S3

You are able to add your preferred S3 provider, like AWS, DigitalOcean, Exoscale or Infomaniak. However, if you don't want to store your files on a S3 bucket, you don't have to. Consider that this feature is DISABLED per default.

Configuration

You can configure your S3 provider and bucket by going to the configuration page in your admin dashboard /admin/config/s3.

Key	Description	Value
enabled	This property enables the storage location on your configured S3 bucket.	true
endpoint	The host for your S3 bucket. Endpoint formats vary by provider and some may include the bucket name in the FQDN. Ensure this is configured correctly, as an incorrect value may break some features.	sos-ch-dk-2.exo.io
region	This property is the region where the bucket is located.	sos-ch-dk-2
bucketName	This property is the name of your S3 bucket.	my-bucket
bucketPath	This property defines the folder where you want to store your files which are uploaded. Hint: Don't put a slash in the start or end.	my/custom/path (or leave it empty for root)
key	This is the access key you need to access to your bucket.	key-asdf
secret	This is the secret you need to access to your bucket.	secret-asdf

Don't forget to save the configuration. :)

ClamAV

When S3 is used in conjunction with ClamAV, the file is first uploaded to the S3 bucket, then streamed by the backend server, scanned by ClamAV and actioned. This can lead to increased scanning times, especially for larger files, due to the additional steps. If you are experiencing slow scanning times, consider disabling S3 or ClamAV.

ZIP

Creating ZIP archives is supported when using S3 as a storage provider. Files will be fetched by the backend, zipped, then served to the user.

CORS Configuration

Since S3 uploads and downloads are performed directly between the client's browser and the S3 bucket (using short-lived pre-signed URLs), your S3 bucket must be configured with a Cross-Origin Resource Sharing (CORS) policy. Without this, file transfers will fail immediately due to browser security restrictions.

Add the following CORS configuration policy to your S3 bucket (replace https://your-pingvin-share-domain.com with the actual URL and port you use to access your app):

[
  {
    "AllowedHeaders": ["Content-Type"],
    "AllowedMethods": ["GET", "PUT", "HEAD"],
    "AllowedOrigins": ["https://your-pingvin-share-domain.com"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3000
  }
]

Key Rules

• AllowedOrigins: Must match the exact URL (scheme, domain, and port) you use to access Pingvin Share in your browser (e.g., http://100.116.239.35:3001 or https://share.example.com).
• AllowedMethods: Must include PUT (for uploading file chunks), GET (for downloads/previews), and HEAD (for checking file existence and size).
• ExposeHeaders: Must explicitly expose ETag. The frontend reads the ETag header from S3 responses to complete the upload.