Can not edit topics with picture with S3 backend

[dirien (Engin Diri)]

Hi everybody,

we stumbled over a strange issue.

Our setting:

• Discourse: 2.8.0.beta2
• S3: Minio
• CDN: Myra

The S3 is configured:

root@assets-prod-app01:~# sudo -u minio mc admin policy info minio readwrite-discourse
{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:ListBucketMultipartUploads",
    "s3:GetBucketLocation",
    "s3:ListBucket"
   ],
   "Resource": [
    "arn:aws:s3:::discourse"
   ]
  },
  {
   "Effect": "Allow",
   "Action": [
    "s3:*"
   ],
   "Resource": [
    "arn:aws:s3:::discourse/*"
   ]
  }
 ]
}

But we get all the time, when we edit following error message

In the logs files we get

Aws::S3::Errors::NotImplemented (A header you provided implies functionality that is not implemented)
lib/file_store/s3_store.rb:279:in `update_ACL'
lib/file_store/s3_store.rb:209:in `update_upload_ACL'
...

Is there a setting we did not consider, or is Minio not compatible with discourse?

Any hint would be nice, as we get a little bit pressure from our users

Thanks in advance

[dirien (Engin Diri)]

Is this setting so uncommon?

I would appriciate some direction on what to look at in more detail or what to change? @Falco At the moment we are quite stuck…

[Falco]

Did you enable the site setting secure_uploads? That won’t work with MinIO at all.

[dirien (Engin Diri)]

Hi @Falco,

unfortunatly not…

[Falco]

Is the S3 setup configured as the documentation at Using Object Storage for Uploads (S3 & Clones) ?

[dirien (Engin Diri)]

Yepp, really letter for letter

[dirien (Engin Diri)]

Sorry to bother, but could you spot anything?

[dirien (Engin Diri)]

Hi, do you have any ideas? Sorry to bother…

[appcomqa]

Hey,

Today I upgraded to 2.8.0.beta2, same error:

---

just select secure_media, minio work again.

[Falco]

@pmusaraj / @martin looks like a regression caused by

FIX: Update upload secure status when revising posts

which didn’t take into account the same stuff that was fixed by

FIX: Only trigger upload ACL update when needed

So the post_creator does:

discourse/discourse/blob/master/lib/post_creator.rb#L427-L429

and models/post:

discourse/discourse/blob/master/lib/post_revisor.rb#L232

[martin (Martin Brennan)]

There has already been a fix for this that was done for performance reasons but should also fix your problem:

PERF: Update post uploads secure status in a job (#13459)

Though I will make a fix to the job so that it exits early if secure media is disabled.

Actually, I cannot do the above because we want post uploads to be marked not secure if secure media is disabled or if the post has been moved to a different category. Instead I will add a fix to capture the Aws::S3::Errors::NotImplemented error when we run Discourse.store.update_upload_ACL(self). That way clients that do not support the private ACLs should have no problem.

Edit: I merged this fix today, hopefully it will help FIX: Handle storage providers not implementing ACLs by martin-brennan · Pull Request #13675 · discourse/discourse · GitHub. I think we are cutting a new beta next week as well.