [_ _] {:type :info, :f op}))
+
+(defn reconfiguration-package
+  "Cluster reconfiguration nemesis package"
+  [opts]
+  {:generator        (->>
+                       (gen/mix [(nemesis-op :reconfigure-start)
+                                 (nemesis-op :reconfigure-stop)])
+                       (gen/stagger (:interval opts 5)))
+   :final-generator  {:type :info, :f :reconfigure-stop}
+   :nemesis          (nemesis/compose
+                       {{:reconfigure-start :start
+                         :reconfigure-stop :stop} (reconfigure-subset 3)})
+   :perf              #{{:name  "reconfigure"
+                         :start #{:reconfigure-start}
+                         :stop  #{:reconfigur-stop}
+                         :color "#A197E9"}}})
+
+(defn scenario-c
+  "Clock modifying scenario"
+  [opts]
+  (combined/clock-package {:db (:db opts), :interval 1, :faults #{:clock}}))
+
+(defn scenario-cp
+  "Clock modifying + partition scenario"
+  [opts]
+  (combined/compose-packages
+    [(combined/clock-package {:db (:db opts), :interval 1, :faults #{:clock}})
+     (combined/partition-package {:db (:db opts), :interval 1, :faults #{:partition}})]))
+
+(defn scenario-r
+  "Cluster reconfiguration scenario"
+  [opts]
+  (reconfiguration-package {:interval 1}))
+
+(defn scenario-pr
+  "Partition + cluster reconfiguration scenario"
+  [opts]
+  (combined/compose-packages
+    [(combined/partition-package {:db (:db opts), :interval 1, :faults #{:partition}})
+     (reconfiguration-package {:interval 1})]))
+
+(defn scenario-cpr
+  "Clock scramble + partition + cluster reconfiguration scenario"
+  [opts]
+  (combined/compose-packages
+    [(combined/clock-package {:db (:db opts), :interval 1, :faults #{:clock}})
+     (combined/partition-package {:db (:db opts), :interval 1, :faults #{:partition}})
+     (reconfiguration-package {:interval 1})]))
+
+(defn scenario-cdp
+  "Clock modifying + db + partition scenario"
+  [opts]
+  (combined/compose-packages
+    [(combined/clock-package {:db (:db opts), :interval 1, :faults #{:clock}})
+     (combined/db-package {:db (:db opts), :interval 1, :faults #{:db :pause :kill}})
+     (combined/partition-package {:db (:db opts), :interval 1, :faults #{:partition}})]))
+
+(defn scenario-dpr
+  "Db + partition + cluster reconfiguration scenario"
+  [opts]
+  (combined/compose-packages
+    [(combined/db-package {:db (:db opts), :interval 1, :faults #{:db :pause :kill}})
+     (combined/partition-package {:db (:db opts), :interval 1, :faults #{:partition}})
+     (reconfiguration-package {:interval 1})]))
+
@@ -0,0 +1,143 @@
+(ns jepsen.garage.reg
+  (:require [clojure.tools.logging :refer :all]
+            [clojure.string :as str]
+            [clojure.set :as set]
+            [jepsen [checker :as checker]
+             [cli :as cli]
+             [client :as client]
+             [control :as c]
+             [db :as db]
+             [generator :as gen]
+             [independent :as independent]
+             [nemesis :as nemesis]
+             [util :as util]
+             [tests :as tests]]
+            [jepsen.checker.timeline :as timeline]
+            [jepsen.control.util :as cu]
+            [jepsen.os.debian :as debian]
+            [jepsen.garage.daemon :as grg]
+            [jepsen.garage.s3api :as s3]
+            [knossos.model :as model]
+            [slingshot.slingshot :refer [try+]]))
+
+(defn op-get [_ _] {:type :invoke, :f :read, :value nil})
+(defn op-put [_ _] {:type :invoke, :f :write, :value (str (rand-int 99))})
+(defn op-del [_ _] {:type :invoke, :f :write, :value nil})
+
+(defrecord RegClient [creds]
+  client/Client
+  (open! [this test node]
+    (assoc this :creds (grg/creds node)))
+  (setup! [this test])
+  (invoke! [this test op]
+    (try+
+      (let [[k v] (:value op)]
+        (case (:f op)
+          :read
+            (util/timeout
+              10000
+              (assoc op :type :fail, :error ::timeout)
+              (let [value (s3/get (:creds this) k)]
+                (assoc op :type :ok, :value (independent/tuple k value))))
+          :write
+            (util/timeout
+              10000
+              (assoc op :type :info, :error ::timeout)
+              (do
+                (s3/put (:creds this) k v)
+                (assoc op :type :ok)))))
+      (catch (re-find #"Unavailable" (.getMessage %)) ex
+        (assoc op :type :info, :error ::unavailable))
+      (catch (re-find #"Broken pipe" (.getMessage %)) ex
+        (assoc op :type :info, :error ::broken-pipe))
+      (catch (re-find #"Connection refused" (.getMessage %)) ex
+        (assoc op :type :info, :error ::connection-refused))))
+  (teardown! [this test])
+  (close! [this test]))
+
+(defn reg-read-after-write
+  "Read-after-Write checker for register operations"
+  []
+  (reify checker/Checker
+    (check [this test history opts]
+      (let [init {:put-values {-1 nil}
+                  :put-done #{-1}
+                  :put-in-progress {}
+                  :read-can-contain {}
+                  :bad-reads #{}}
+            final (reduce
+                    (fn [state op]
+                      (let [current-values (set/union
+                                             (set (map (fn [idx] (get (:put-values state) idx)) (:put-done state)))
+                                             (set (map (fn [[_ [idx _]]] (get (:put-values state) idx)) (:put-in-progress state))))
+                            read-can-contain (reduce
+                                               (fn [rcc [idx v]] (assoc rcc idx (set/union current-values v)))
+                                               {} (:read-can-contain state))]
+                      (info "--------")
+                      (info "state: " state)
+                      (info "current-values: " current-values)
+                      (info "read-can-contain: " read-can-contain)
+                      (info "op: " op)
+                      (case [(:type op) (:f op)]
+                        ([:invoke :write])
+                          (assoc state
+                                 :read-can-contain read-can-contain
+                                 :put-values (assoc (:put-values state) (:index op) (:value op))
+                                 :put-in-progress (assoc (:put-in-progress state) (:process op) [(:index op) (:put-done state)]))
+                        ([:ok :write])
+                          (let [[index overwrites] (get (:put-in-progress state) (:process op))]
+                            (assoc state
+                                   :read-can-contain read-can-contain
+                                   :put-in-progress (dissoc (:put-in-progress state) (:process op))
+                                   :put-done
+                                     (conj
+                                       (set/difference (:put-done state) overwrites)
+                                       index)))
+                        ([:invoke :read])
+                         (assoc state
+                                :read-can-contain (assoc read-can-contain (:process op) current-values))
+                        ([:ok :read])
+                         (let [this-read-can-contain (get read-can-contain (:process op))
+                               bad-reads (if (contains? this-read-can-contain (:value op))
+                                           (:bad-reads state)
+                                           (conj (:bad-reads state) [(:process op) (:index op) (:value op) this-read-can-contain]))]
+                           (info "this-read-can-contain: " this-read-can-contain)
+                           (assoc state
+                                  :read-can-contain (dissoc read-can-contain (:process op))
+                                  :bad-reads bad-reads))
+                        state)))
+                    init history)
+            valid? (empty? (:bad-reads final))]
+        (assoc final :valid? valid?)))))
+
+(defn workload-common
+  "Common parts of workload"
+  [opts]
+  {:client           (RegClient. nil)
+   :generator        (independent/concurrent-generator
+                       10
+                       (range)
+                       (fn [k]
+                         (->>
+                           (gen/mix [op-get op-put op-del])
+                           (gen/limit (:ops-per-key opts)))))})
+
+(defn workload1
+  "Tests linearizable reads and writes"
+  [opts]
+  (assoc (workload-common opts)
+         :checker (independent/checker
+                    (checker/compose
+                      {:linear (checker/linearizable
+                                 {:model     (model/register)
+                                  :algorithm :linear})
+                       :timeline (timeline/html)}))))
+
+(defn workload2
+  "Tests CRDT reads and writes"
+  [opts]
+  (assoc (workload-common opts)
+         :checker (independent/checker
+                    (checker/compose
+                      {:reg-read-after-write (reg-read-after-write)
+                       :timeline (timeline/html)}))))
@@ -0,0 +1,48 @@
+(ns jepsen.garage.s3api
+  (:require [clojure.tools.logging :refer :all]
+            [jepsen [control :as c]]
+            [amazonica.aws.s3 :as s3]
+            [slingshot.slingshot :refer [try+]]))
+
+; GARAGE S3 HELPER FUNCTIONS
+
+(defn get
+  "Helper for GetObject"
+  [creds k]
+  (try+
+    (-> (s3/get-object creds (:bucket creds) k)
+        :input-stream
+        slurp)
+    (catch (re-find #"Key not found" (.getMessage %)) ex
+      nil)))
+
+(defn put
+  "Helper for PutObject or DeleteObject (is a delete if value is nil)"
+  [creds k v]
+  (if (= v nil)
+    (s3/delete-object creds
+                      :bucket-name (:bucket creds)
+                      :key k)
+    (let [some-bytes (.getBytes v "UTF-8")
+          bytes-stream (java.io.ByteArrayInputStream. some-bytes)]
+      (s3/put-object creds
+                     :bucket-name (:bucket creds)
+                     :key k
+                     :input-stream bytes-stream
+                     :metadata {:content-length (count some-bytes)}))))
+
+(defn list-inner [creds prefix ct accum]
+  (let [list-result (s3/list-objects-v2 creds
+                                        {:bucket-name (:bucket creds)
+                                         :prefix prefix
+                                         :continuation-token ct})
+        new-object-summaries (:object-summaries list-result)
+        new-objects (map (fn [d] (:key d)) new-object-summaries)
+        objects (concat new-objects accum)]
+    (if (:truncated? list-result)
+      (list-inner creds prefix (:next-continuation-token list-result) objects)
+      objects)))
+(defn list
+  "Helper for ListObjects -- just lists everything in the bucket"
+  [creds prefix]
+  (list-inner creds prefix nil []))
@@ -0,0 +1,135 @@
+(ns jepsen.garage.set
+  (:require [clojure.tools.logging :refer :all]
+            [clojure.string :as str]
+            [clojure.set :as set]
+            [jepsen [checker :as checker]
+             [cli :as cli]
+             [client :as client]
+             [control :as c]
+             [checker :as checker]
+             [db :as db]
+             [generator :as gen]
+             [independent :as independent]
+             [nemesis :as nemesis]
+             [util :as util]
+             [tests :as tests]]
+            [jepsen.checker.timeline :as timeline]
+            [jepsen.control.util :as cu]
+            [jepsen.os.debian :as debian]
+            [jepsen.garage.daemon :as grg]
+            [jepsen.garage.s3api :as s3]
+            [knossos.model :as model]
+            [slingshot.slingshot :refer [try+]]))
+
+(defn op-add-rand100 [_ _] {:type :invoke, :f :add, :value (rand-int 100)})
+(defn op-read [_ _] {:type :invoke, :f :read, :value nil})
+
+(defrecord SetClient [creds]
+  client/Client
+  (open! [this test node]
+    (assoc this :creds (grg/creds node)))
+  (setup! [this test])
+  (invoke! [this test op]
+    (try+
+      (let [[k v] (:value op)
+            prefix (str "set" k "/")]
+        (case (:f op)
+          :add
+            (util/timeout
+              10000
+              (assoc op :type :info, :error ::timeout)
+              (do
+                (s3/put (:creds this) (str prefix v) "present")
+                (assoc op :type :ok)))
+          :read
+            (util/timeout
+              10000
+              (assoc op :type :fail, :error ::timeout)
+              (do
+                (let [items (s3/list (:creds this) prefix)]
+                  (let [items-stripped (map (fn [o]
+                                            (assert (str/starts-with? o prefix))
+                                            (str/replace-first o prefix "")) items)
+                        items-set (set (map parse-long items-stripped))]
+                    (assoc op :type :ok, :value (independent/tuple k items-set))))))))
+      (catch (re-find #"Unavailable" (.getMessage %)) ex
+        (assoc op :type :info, :error ::unavailable))
+      (catch (re-find #"Broken pipe" (.getMessage %)) ex
+        (assoc op :type :info, :error ::broken-pipe))
+      (catch (re-find #"Connection refused" (.getMessage %)) ex
+        (assoc op :type :info, :error ::connection-refused))))
+  (teardown! [this test])
+  (close! [this test]))
+
+(defn set-read-after-write
+  "Read-after-Write checker for set operations"
+  []
+  (reify checker/Checker
+    (check [this test history opts]
+      (let [init {:add-started #{}
+                  :add-done #{}
+                  :read-must-contain {}
+                  :missed #{}
+                  :unexpected #{}}
+            final (reduce
+                    (fn [state op]
+                      (case [(:type op) (:f op)]
+                        ([:invoke :add])
+                          (assoc state :add-started (conj (:add-started state) (:value op)))
+                        ([:ok :add])
+                          (assoc state :add-done (conj (:add-done state) (:value op)))
+                        ([:invoke :read])
+                          (assoc-in state [:read-must-contain (:process op)] (:add-done state))
+                        ([:ok :read])
+                          (let [read-must-contain (get (:read-must-contain state) (:process op))
+                                new-missed (set/difference read-must-contain (:value op))
+                                new-unexpected (set/difference (:value op) (:add-started state))]
+                            (assoc state
+                                   :read-must-contain (dissoc (:read-must-contain state) (:process op))
+                                   :missed (set/union (:missed state) new-missed),
+                                   :unexpected (set/union (:unexpected state) new-unexpected)))
+                         state))
+                    init history)
+            valid? (and (empty? (:missed final)) (empty? (:unexpected final)))]
+        (assoc final :valid? valid?)))))
+
+(defn workload1
+  "Tests insertions and deletions"
+  [opts]
+  {:client            (SetClient. nil)
+   :checker           (independent/checker
+                        (checker/compose
+                          {:set (checker/set)
+                           :timeline (timeline/html)}))
+   :generator         (independent/concurrent-generator
+                        10
+                        (range 100)
+                        (fn [k]
+                          (->> (range)
+                           (map (fn [x] {:type :invoke, :f :add, :value x}))
+                           (gen/limit (:ops-per-key opts)))))
+   :final-generator   (independent/concurrent-generator
+                        10
+                        (range 100)
+                        (fn [k]
+                          (gen/phases
+                            (gen/once op-read)
+                            (gen/sleep 5))))})
+
+(defn workload2
+  "Tests insertions and deletions"
+  [opts]
+  {:client            (SetClient. nil)
+   :checker           (independent/checker
+                        (checker/compose
+                          {:set-read-after-write (set-read-after-write)
+                           ; :set-full (checker/set-full {:linearizable? false})
+                           :timeline (timeline/html)}))
+   :generator         (independent/concurrent-generator
+                        10
+                        (range)
+                        (fn [k]
+                          (->> (gen/mix [op-add-rand100 op-read])
+                               (gen/limit (:ops-per-key opts)))))})
+
+
@@ -0,0 +1,7 @@
+(ns jepsen.garage-test
+  (:require [clojure.test :refer :all]
+            [jepsen.garage :refer :all]))
+
+(deftest a-test
+  (testing "FIXME, I fail."
+    (is (= 0 1))))
@@ -15,16 +15,18 @@ in {
  # --- Rust Shell ---
  # Use it to compile Garage
  rust = pkgs.mkShell {
-    nativeBuildInputs = [
-      #pkgs.rustPlatform.rust.rustc
-      pkgs.rustPlatform.rust.cargo
-      #pkgs.clippy
-      pkgs.rustfmt
-      #pkgs.perl
-      #pkgs.protobuf
-      #pkgs.pkg-config
-      #pkgs.openssl
-      pkgs.file
+    nativeBuildInputs = with pkgs; [
+      #rustPlatform.rust.rustc
+      rustPlatform.rust.cargo
+      clang
+      mold
+      #clippy
+      rustfmt
+      #perl
+      #protobuf
+      #pkg-config
+      #openssl
+      file
      #cargo2nix.packages.x86_64-linux.cargo2nix
    ];
  };
@@ -1,6 +1,6 @@
 [package]
 name = "garage_api"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -182,7 +182,7 @@ impl AdminApiServer {
 			),
 		};
 		let status_str = format!(
-			"{}\nConsult the full health check API endpoint at /v0/health for more details\n",
+			"{}\nConsult the full health check API endpoint at /v1/health for more details\n",
 			status_str
 		);

@@ -344,7 +344,7 @@ impl ApiHandler for S3ApiServer {
 						bucket_id,
 						key,
 						upload_id,
-						part_number_marker: part_number_marker.map(|p| p.clamp(1, 10000)),
+						part_number_marker: part_number_marker.map(|p| p.min(10000)),
 						max_parts: max_parts.unwrap_or(1000).clamp(1, 1000),
 					},
 				)
@@ -3,12 +3,12 @@ use std::sync::Arc;
 use hyper::{Body, Request, Response, StatusCode};

 use garage_util::data::*;
-use garage_util::time::*;

 use garage_model::garage::Garage;
 use garage_model::s3::object_table::*;

 use crate::s3::error::*;
+use crate::s3::put::next_timestamp;
 use crate::s3::xml as s3_xml;
 use crate::signature::verify_signed_content;

@@ -23,40 +23,36 @@ async fn handle_delete_internal(
 		.await?
 		.ok_or(Error::NoSuchKey)?; // No need to delete

-	let interesting_versions = object.versions().iter().filter(|v| {
-		!matches!(
-			v.state,
-			ObjectVersionState::Aborted
-				| ObjectVersionState::Complete(ObjectVersionData::DeleteMarker)
-		)
-	});
+	let del_timestamp = next_timestamp(Some(&object));
+	let del_uuid = gen_uuid();

-	let mut version_to_delete = None;
-	let mut timestamp = now_msec();
-	for v in interesting_versions {
-		if v.timestamp + 1 > timestamp || version_to_delete.is_none() {
-			version_to_delete = Some(v.uuid);
+	let deleted_version = object
+		.versions()
+		.iter()
+		.rev()
+		.find(|v| !matches!(&v.state, ObjectVersionState::Aborted))
+		.or_else(|| object.versions().iter().rev().next());
+	let deleted_version = match deleted_version {
+		Some(dv) => dv.uuid,
+		None => {
+			warn!("Object has no versions: {:?}", object);
+			Uuid::from([0u8; 32])
 		}
-		timestamp = std::cmp::max(timestamp, v.timestamp + 1);
-	}
-
-	let deleted_version = version_to_delete.ok_or(Error::NoSuchKey)?;
-
-	let version_uuid = gen_uuid();
+	};

 	let object = Object::new(
 		bucket_id,
 		key.into(),
 		vec![ObjectVersion {
-			uuid: version_uuid,
-			timestamp,
+			uuid: del_uuid,
+			timestamp: del_timestamp,
 			state: ObjectVersionState::Complete(ObjectVersionData::DeleteMarker),
 		}],
 	);

 	garage.object_table.insert(&object).await?;

-	Ok((deleted_version, version_uuid))
+	Ok((deleted_version, del_uuid))
 }

 pub async fn handle_delete(
@@ -426,8 +426,10 @@ where
 		// Drop the first key if needed
 		// Only AfterKey requires it according to the S3 spec and our implem.
 		match (&cursor, iter.peek()) {
-			(RangeBegin::AfterKey { key }, Some(object)) if &object.key == key => iter.next(),
-			(_, _) => None,
+			(RangeBegin::AfterKey { key }, Some(object)) if &object.key == key => {
+				iter.next();
+			}
+			_ => (),
 		};

 		while let Some(object) = iter.peek() {
@@ -436,16 +438,22 @@ where
 				return Ok(None);
 			}

-			cursor = match acc.extract(query, &cursor, &mut iter) {
-				ExtractionResult::Extracted { key } => RangeBegin::AfterKey { key },
+			match acc.extract(query, &cursor, &mut iter) {
+				ExtractionResult::Extracted { key } => {
+					cursor = RangeBegin::AfterKey { key };
+				}
 				ExtractionResult::SkipTo { key, fallback_key } => {
-					RangeBegin::IncludingKey { key, fallback_key }
+					cursor = RangeBegin::IncludingKey { key, fallback_key };
 				}
 				ExtractionResult::FilledAtUpload { key, upload } => {
-					return Ok(Some(RangeBegin::AfterUpload { key, upload }))
+					return Ok(Some(RangeBegin::AfterUpload { key, upload }));
+				}
+				ExtractionResult::Filled => {
+					return Ok(Some(cursor));
+				}
+				ExtractionResult::NoMore => {
+					return Ok(None);
 				}
-				ExtractionResult::Filled => return Ok(Some(cursor)),
-				ExtractionResult::NoMore => return Ok(None),
 			};
 		}

@@ -519,8 +527,8 @@ fn fetch_part_info<'a>(
 /// This key can be the prefix in the base case, or intermediate
 /// points in the dataset if we are continuing a previous listing.
 impl ListObjectsQuery {
-	fn build_accumulator(&self) -> Accumulator<String, ObjectInfo> {
-		Accumulator::<String, ObjectInfo>::new(self.common.page_size)
+	fn build_accumulator(&self) -> ObjectAccumulator {
+		ObjectAccumulator::new(self.common.page_size)
 	}

 	fn begin(&self) -> Result<RangeBegin, Error> {
@@ -529,9 +537,10 @@ impl ListObjectsQuery {
 				// In V2 mode, the continuation token is defined as an opaque
 				// string in the spec, so we can do whatever we want with it.
 				// In our case, it is defined as either [ or ] (for include
+				// or exclude), followed by a base64-encoded string
 				// representing the key to start with.
-				(Some(token), _) => match &token[..1] {
-					"[" => Ok(RangeBegin::IncludingKey {
+				(Some(token), _) => match &token.get(..1) {
+					Some("[") => Ok(RangeBegin::IncludingKey {
 						key: String::from_utf8(
 							BASE64_STANDARD
 								.decode(token[1..].as_bytes())
@@ -539,7 +548,7 @@ impl ListObjectsQuery {
 						)?,
 						fallback_key: None,
 					}),
-					"]" => Ok(RangeBegin::AfterKey {
+					Some("]") => Ok(RangeBegin::AfterKey {
 						key: String::from_utf8(
 							BASE64_STANDARD
 								.decode(token[1..].as_bytes())
@@ -580,8 +589,8 @@ impl ListObjectsQuery {
 }

 impl ListMultipartUploadsQuery {
-	fn build_accumulator(&self) -> Accumulator<Uuid, UploadInfo> {
-		Accumulator::<Uuid, UploadInfo>::new(self.common.page_size)
+	fn build_accumulator(&self) -> UploadAccumulator {
+		UploadAccumulator::new(self.common.page_size)
 	}

 	fn begin(&self) -> Result<RangeBegin, Error> {
@@ -665,6 +674,7 @@ impl<K: std::cmp::Ord, V> Accumulator<K, V> {
 			Some(p) => p,
 			None => return None,
 		};
+		assert!(pfx.starts_with(&query.prefix));

 		// Try to register this prefix
 		// If not possible, we can return early
@@ -675,8 +685,11 @@ impl<K: std::cmp::Ord, V> Accumulator<K, V> {
 		// We consume the whole common prefix from the iterator
 		let mut last_pfx_key = &object.key;
 		loop {
-			last_pfx_key = match objects.peek() {
-				Some(o) if o.key.starts_with(pfx) => &o.key,
+			match objects.peek() {
+				Some(o) if o.key.starts_with(pfx) => {
+					last_pfx_key = &o.key;
+					objects.next();
+				}
 				Some(_) => {
 					return Some(ExtractionResult::Extracted {
 						key: last_pfx_key.to_owned(),
@@ -692,8 +705,6 @@ impl<K: std::cmp::Ord, V> Accumulator<K, V> {
 					}
 				}
 			};
-
-			objects.next();
 		}
 	}

@@ -708,12 +719,11 @@ impl<K: std::cmp::Ord, V> Accumulator<K, V> {
 		}

 		// Otherwise, we need to check if we can add it
-		match self.is_full() {
-			true => false,
-			false => {
-				self.common_prefixes.insert(key);
-				true
-			}
+		if self.is_full() {
+			false
+		} else {
+			self.common_prefixes.insert(key);
+			true
 		}
 	}

@@ -721,12 +731,11 @@ impl<K: std::cmp::Ord, V> Accumulator<K, V> {
 		// It is impossible to add twice a key, this is an error
 		assert!(!self.keys.contains_key(&key));

-		match self.is_full() {
-			true => false,
-			false => {
-				self.keys.insert(key, value);
-				true
-			}
+		if self.is_full() {
+			false
+		} else {
+			self.keys.insert(key, value);
+			true
 		}
 	}
 }
@@ -743,6 +752,7 @@ impl ExtractAccumulator for ObjectAccumulator {
 		}

 		let object = objects.next().expect("This iterator can not be empty as it is checked earlier in the code. This is a logic bug, please report it.");
+		assert!(object.key.starts_with(&query.prefix));

 		let version = match object.versions().iter().find(|x| x.is_data()) {
 			Some(v) => v,
@@ -9,7 +9,6 @@ use md5::{Digest as Md5Digest, Md5};
 use garage_table::*;
 use garage_util::async_hash::*;
 use garage_util::data::*;
-use garage_util::time::*;

 use garage_model::bucket_table::Bucket;
 use garage_model::garage::Garage;
@@ -30,10 +29,13 @@ pub async fn handle_create_multipart_upload(
 	req: &Request<Body>,
 	bucket_name: &str,
 	bucket_id: Uuid,
-	key: &str,
+	key: &String,
 ) -> Result<Response<Body>, Error> {
+	let existing_object = garage.object_table.get(&bucket_id, &key).await?;
+
 	let upload_id = gen_uuid();
-	let timestamp = now_msec();
+	let timestamp = next_timestamp(existing_object.as_ref());
+
 	let headers = get_headers(req.headers())?;

 	// Create object in object table
@@ -233,7 +235,8 @@ pub async fn handle_complete_multipart_upload(

 	// Get object and multipart upload
 	let key = key.to_string();
-	let (_, mut object_version, mpu) = get_upload(&garage, &bucket.id, &key, &upload_id).await?;
+	let (object, mut object_version, mpu) =
+		get_upload(&garage, &bucket.id, &key, &upload_id).await?;

 	if mpu.parts.is_empty() {
 		return Err(Error::bad_request("No data was uploaded"));
@@ -331,7 +334,7 @@ pub async fn handle_complete_multipart_upload(
 	// Calculate total size of final object
 	let total_size = parts.iter().map(|x| x.size.unwrap()).sum();

-	if let Err(e) = check_quotas(&garage, bucket, &key, total_size).await {
+	if let Err(e) = check_quotas(&garage, bucket, total_size, Some(&object)).await {
 		object_version.state = ObjectVersionState::Aborted;
 		let final_object = Object::new(bucket.id, key.clone(), vec![object_version]);
 		garage.object_table.insert(&final_object).await?;
@@ -15,6 +15,7 @@ use serde::Deserialize;

 use garage_model::garage::Garage;

+use crate::s3::cors::*;
 use crate::s3::error::*;
 use crate::s3::put::{get_headers, save_stream};
 use crate::s3::xml as s3_xml;
@@ -242,7 +243,7 @@ pub async fn handle_post_object(

 	let etag = format!("\"{}\"", md5);

-	let resp = if let Some(mut target) = params
+	let mut resp = if let Some(mut target) = params
 		.get("success_action_redirect")
 		.and_then(|h| h.to_str().ok())
 		.and_then(|u| url::Url::parse(u).ok())
@@ -262,8 +263,7 @@ pub async fn handle_post_object(
 	} else {
 		let path = head
 			.uri
-			.into_parts()
-			.path_and_query
+			.path_and_query()
 			.map(|paq| paq.path().to_string())
 			.unwrap_or_else(|| "/".to_string());
 		let authority = head
@@ -308,6 +308,13 @@ pub async fn handle_post_object(
 		}
 	};

+	let matching_cors_rule =
+		find_matching_cors_rule(&bucket, &Request::from_parts(head, Body::empty()))?;
+	if let Some(rule) = matching_cors_rule {
+		add_cors_headers(&mut resp, rule)
+			.ok_or_internal_error("Invalid bucket CORS configuration")?;
+	}
+
 	Ok(resp)
 }

@@ -3,6 +3,7 @@ use std::sync::Arc;

 use base64::prelude::*;
 use futures::prelude::*;
+use futures::try_join;
 use hyper::body::{Body, Bytes};
 use hyper::header::{HeaderMap, HeaderValue};
 use hyper::{Request, Response};
@@ -35,7 +36,7 @@ pub async fn handle_put(
 	garage: Arc<Garage>,
 	req: Request<Body>,
 	bucket: &Bucket,
-	key: &str,
+	key: &String,
 	content_sha256: Option<Hash>,
 ) -> Result<Response<Body>, Error> {
 	// Retrieve interesting headers from request
@@ -68,16 +69,24 @@ pub(crate) async fn save_stream<S: Stream<Item = Result<Bytes, Error>> + Unpin>(
 	headers: ObjectVersionHeaders,
 	body: S,
 	bucket: &Bucket,
-	key: &str,
+	key: &String,
 	content_md5: Option<String>,
 	content_sha256: Option<FixedBytes32>,
 ) -> Result<(Uuid, String), Error> {
+	let mut chunker = StreamChunker::new(body, garage.config.block_size);
+	let (first_block_opt, existing_object) = try_join!(
+		chunker.next(),
+		garage
+			.object_table
+			.get(&bucket.id, key)
+			.map_err(Error::from),
+	)?;
+
+	let first_block = first_block_opt.unwrap_or_default();
+
 	// Generate identity of new version
 	let version_uuid = gen_uuid();
-	let version_timestamp = now_msec();
-
-	let mut chunker = StreamChunker::new(body, garage.config.block_size);
-	let first_block = chunker.next().await?.unwrap_or_default();
+	let version_timestamp = next_timestamp(existing_object.as_ref());

 	// If body is small enough, store it directly in the object table
 	// as "inline data". We can then return immediately.
@@ -97,7 +106,7 @@ pub(crate) async fn save_stream<S: Stream<Item = Result<Bytes, Error>> + Unpin>(
 			content_sha256,
 		)?;

-		check_quotas(&garage, bucket, key, size).await?;
+		check_quotas(&garage, bucket, size, existing_object.as_ref()).await?;

 		let object_version = ObjectVersion {
 			uuid: version_uuid,
@@ -176,7 +185,7 @@ pub(crate) async fn save_stream<S: Stream<Item = Result<Bytes, Error>> + Unpin>(
 		content_sha256,
 	)?;

-	check_quotas(&garage, bucket, key, total_size).await?;
+	check_quotas(&garage, bucket, total_size, existing_object.as_ref()).await?;

 	// Save final object state, marked as Complete
 	let md5sum_hex = hex::encode(data_md5sum);
@@ -229,19 +238,19 @@ pub(crate) fn ensure_checksum_matches(
 pub(crate) async fn check_quotas(
 	garage: &Arc<Garage>,
 	bucket: &Bucket,
-	key: &str,
 	size: u64,
+	prev_object: Option<&Object>,
 ) -> Result<(), Error> {
 	let quotas = bucket.state.as_option().unwrap().quotas.get();
 	if quotas.max_objects.is_none() && quotas.max_size.is_none() {
 		return Ok(());
 	};

-	let key = key.to_string();
-	let (prev_object, counters) = futures::try_join!(
-		garage.object_table.get(&bucket.id, &key),
-		garage.object_counter_table.table.get(&bucket.id, &EmptyKey),
-	)?;
+	let counters = garage
+		.object_counter_table
+		.table
+		.get(&bucket.id, &EmptyKey)
+		.await?;

 	let counters = counters
 		.map(|x| x.filtered_values(&garage.system.ring.borrow()))
@@ -275,7 +284,7 @@ pub(crate) async fn check_quotas(
 		if cnt_size_diff > 0 && current_size + cnt_size_diff > ms as i64 {
 			return Err(Error::forbidden(format!(
 				"Bucket size quota is reached, maximum total size of objects for this bucket: {}. The bucket is already {} bytes, and this object would add {} bytes.",
-				ms, current_size, size
+				ms, current_size, cnt_size_diff
 			)));
 		}
 	}
@@ -519,3 +528,11 @@ pub(crate) fn get_headers(headers: &HeaderMap<HeaderValue>) -> Result<ObjectVers
 		other,
 	})
 }
+
+pub(crate) fn next_timestamp(existing_object: Option<&Object>) -> u64 {
+	existing_object
+		.as_ref()
+		.and_then(|obj| obj.versions().iter().map(|v| v.timestamp).max())
+		.map(|t| std::cmp::max(t + 1, now_msec()))
+		.unwrap_or_else(now_msec)
+}
@@ -1,6 +1,6 @@
 [package]
 name = "garage_block"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -1,6 +1,6 @@
 [package]
 name = "garage_db"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -11,11 +11,6 @@ readme = "../../README.md"
 [lib]
 path = "lib.rs"

-[[bin]]
-name = "convert"
-path = "bin/convert.rs"
-required-features = ["cli"]
-
 [dependencies]
 err-derive = "0.3"
 hexdump = "0.1"
@@ -1,6 +1,6 @@
 [package]
 name = "garage"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -67,6 +67,7 @@ chrono = "0.4"
 http = "0.2"
 hmac = "0.12"
 hyper = { version = "0.14", features = ["client", "http1", "runtime"] }
+mktemp = "0.5"
 sha2 = "0.10"

 static_init = "1.0"
@@ -1,39 +1,30 @@
 use std::path::PathBuf;

+use structopt::StructOpt;
+
 use garage_db::*;

-use clap::Parser;
-
 /// K2V command line interface
-#[derive(Parser, Debug)]
-#[clap(author, version, about, long_about = None)]
-struct Args {
-	/// Input DB path
-	#[clap(short = 'i')]
+#[derive(StructOpt, Debug)]
+pub struct ConvertDbOpt {
+	/// Input database path (not the same as metadata_dir, see
+	/// https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#db-engine-since-v0-8-0)
+	#[structopt(short = "i")]
 	input_path: PathBuf,
-	/// Input DB engine
-	#[clap(short = 'a')]
+	/// Input database engine (sled, lmdb or sqlite; limited by db engines
+	/// enabled in this build)
+	#[structopt(short = "a")]
 	input_engine: String,

-	/// Output DB path
-	#[clap(short = 'o')]
+	/// Output database path
+	#[structopt(short = "o")]
 	output_path: PathBuf,
-	/// Output DB engine
-	#[clap(short = 'b')]
+	/// Output database engine
+	#[structopt(short = "b")]
 	output_engine: String,
 }

-fn main() {
-	let args = Args::parse();
-	pretty_env_logger::init();
-
-	match do_conversion(args) {
-		Ok(()) => println!("Success!"),
-		Err(e) => eprintln!("Error: {}", e),
-	}
-}
-
-fn do_conversion(args: Args) -> Result<()> {
+pub(crate) fn do_conversion(args: ConvertDbOpt) -> Result<()> {
 	let input = open_db(args.input_path, args.input_engine)?;
 	let output = open_db(args.output_path, args.output_engine)?;
 	output.import(&input)?;
@@ -42,16 +33,19 @@ fn do_conversion(args: Args) -> Result<()> {

 fn open_db(path: PathBuf, engine: String) -> Result<Db> {
 	match engine.as_str() {
+		#[cfg(feature = "sled")]
 		"sled" => {
 			let db = sled_adapter::sled::Config::default().path(&path).open()?;
 			Ok(sled_adapter::SledDb::init(db))
 		}
+		#[cfg(feature = "sqlite")]
 		"sqlite" | "sqlite3" | "rusqlite" => {
 			let db = sqlite_adapter::rusqlite::Connection::open(&path)?;
 			db.pragma_update(None, "journal_mode", &"WAL")?;
 			db.pragma_update(None, "synchronous", &"NORMAL")?;
 			Ok(sqlite_adapter::SqliteDb::init(db))
 		}
+		#[cfg(feature = "lmdb")]
 		"lmdb" | "heed" => {
 			std::fs::create_dir_all(&path).map_err(|e| {
 				Error(format!("Unable to create LMDB data directory: {}", e).into())
@@ -63,11 +57,13 @@ fn open_db(path: PathBuf, engine: String) -> Result<Db> {
 			env_builder.max_dbs(100);
 			env_builder.map_size(map_size);
 			unsafe {
-				env_builder.flag(heed::flags::Flags::MdbNoMetaSync);
+				env_builder.flag(lmdb_adapter::heed::flags::Flags::MdbNoMetaSync);
 			}
 			let db = env_builder.open(&path)?;
 			Ok(lmdb_adapter::LmdbDb::init(db))
 		}
-		e => Err(Error(format!("Invalid DB engine: {}", e).into())),
+		e => Err(Error(
+			format!("Invalid or unsupported DB engine: {}", e).into(),
+		)),
 	}
 }
@@ -43,7 +43,7 @@ pub fn node_id_command(config_file: PathBuf, quiet: bool) -> Result<(), Error> {
 			idstr
 		);
 		eprintln!(
-			"where <remote_node> is their own node identifier in the format: <pubkey>@<ip>:<port>"
+			"where <remote_node> is their own node identifier in the format: <full-node-id>@<ip>:<port>"
 		);
 		eprintln!();
 		eprintln!("This node identifier can also be added as a bootstrap node in other node's garage.toml files:");
@@ -4,6 +4,8 @@ pub(crate) mod layout;
 pub(crate) mod structs;
 pub(crate) mod util;

+pub(crate) mod convert_db;
+
 pub(crate) use cmd::*;
 pub(crate) use init::*;
 pub(crate) use layout::*;
@@ -3,6 +3,8 @@ use structopt::StructOpt;

 use garage_util::version::garage_version;

+use crate::cli::convert_db;
+
 #[derive(StructOpt, Debug)]
 pub enum Command {
 	/// Run Garage server
@@ -54,11 +56,16 @@ pub enum Command {
 	/// Low-level debug operations on data blocks
 	#[structopt(name = "block", version = garage_version())]
 	Block(BlockOperation),
+
+	/// Convert metadata db between database engine formats
+	#[structopt(name = "convert-db", version = garage_version())]
+	ConvertDb(convert_db::ConvertDbOpt),
 }

 #[derive(StructOpt, Debug)]
 pub enum NodeOperation {
-	/// Print identifier (public key) of this Garage node
+	/// Print the full node ID (public key) of this Garage node, and its publicly reachable IP
+	/// address and port if they are specified in config file under `rpc_public_addr`
 	#[structopt(name = "id", version = garage_version())]
 	NodeId(NodeIdOpt),

@@ -76,8 +83,9 @@ pub struct NodeIdOpt {

 #[derive(StructOpt, Debug)]
 pub struct ConnectNodeOpt {
-	/// Node public key and address, in the format:
-	/// `<public key hexadecimal>@<ip or hostname>:<port>`
+	/// Full node ID (public key) and IP address and port, in the format:
+	/// `<full node ID>@<ip or hostname>:<port>`.
+	/// You can retrieve this information on the target node using `garage node id`.
 	pub(crate) node: String,
 }

@@ -7,6 +7,7 @@ extern crate tracing;
 mod admin;
 mod cli;
 mod repair;
+mod secrets;
 mod server;
 #[cfg(feature = "telemetry-otlp")]
 mod tracing_setup;
@@ -28,7 +29,6 @@ use structopt::StructOpt;
 use netapp::util::parse_and_resolve_peer_addr;
 use netapp::NetworkKey;

-use garage_util::config::Config;
 use garage_util::error::*;

 use garage_rpc::system::*;
@@ -38,6 +38,7 @@ use garage_model::helper::error::Error as HelperError;

 use admin::*;
 use cli::*;
+use secrets::Secrets;

 #[derive(StructOpt, Debug)]
 #[structopt(
@@ -45,8 +46,7 @@ use cli::*;
 	about = "S3-compatible object store for self-hosted geo-distributed deployments"
 )]
 struct Opt {
-	/// Host to connect to for admin operations, in the format:
-	/// <public-key>@<ip>:<port>
+	/// Host to connect to for admin operations, in the format: <full-node-id>@<ip>:<port>
 	#[structopt(short = "h", long = "rpc-host", env = "GARAGE_RPC_HOST")]
 	pub rpc_host: Option<String>,

@@ -66,24 +66,6 @@ struct Opt {
 	cmd: Command,
 }

-#[derive(StructOpt, Debug)]
-pub struct Secrets {
-	/// RPC secret network key, used to replace rpc_secret in config.toml when running the
-	/// daemon or doing admin operations
-	#[structopt(short = "s", long = "rpc-secret", env = "GARAGE_RPC_SECRET")]
-	pub rpc_secret: Option<String>,
-
-	/// Metrics API authentication token, replaces admin.metrics_token in config.toml when
-	/// running the Garage daemon
-	#[structopt(long = "admin-token", env = "GARAGE_ADMIN_TOKEN")]
-	pub admin_token: Option<String>,
-
-	/// Metrics API authentication token, replaces admin.metrics_token in config.toml when
-	/// running the Garage daemon
-	#[structopt(long = "metrics-token", env = "GARAGE_METRICS_TOKEN")]
-	pub metrics_token: Option<String>,
-}
-
 #[tokio::main]
 async fn main() {
 	// Initialize version and features info
@@ -176,6 +158,9 @@ async fn main() {
 		Command::OfflineRepair(repair_opt) => {
 			repair::offline::offline_repair(opt.config_file, opt.secrets, repair_opt).await
 		}
+		Command::ConvertDb(conv_opt) => {
+			cli::convert_db::do_conversion(conv_opt).map_err(From::from)
+		}
 		Command::Node(NodeOperation::NodeId(node_id_opt)) => {
 			node_id_command(opt.config_file, node_id_opt.quiet)
 		}
@@ -215,7 +200,7 @@ async fn cli_command(opt: Opt) -> Result<(), Error> {

 	// Find and parse the address of the target host
 	let (id, addr, is_default_addr) = if let Some(h) = opt.rpc_host {
-		let (id, addrs) = parse_and_resolve_peer_addr(&h).ok_or_else(|| format!("Invalid RPC remote node identifier: {}. Expected format is <pubkey>@<IP or hostname>:<port>.", h))?;
+		let (id, addrs) = parse_and_resolve_peer_addr(&h).ok_or_else(|| format!("Invalid RPC remote node identifier: {}. Expected format is <full node id>@<IP or hostname>:<port>.", h))?;
 		(id, addrs[0], false)
 	} else {
 		let node_id = garage_rpc::system::read_node_id(&config.as_ref().unwrap().metadata_dir)
@@ -245,7 +230,7 @@ async fn cli_command(opt: Opt) -> Result<(), Error> {
 				addr
 			);
 		}
-		Err(e).err_context("Unable to connect to destination RPC host. Check that you are using the same value of rpc_secret as them, and that you have their correct public key.")?;
+		Err(e).err_context("Unable to connect to destination RPC host. Check that you are using the same value of rpc_secret as them, and that you have their correct full-length node ID (public key).")?;
 	}

 	let system_rpc_endpoint = netapp.endpoint::<SystemRpc, ()>(SYSTEM_RPC_PATH.into());
@@ -258,16 +243,3 @@ async fn cli_command(opt: Opt) -> Result<(), Error> {
 		Ok(x) => Ok(x),
 	}
 }
-
-fn fill_secrets(mut config: Config, secrets: Secrets) -> Config {
-	if secrets.rpc_secret.is_some() {
-		config.rpc_secret = secrets.rpc_secret;
-	}
-	if secrets.admin_token.is_some() {
-		config.admin.admin_token = secrets.admin_token;
-	}
-	if secrets.metrics_token.is_some() {
-		config.admin.metrics_token = secrets.metrics_token;
-	}
-	config
-}
@@ -6,7 +6,7 @@ use garage_util::error::*;
 use garage_model::garage::Garage;

 use crate::cli::structs::*;
-use crate::{fill_secrets, Secrets};
+use crate::secrets::{fill_secrets, Secrets};

 pub async fn offline_repair(
 	config_file: PathBuf,
@@ -20,7 +20,7 @@ pub async fn offline_repair(
 	}

 	info!("Loading configuration...");
-	let config = fill_secrets(read_config(config_file)?, secrets);
+	let config = fill_secrets(read_config(config_file)?, secrets)?;

 	info!("Initializing Garage main data store...");
 	let garage = Garage::new(config)?;
@@ -0,0 +1,318 @@
+use structopt::StructOpt;
+
+use garage_util::config::Config;
+use garage_util::error::Error;
+
+/// Structure for secret values or paths that are passed as CLI arguments or environment
+/// variables, instead of in the config file.
+#[derive(StructOpt, Debug, Default, Clone)]
+pub struct Secrets {
+	/// Skip permission check on files containing secrets
+	#[cfg(unix)]
+	#[structopt(
+		long = "allow-world-readable-secrets",
+		env = "GARAGE_ALLOW_WORLD_READABLE_SECRETS"
+	)]
+	pub allow_world_readable_secrets: Option<bool>,
+
+	/// RPC secret network key, used to replace rpc_secret in config.toml when running the
+	/// daemon or doing admin operations
+	#[structopt(short = "s", long = "rpc-secret", env = "GARAGE_RPC_SECRET")]
+	pub rpc_secret: Option<String>,
+
+	/// RPC secret network key, used to replace rpc_secret in config.toml and rpc-secret
+	/// when running the daemon or doing admin operations
+	#[structopt(long = "rpc-secret-file", env = "GARAGE_RPC_SECRET_FILE")]
+	pub rpc_secret_file: Option<String>,
+
+	/// Admin API authentication token, replaces admin.admin_token in config.toml when
+	/// running the Garage daemon
+	#[structopt(long = "admin-token", env = "GARAGE_ADMIN_TOKEN")]
+	pub admin_token: Option<String>,
+
+	/// Admin API authentication token file path, replaces admin.admin_token in config.toml
+	/// and admin-token when running the Garage daemon
+	#[structopt(long = "admin-token-file", env = "GARAGE_ADMIN_TOKEN_FILE")]
+	pub admin_token_file: Option<String>,
+
+	/// Metrics API authentication token, replaces admin.metrics_token in config.toml when
+	/// running the Garage daemon
+	#[structopt(long = "metrics-token", env = "GARAGE_METRICS_TOKEN")]
+	pub metrics_token: Option<String>,
+
+	/// Metrics API authentication token file path, replaces admin.metrics_token in config.toml
+	/// and metrics-token when running the Garage daemon
+	#[structopt(long = "metrics-token-file", env = "GARAGE_METRICS_TOKEN_FILE")]
+	pub metrics_token_file: Option<String>,
+}
+
+/// Single function to fill all secrets in the Config struct from their correct source (value
+/// from config or CLI param or env variable or read from a file specified in config or CLI
+/// param or env variable)
+pub fn fill_secrets(mut config: Config, secrets: Secrets) -> Result<Config, Error> {
+	let allow_world_readable = secrets
+		.allow_world_readable_secrets
+		.unwrap_or(config.allow_world_readable_secrets);
+
+	fill_secret(
+		&mut config.rpc_secret,
+		&config.rpc_secret_file,
+		&secrets.rpc_secret,
+		&secrets.rpc_secret_file,
+		"rpc_secret",
+		allow_world_readable,
+	)?;
+
+	fill_secret(
+		&mut config.admin.admin_token,
+		&config.admin.admin_token_file,
+		&secrets.admin_token,
+		&secrets.admin_token_file,
+		"admin.admin_token",
+		allow_world_readable,
+	)?;
+	fill_secret(
+		&mut config.admin.metrics_token,
+		&config.admin.metrics_token_file,
+		&secrets.metrics_token,
+		&secrets.metrics_token_file,
+		"admin.metrics_token",
+		allow_world_readable,
+	)?;
+
+	Ok(config)
+}
+
+fn fill_secret(
+	config_secret: &mut Option<String>,
+	config_secret_file: &Option<String>,
+	cli_secret: &Option<String>,
+	cli_secret_file: &Option<String>,
+	name: &'static str,
+	allow_world_readable: bool,
+) -> Result<(), Error> {
+	let cli_value = match (&cli_secret, &cli_secret_file) {
+		(Some(_), Some(_)) => {
+			return Err(format!("only one of `{}` and `{}_file` can be set", name, name).into());
+		}
+		(Some(secret), None) => Some(secret.to_string()),
+		(None, Some(file)) => Some(read_secret_file(file, allow_world_readable)?),
+		(None, None) => None,
+	};
+
+	if let Some(val) = cli_value {
+		if config_secret.is_some() || config_secret_file.is_some() {
+			debug!("Overriding secret `{}` using value specified using CLI argument or environnement variable.", name);
+		}
+
+		*config_secret = Some(val);
+	} else if let Some(file_path) = &config_secret_file {
+		if config_secret.is_some() {
+			return Err(format!("only one of `{}` and `{}_file` can be set", name, name).into());
+		}
+
+		*config_secret = Some(read_secret_file(file_path, allow_world_readable)?);
+	}
+
+	Ok(())
+}
+
+fn read_secret_file(file_path: &String, allow_world_readable: bool) -> Result<String, Error> {
+	if !allow_world_readable {
+		#[cfg(unix)]
+		{
+			use std::os::unix::fs::MetadataExt;
+			let metadata = std::fs::metadata(file_path)?;
+			if metadata.mode() & 0o077 != 0 {
+				return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
+			}
+		}
+	}
+
+	let secret_buf = std::fs::read_to_string(file_path)?;
+
+	// trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
+	//           also editors sometimes add a trailing newline
+	Ok(String::from(secret_buf.trim_end()))
+}
+
+#[cfg(test)]
+mod tests {
+	use std::fs::File;
+	use std::io::Write;
+
+	use garage_util::config::read_config;
+	use garage_util::error::Error;
+
+	use super::*;
+
+	#[test]
+	fn test_rpc_secret_file_works() -> Result<(), Error> {
+		let path_secret = mktemp::Temp::new_file()?;
+		let mut file_secret = File::create(path_secret.as_path())?;
+		writeln!(file_secret, "foo")?;
+		drop(file_secret);
+
+		let path_config = mktemp::Temp::new_file()?;
+		let mut file_config = File::create(path_config.as_path())?;
+		let path_secret_path = path_secret.as_path();
+		writeln!(
+			file_config,
+			r#"
+			metadata_dir = "/tmp/garage/meta"
+			data_dir = "/tmp/garage/data"
+			replication_mode = "3"
+			rpc_bind_addr = "[::]:3901"
+			rpc_secret_file = "{}"
+
+			[s3_api]
+			s3_region = "garage"
+			api_bind_addr = "[::]:3900"
+			"#,
+			path_secret_path.display()
+		)?;
+		drop(file_config);
+
+		// Second configuration file, same as previous one
+		// except it allows world-readable secrets.
+		let path_config_allow_world_readable = mktemp::Temp::new_file()?;
+		let mut file_config_allow_world_readable =
+			File::create(path_config_allow_world_readable.as_path())?;
+		writeln!(
+			file_config_allow_world_readable,
+			r#"
+			metadata_dir = "/tmp/garage/meta"
+			data_dir = "/tmp/garage/data"
+			replication_mode = "3"
+			rpc_bind_addr = "[::]:3901"
+			rpc_secret_file = "{}"
+			allow_world_readable_secrets = true
+
+			[s3_api]
+			s3_region = "garage"
+			api_bind_addr = "[::]:3900"
+			"#,
+			path_secret_path.display()
+		)?;
+		drop(file_config_allow_world_readable);
+
+		let config = read_config(path_config.to_path_buf())?;
+		let config = fill_secrets(config, Secrets::default())?;
+		assert_eq!("foo", config.rpc_secret.unwrap());
+
+		// ---- Check non world-readable secrets config ----
+		#[cfg(unix)]
+		{
+			let secrets_allow_world_readable = Secrets {
+				allow_world_readable_secrets: Some(true),
+				..Default::default()
+			};
+			let secrets_no_allow_world_readable = Secrets {
+				allow_world_readable_secrets: Some(false),
+				..Default::default()
+			};
+
+			use std::os::unix::fs::PermissionsExt;
+			let metadata = std::fs::metadata(&path_secret_path)?;
+			let mut perm = metadata.permissions();
+			perm.set_mode(0o660);
+			std::fs::set_permissions(&path_secret_path, perm)?;
+
+			// Config file that just specifies the path
+			let config = read_config(path_config.to_path_buf())?;
+			assert!(fill_secrets(config, Secrets::default()).is_err());
+
+			let config = read_config(path_config.to_path_buf())?;
+			assert!(fill_secrets(config, secrets_allow_world_readable.clone()).is_ok());
+
+			let config = read_config(path_config.to_path_buf())?;
+			assert!(fill_secrets(config, secrets_no_allow_world_readable.clone()).is_err());
+
+			// Config file that also specifies to allow world_readable_secrets
+			let config = read_config(path_config_allow_world_readable.to_path_buf())?;
+			assert!(fill_secrets(config, Secrets::default()).is_ok());
+
+			let config = read_config(path_config_allow_world_readable.to_path_buf())?;
+			assert!(fill_secrets(config, secrets_allow_world_readable).is_ok());
+
+			let config = read_config(path_config_allow_world_readable.to_path_buf())?;
+			assert!(fill_secrets(config, secrets_no_allow_world_readable).is_err());
+		}
+
+		// ---- Check alternative secrets specified on CLI ----
+
+		let path_secret2 = mktemp::Temp::new_file()?;
+		let mut file_secret2 = File::create(path_secret2.as_path())?;
+		writeln!(file_secret2, "bar")?;
+		drop(file_secret2);
+
+		let config = read_config(path_config.to_path_buf())?;
+		let config = fill_secrets(
+			config,
+			Secrets {
+				rpc_secret: Some("baz".into()),
+				..Default::default()
+			},
+		)?;
+		assert_eq!(config.rpc_secret.as_deref(), Some("baz"));
+
+		let config = read_config(path_config.to_path_buf())?;
+		let config = fill_secrets(
+			config,
+			Secrets {
+				rpc_secret_file: Some(path_secret2.display().to_string()),
+				..Default::default()
+			},
+		)?;
+		assert_eq!(config.rpc_secret.as_deref(), Some("bar"));
+
+		let config = read_config(path_config.to_path_buf())?;
+		assert!(fill_secrets(
+			config,
+			Secrets {
+				rpc_secret: Some("baz".into()),
+				rpc_secret_file: Some(path_secret2.display().to_string()),
+				..Default::default()
+			}
+		)
+		.is_err());
+
+		drop(path_secret);
+		drop(path_secret2);
+		drop(path_config);
+		drop(path_config_allow_world_readable);
+
+		Ok(())
+	}
+
+	#[test]
+	fn test_rcp_secret_and_rpc_secret_file_cannot_be_set_both() -> Result<(), Error> {
+		let path_config = mktemp::Temp::new_file()?;
+		let mut file_config = File::create(path_config.as_path())?;
+		writeln!(
+			file_config,
+			r#"
+			metadata_dir = "/tmp/garage/meta"
+			data_dir = "/tmp/garage/data"
+			replication_mode = "3"
+			rpc_bind_addr = "[::]:3901"
+			rpc_secret= "dummy"
+			rpc_secret_file = "dummy"
+
+			[s3_api]
+			s3_region = "garage"
+			api_bind_addr = "[::]:3900"
+			"#
+		)?;
+		let config = read_config(path_config.to_path_buf())?;
+		assert_eq!(
+			"only one of `rpc_secret` and `rpc_secret_file` can be set",
+			fill_secrets(config, Secrets::default())
+				.unwrap_err()
+				.to_string()
+		);
+		drop(path_config);
+		drop(file_config);
+		Ok(())
+	}
+}
@@ -15,9 +15,9 @@ use garage_web::WebServer;
 use garage_api::k2v::api_server::K2VApiServer;

 use crate::admin::*;
+use crate::secrets::{fill_secrets, Secrets};
 #[cfg(feature = "telemetry-otlp")]
 use crate::tracing_setup::*;
-use crate::{fill_secrets, Secrets};

 async fn wait_from(mut chan: watch::Receiver<bool>) {
 	while !*chan.borrow() {
@@ -29,12 +29,19 @@ async fn wait_from(mut chan: watch::Receiver<bool>) {

 pub async fn run_server(config_file: PathBuf, secrets: Secrets) -> Result<(), Error> {
 	info!("Loading configuration...");
-	let config = fill_secrets(read_config(config_file)?, secrets);
+	let config = fill_secrets(read_config(config_file)?, secrets)?;

 	// ---- Initialize Garage internals ----

 	#[cfg(feature = "metrics")]
-	let metrics_exporter = opentelemetry_prometheus::exporter().init();
+	let metrics_exporter = opentelemetry_prometheus::exporter()
+		.with_default_summary_quantiles(vec![0.25, 0.5, 0.75, 0.9, 0.95, 0.99])
+		.with_default_histogram_boundaries(vec![
+			0.001, 0.0015, 0.002, 0.003, 0.005, 0.007, 0.01, 0.015, 0.02, 0.03, 0.05, 0.07, 0.1,
+			0.15, 0.2, 0.3, 0.5, 0.7, 1., 1.5, 2., 3., 5., 7., 10., 15., 20., 30., 40., 50., 60.,
+			70., 100.,
+		])
+		.init();

 	info!("Initializing Garage main data store...");
 	let garage = Garage::new(config.clone())?;
@@ -1,6 +1,6 @@
 [package]
 name = "garage_model"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -1,6 +1,6 @@
 [package]
 name = "garage_rpc"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -148,7 +148,7 @@ impl ConsulDiscovery {
 				ret.push((pubkey, SocketAddr::new(ip, ent.service_port)));
 			} else {
 				warn!(
-					"Could not process node spec from Consul: {:?} (invalid IP or public key)",
+					"Could not process node spec from Consul: {:?} (invalid IP address or node ID/pubkey)",
 					ent
 				);
 			}
@@ -57,7 +57,7 @@ pub const SYSTEM_RPC_PATH: &str = "garage_rpc/membership.rs/SystemRpc";
 pub enum SystemRpc {
 	/// Response to successfull advertisements
 	Ok,
-	/// Request to connect to a specific node (in <pubkey>@<host>:<port> format)
+	/// Request to connect to a specific node (in <pubkey>@<host>:<port> format, pubkey = full-length node ID)
 	Connect(String),
 	/// Ask other node its cluster layout. Answered with AdvertiseClusterLayout
 	PullClusterLayout,
@@ -899,8 +899,8 @@ impl NodeStatus {
 		use nix::sys::statvfs::statvfs;
 		let mount_avail = |path: &Path| match statvfs(path) {
 			Ok(x) => {
-				let avail = x.blocks_available() * x.fragment_size() as u64;
-				let total = x.blocks() * x.fragment_size() as u64;
+				let avail = x.blocks_available() as u64 * x.fragment_size() as u64;
+				let total = x.blocks() as u64 * x.fragment_size() as u64;
 				Some((x.filesystem_id(), avail, total))
 			}
 			Err(_) => None,
@@ -1,6 +1,6 @@
 [package]
 name = "garage_table"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -1,6 +1,6 @@
 [package]
 name = "garage_util"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>"]
 edition = "2018"
 license = "AGPL-3.0"
@@ -1,6 +1,5 @@
 //! Contains type and functions related to Garage configuration file
 use std::convert::TryFrom;
-use std::io::Read;
 use std::net::SocketAddr;
 use std::path::PathBuf;

@@ -45,11 +44,15 @@ pub struct Config {
 	)]
 	pub compression_level: Option<i32>,

+	/// Skip the permission check of secret files. Useful when
+	/// POSIX ACLs (or more complex chmods) are used.
+	#[serde(default)]
+	pub allow_world_readable_secrets: bool,
+
 	/// RPC secret key: 32 bytes hex encoded
 	pub rpc_secret: Option<String>,
 	/// Optional file where RPC secret key is read from
 	pub rpc_secret_file: Option<String>,
-
 	/// Address to bind for RPC
 	pub rpc_bind_addr: SocketAddr,
 	/// Public IP address of this node
@@ -221,6 +224,13 @@ pub struct KubernetesDiscoveryConfig {
 	pub skip_crd: bool,
 }

+/// Read and parse configuration
+pub fn read_config(config_file: PathBuf) -> Result<Config, Error> {
+	let config = std::fs::read_to_string(config_file)?;
+
+	Ok(toml::from_str(&config)?)
+}
+
 fn default_db_engine() -> String {
 	"lmdb".into()
 }
@@ -235,68 +245,6 @@ fn default_block_size() -> usize {
 	1048576
 }

-/// Read and parse configuration
-pub fn read_config(config_file: PathBuf) -> Result<Config, Error> {
-	let mut file = std::fs::OpenOptions::new()
-		.read(true)
-		.open(config_file.as_path())?;
-
-	let mut config = String::new();
-	file.read_to_string(&mut config)?;
-
-	let mut parsed_config: Config = toml::from_str(&config)?;
-
-	secret_from_file(
-		&mut parsed_config.rpc_secret,
-		&parsed_config.rpc_secret_file,
-		"rpc_secret",
-	)?;
-	secret_from_file(
-		&mut parsed_config.admin.metrics_token,
-		&parsed_config.admin.metrics_token_file,
-		"admin.metrics_token",
-	)?;
-	secret_from_file(
-		&mut parsed_config.admin.admin_token,
-		&parsed_config.admin.admin_token_file,
-		"admin.admin_token",
-	)?;
-
-	Ok(parsed_config)
-}
-
-fn secret_from_file(
-	secret: &mut Option<String>,
-	secret_file: &Option<String>,
-	name: &'static str,
-) -> Result<(), Error> {
-	match (&secret, &secret_file) {
-		(_, None) => {
-			// no-op
-		}
-		(Some(_), Some(_)) => {
-			return Err(format!("only one of `{}` and `{}_file` can be set", name, name).into());
-		}
-		(None, Some(file_path)) => {
-			#[cfg(unix)]
-			if std::env::var("GARAGE_ALLOW_WORLD_READABLE_SECRETS").as_deref() != Ok("true") {
-				use std::os::unix::fs::MetadataExt;
-				let metadata = std::fs::metadata(file_path)?;
-				if metadata.mode() & 0o077 != 0 {
-					return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
-				}
-			}
-			let mut file = std::fs::OpenOptions::new().read(true).open(file_path)?;
-			let mut secret_buf = String::new();
-			file.read_to_string(&mut secret_buf)?;
-			// trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
-			//           also editors sometimes add a trailing newline
-			*secret = Some(String::from(secret_buf.trim_end()));
-		}
-	}
-	Ok(())
-}
-
 fn default_compression() -> Option<i32> {
 	Some(1)
 }
@@ -425,83 +373,4 @@ mod tests {

 		Ok(())
 	}
-
-	#[test]
-	fn test_rpc_secret_file_works() -> Result<(), Error> {
-		let path_secret = mktemp::Temp::new_file()?;
-		let mut file_secret = File::create(path_secret.as_path())?;
-		writeln!(file_secret, "foo")?;
-		drop(file_secret);
-
-		let path_config = mktemp::Temp::new_file()?;
-		let mut file_config = File::create(path_config.as_path())?;
-		let path_secret_path = path_secret.as_path();
-		writeln!(
-			file_config,
-			r#"
-			metadata_dir = "/tmp/garage/meta"
-			data_dir = "/tmp/garage/data"
-			replication_mode = "3"
-			rpc_bind_addr = "[::]:3901"
-			rpc_secret_file = "{}"
-
-			[s3_api]
-			s3_region = "garage"
-			api_bind_addr = "[::]:3900"
-			"#,
-			path_secret_path.display()
-		)?;
-		let config = super::read_config(path_config.to_path_buf())?;
-		assert_eq!("foo", config.rpc_secret.unwrap());
-
-		#[cfg(unix)]
-		{
-			use std::os::unix::fs::PermissionsExt;
-			let metadata = std::fs::metadata(&path_secret_path)?;
-			let mut perm = metadata.permissions();
-			perm.set_mode(0o660);
-			std::fs::set_permissions(&path_secret_path, perm)?;
-
-			std::env::set_var("GARAGE_ALLOW_WORLD_READABLE_SECRETS", "false");
-			assert!(super::read_config(path_config.to_path_buf()).is_err());
-
-			std::env::set_var("GARAGE_ALLOW_WORLD_READABLE_SECRETS", "true");
-			assert!(super::read_config(path_config.to_path_buf()).is_ok());
-		}
-
-		drop(path_config);
-		drop(path_secret);
-		drop(file_config);
-		Ok(())
-	}
-
-	#[test]
-	fn test_rcp_secret_and_rpc_secret_file_cannot_be_set_both() -> Result<(), Error> {
-		let path_config = mktemp::Temp::new_file()?;
-		let mut file_config = File::create(path_config.as_path())?;
-		writeln!(
-			file_config,
-			r#"
-			metadata_dir = "/tmp/garage/meta"
-			data_dir = "/tmp/garage/data"
-			replication_mode = "3"
-			rpc_bind_addr = "[::]:3901"
-			rpc_secret= "dummy"
-			rpc_secret_file = "dummy"
-
-			[s3_api]
-			s3_region = "garage"
-			api_bind_addr = "[::]:3900"
-			"#
-		)?;
-		assert_eq!(
-			"only one of `rpc_secret` and `rpc_secret_file` can be set",
-			super::read_config(path_config.to_path_buf())
-				.unwrap_err()
-				.to_string()
-		);
-		drop(path_config);
-		drop(file_config);
-		Ok(())
-	}
 }
@@ -1,6 +1,6 @@
 [package]
 name = "garage_web"
-version = "0.8.4"
+version = "0.9.1"
 authors = ["Alex Auvolat <alex@adnab.me>", "Quentin Dufour <quentin@dufour.io>"]
 edition = "2018"
 license = "AGPL-3.0"
Author	SHA1	Message	Date
Alex Auvolat	ee57dd922b	Bump version to 0.9.1	2024-01-16 16:28:17 +01:00
Alex	9cfeea389a	Merge pull request 'CLI help, comments & messages: make clear that full-length node ID = public key' (#688 ) from rename-public-key into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/688	2024-01-16 13:33:43 +00:00
Alex Auvolat	82a29bf6e5	help, comments: make clear that full-length node ID = public key Generally, avoid using the "public key" terminology	2024-01-16 14:04:11 +01:00
Alex	707d85f602	Merge pull request 'sync garage v0.9 with garage v0.8' (#657 ) from sync-08-09 into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/657	2024-01-16 11:33:27 +00:00
Alex Auvolat	4c5be79b80	Merge tag 'v0.8.5' into sync-08-09 Garage v0.8.5 This minor release includes the following improvements and fixes: New features: - Configuration: make LMDB's `map_size` configurable and make `block_size` and `sled_cache_capacity` expressable as strings (such as `10M`) (#628, #630) - Add support for binding to Unix sockets for the S3, K2V, Admin and Web API servers (#640) - Move the `convert_db` command into the main Garage binary (#645) - Add support for specifying RPC secret and admin tokens as environment variables (#643) - Add `allow_world_readable_secrets` option to config file (#663, #685) Bug fixes: - Use `statvfs` instead of mount list to determine free space in metadata/data directories (#611, #631) - Add missing casts to fix 32-bit build (#632) - Fix error when none of the HTTP servers (S3/K2V/Admin/Web) is started and fix shutdown hang (#613, #633) - Add missing CORS headers to PostObject response (#609, #656) - Monitoring: finer histogram boundaries in Prometheus exported metrics (#531, #686) Other: - Documentation improvements (#641)	2024-01-16 12:12:27 +01:00
Alex	083e982f5f	Merge pull request 'Garage v0.8.5' (#687 ) from rel-0.8.5 into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/687	2024-01-16 10:30:54 +00:00
Alex Auvolat	50643e61bf	Bump version to 0.8.5	2024-01-16 10:47:33 +01:00
Alex	a6421ee5a5	Merge pull request 'monitoring: finer histogram boundaries in prometheus metrics (fix #531 )' (#686 ) from fix-531 into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/686	2024-01-15 16:44:58 +00:00
Alex	993ce74976	Merge pull request '0.8.x: config: refactor secret sourcing' (#685 ) from secret-sourcing into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/685	2024-01-15 16:41:50 +00:00
Alex Auvolat	f512609123	monitoring: finer histogram boundaries in prometheus metrics (fix #531 )	2024-01-15 17:33:35 +01:00
Alex Auvolat	97bae7213a	config: additional tests for secret sourcing	2024-01-15 17:30:30 +01:00
Alex Auvolat	7228695ee2	config: refactor secret sourcing	2024-01-15 17:18:46 +01:00
Alex	ee7fe27d3d	Merge pull request 'Add allow_world_readable_secrets option to config file' (#663 ) from PicNoir/garage:nin/world-readable-conf-file into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/663	2024-01-15 15:20:16 +00:00
Alex	d91a1de731	Merge pull request 'fix typo in peertube doc' (#617 ) from Lapineige/garage:main into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/617	2024-01-11 11:19:42 +00:00
Alex	723e56b37f	Merge pull request 'Jepsen testing (NLnet task 3 subtask 1)' (#544 ) from jepsen into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/544	2024-01-11 10:52:12 +00:00
Alex Auvolat	fa9247f11b	jepsen: updated results, confirming that task3 works	2023-12-14 16:23:48 +01:00
Alex	a8b0e01f88	Merge pull request 'OpenAPI specification of admin APIv1' (#672 ) from api-v1 into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/672	2023-11-29 15:42:46 +00:00
Quentin Dufour	8088690650	fix the doc	2023-11-28 16:18:28 +01:00
Alex	ffa659433d	Merge pull request 'Doc: fix db_engines section and improve config reference' (#674 ) from fix-doc-db-engine into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/674	2023-11-28 12:03:46 +00:00
Alex Auvolat	cfa5550cb2	doc: move replication_mode to top of configuration page reference	2023-11-28 11:58:27 +01:00
Alex Auvolat	939d1f2e17	doc: improve navigation in configuration reference	2023-11-28 11:53:26 +01:00
Alex Auvolat	1f6efe57be	doc: update the `db_engine` section	2023-11-28 11:33:31 +01:00
Quentin Dufour	3908619eac	add ClusterHealthReport endpoint to the API	2023-11-28 09:34:01 +01:00
Quentin Dufour	68d23cccdf	disable int64 finally for now	2023-11-23 10:20:36 +01:00
Quentin Dufour	9f1043586c	set layout version as required	2023-11-23 10:16:16 +01:00
Quentin Dufour	1caa6e29e5	capacity is int64	2023-11-23 10:02:41 +01:00
Quentin Dufour	814b3e11d4	fix query parameters for keys	2023-11-23 08:50:10 +01:00
Quentin Dufour	2d37e7fa39	convert showsecretkey from bool to enum	2023-11-22 21:05:36 +01:00
Quentin Dufour	4f473f43c9	Change how query parameters are handled	2023-11-22 20:39:38 +01:00
Quentin Dufour	3684c29ad0	handle key changes	2023-11-22 18:14:38 +01:00
Quentin Dufour	0d415f42ac	Port GetKeyInfo by adding showSecretKey query param	2023-11-22 18:05:11 +01:00
Quentin Dufour	20b3afbde4	Port layout endpoints	2023-11-22 17:49:51 +01:00
Quentin Dufour	e3cd6ed530	port GetLayout and AddLayout	2023-11-22 15:24:30 +01:00
Quentin Dufour	9b24d7c402	Upgrade GetNodes	2023-11-22 14:25:04 +01:00
Alex	36bd21a148	Merge pull request 'Allow 0 as a part number marker' (#670 ) from asonix/garage:main into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/670	2023-11-22 10:33:31 +00:00
Quentin Dufour	d1d1940252	Health info message now advertises API v1	2023-11-22 09:28:50 +01:00
Quentin Dufour	c63b446989	skeleton for api v1	2023-11-22 08:58:09 +01:00
asonix	92fd899fb6	Allow 0 as a part number marker	2023-11-21 17:39:51 -06:00
Alex Auvolat	92dd2bbe15	jepsen: nlnet task3a seems to fix things	2023-11-16 18:09:13 +01:00
Alex Auvolat	18e5811159	jepsen: add patch and use more complete names	2023-11-16 12:57:21 +01:00
Félix Baylac Jacqué	f83fa02193	Add allow_world_readable_secrets option to config file Sometimes, the secret files permissions checks gets in the way. It's by no mean complete, it doesn't take the Posix ACLs into account among other things. Correctly checking the ACLs would be too involving (see https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/658#issuecomment-7102) and would likely still fail in some weird chmod settings. We're adding a new configuration file key allowing the user to disable this permission check altogether. The (already existing) env variable counterpart always take precedence to this config file option. That's useful in cases where the configuration file is static and cannot be easily altered. Fixes https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/658 Co-authored-by: Florian Klink <flokli@flokli.de>	2023-10-26 18:25:13 +02:00
Alex	f4d3905d15	Merge pull request 'nix: add clang to flake.nix and shell.nix' (#664 ) from add-clang into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/664	2023-10-26 09:25:53 +00:00
Alex	a0fa50dfcd	Merge pull request 's3 api: refactoring and bug fix in ListObjects' (#655 ) from fix-list-objects into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/655	2023-10-26 09:22:47 +00:00
Alex Auvolat	d50fa2a562	nix: add clang to flake.nix and shell.nix	2023-10-26 11:19:22 +02:00
Alex	4b3dee2ca3	Merge pull request 's3 api: add missing CORS headers to PostObject responses (fix #609 )' (#656 ) from fix-cors-post-object into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/656	2023-10-26 09:17:14 +00:00
Alex Auvolat	5b1f50be65	jepsen: testing	2023-10-25 14:43:24 +02:00
Alex Auvolat	9df7fa0bcd	jepsen: use 7 nodes	2023-10-25 14:04:39 +02:00
Alex Auvolat	fd85010a40	jepsen: failures with set2 test in --scenario r	2023-10-25 12:13:27 +02:00
Alex Auvolat	cfbfa09d24	jepsen: fix set2 test omg finally this is so stupid	2023-10-25 11:50:16 +02:00
Alex Auvolat	db921cc05f	jepsen: reconfigure nemesis + add db nemesis	2023-10-25 11:41:34 +02:00
Alex Auvolat	4fa2646a75	jepsen: got a failure with set1	2023-10-24 17:45:22 +02:00
Alex Auvolat	d7ab2c639e	jepsen: fix nemesis to actually generate many operations	2023-10-24 16:39:50 +02:00
Alex Auvolat	d13bde5e26	jepsen: set1 and set2 don't fail anymore ??	2023-10-24 15:44:05 +02:00
Alex	75d5d08ee1	Merge pull request 'Ensure increasing version timestamps when writing new object versions' (#543 ) from increasing-timestamps into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/543	2023-10-24 10:07:16 +00:00
Alex Auvolat	d2c365767b	jepsen: more testing	2023-10-24 11:39:45 +02:00
Alex Auvolat	fb6c9a1243	jepsen: update readme	2023-10-20 15:55:09 +02:00
Alex Auvolat	9030c1eef8	jepsen: code path for nemesis final generator	2023-10-20 15:53:46 +02:00
Alex Auvolat	654775308e	jepsen: add cluster reconfiguration nemesis	2023-10-20 15:48:37 +02:00
Alex Auvolat	f5b0972781	jepsen: register crdt read-after-write is fixed with deleteobject patch	2023-10-20 15:00:10 +02:00
Alex Auvolat	c82d91c6bc	DeleteObject: always insert a deletion marker with a bigger timestamp than everything before	2023-10-20 13:56:35 +02:00
Alex Auvolat	8686cfd0b1	s3 api: also ensure increasing timestamps for create_multipart_upload	2023-10-20 13:37:37 +02:00
Alex Auvolat	d148b83d4f	jepsen: reg2 failure seems to happen only with deleteobject	2023-10-20 13:36:48 +02:00
Alex Auvolat	c6cde1f143	remove now-unused key parameter in check_quotas	2023-10-20 13:20:47 +02:00
Alex Auvolat	4b93ce179a	jepsen: errors in reg2 workload under investigation	2023-10-20 12:56:55 +02:00
Alex Auvolat	4ba18ce9cc	jepsen: wip checker for register-like behavior	2023-10-20 12:13:11 +02:00
Alex Auvolat	ac04934dae	s3 api: add missing CORS headers to PostObject responses (fix #609 )	2023-10-20 10:37:48 +02:00
Alex Auvolat	ef662822c9	jepsen: fix the list-objects call (?)	2023-10-19 23:40:55 +02:00
Alex Auvolat	da8b170748	jepsen: investigating listobjects error	2023-10-19 16:45:24 +02:00
Alex Auvolat	58b0ee1b1a	list objects: prettyness and add asserts	2023-10-19 15:26:17 +02:00
Alex Auvolat	158dc17a06	listobjects: fix panic if continuation token is an empty string	2023-10-19 15:08:47 +02:00
Alex Auvolat	74e50edddd	jepsen: refactoring	2023-10-19 14:34:19 +02:00
Alex	0215b11402	Merge pull request 'Add support for specifying `rpc_secret_file`, `metrics_token_file` and `admin_token_file` using environment variables' (#643 ) from networkException/garage:token-file-env into main-0.8.x Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/643	2023-10-19 09:33:12 +00:00
networkException	8599051c49	garage: support specifying token / secret as environment variables this patch adds support for specifying the `rpc_secret_file`, `metrics_token_file` and `admin_token_file` as environment variables.	2023-10-19 03:39:02 +02:00
networkException	4a19ee94bb	garage: fix admin-token description	2023-10-19 03:31:50 +02:00
networkException	c99cb58d71	util: move reading secret file into seperate helper this patch moves the logic to read a secret file (and check for correct permissions) from `secret_from_file` into a new `read_secret_file` helper.	2023-10-19 03:29:48 +02:00
networkException	5feb6a1f64	docs: add documentation for specifying token / secret file as environment variables	2023-10-19 03:28:44 +02:00
Alex Auvolat	b3bf16ee27	make jepsen test more robust: handle errors and timeouts, fixed access key	2023-10-18 17:51:34 +02:00
Alex Auvolat	d146cdd5b6	cargo fmt	2023-10-18 16:38:26 +02:00
Alex Auvolat	3d6ed63824	check_quotas: avoid re-fetching object from object table	2023-10-18 16:36:48 +02:00
Alex Auvolat	45b0453d0f	Ensure increasing version timestamps in PutObject	2023-10-18 16:31:50 +02:00
Alex Auvolat	ddd3de7fce	refactor jepsen code	2023-10-18 16:30:45 +02:00
Alex Auvolat	84d43501ce	refactor jepsen setup logic	2023-10-18 15:34:12 +02:00
Alex Auvolat	012ade5d4b	jepsen: update jepsen and fix garage key info	2023-10-18 14:06:32 +02:00
Alex Auvolat	ef5ca86dfc	jepsen: update to garage 0.9.0	2023-10-18 14:01:18 +02:00
Alex Auvolat	9ec4cca334	reformatting	2023-10-18 12:03:12 +02:00
Alex Auvolat	18ee8efb5f	Check read-after-write property for sets	2023-10-18 12:03:12 +02:00
Alex Auvolat	55eb4e87c4	set tests with independant tests together	2023-10-18 12:03:11 +02:00
Alex Auvolat	0bb1577ae1	two set workloads with different checkers	2023-10-18 12:03:11 +02:00
Alex Auvolat	6eb26be548	Add garage set test (this one works :p)	2023-10-18 12:03:11 +02:00
Alex Auvolat	eb86eaa6d2	refactor jepsen test	2023-10-18 12:03:11 +02:00
Alex Auvolat	80d7b7d858	remove useless files	2023-10-18 12:03:11 +02:00
Alex Auvolat	93a7132b4c	the fix for increasing timestamps does not make things linearizable	2023-10-18 12:03:11 +02:00
Alex Auvolat	dc5245ce65	even without nemesis, s3 get/put/delete is not linearizable (is this normal?)	2023-10-18 12:03:11 +02:00
Alex Auvolat	70c1d3db46	better match exceptions	2023-10-18 12:03:11 +02:00
Alex Auvolat	bc11701999	jepsen: s3 gets and puts	2023-10-18 12:03:11 +02:00
Alex Auvolat	ca4cc7e44f	jepsen connects to vagrant vms	2023-10-18 12:03:11 +02:00
Alex Auvolat	17ebb65273	jepsen ssh into containers seem to work ?	2023-10-18 12:03:11 +02:00
Alex Auvolat	7011b71fbd	jepsen: wip	2023-10-18 12:03:11 +02:00
Alex	a5e8ffeb63	Merge pull request 'use mold linker when invoking cargo manually (not in nix build scripts)' (#646 ) from mold-linker into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/646	2023-10-18 10:02:34 +00:00
Alex	b53510c5b7	Merge pull request 'fix compilation on macos' (#654 ) from trinity-1686a/garage:fix-macos-compilation into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/654	2023-10-16 09:33:33 +00:00
trinity-1686a	c7f5dcd953	fix compilation on macos fsblkcnt_t is ony 32b there, so we have to do an additional cast	2023-10-15 17:57:27 +02:00
Alex	d8263fdf92	Merge pull request 'documentation updates for v0.9.0' (#647 ) from doc-updates into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/647	2023-10-11 12:57:37 +00:00
Alex Auvolat	d24aaba697	doc: update quick start and real world for v0.9.0	2023-10-11 14:49:54 +02:00
Alex Auvolat	b571dcd811	doc: updates to the "migrating to v0.9" page	2023-10-10 15:43:26 +02:00
Alex	e6df7089a1	Merge pull request 'Garage v0.9' (#473 ) from next into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/473	2023-10-10 13:28:28 +00:00
Alex Auvolat	952c9570c4	bump version to v0.9.0	2023-10-10 14:08:11 +02:00
Alex Auvolat	3d7892477d	convert_db: fix build	2023-10-10 14:06:25 +02:00
Alex Auvolat	d4932c31ea	Merge branch 'main' into next	2023-10-10 13:57:21 +02:00
Alex Auvolat	d3fffd30dc	use mold linker when invoking cargo manually (not in nix build scripts)	2023-10-10 13:56:48 +02:00
Alex	e75fe2157d	Merge pull request 'Move convert_db command into main garage binary' (#645 ) from convert-db-main-binary into main Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/645	2023-10-10 11:42:14 +00:00
Alex Auvolat	2d5d7a7031	Move convert_db command into main garage binary	2023-10-10 12:13:15 +02:00
Lapineige	47e7f9e122	another typo	2023-08-19 20:29:24 +00:00
Lapineige	5ffcdb4634	fix typo	2023-08-19 15:17:51 +00:00