Start Keldra. Upload your first file.Start Keldra. Upload your first file.
Self-hosted object storage, running on your own infrastructure.
Run the server with Docker, use the included CLI to create a private bucket, then upload and download the same file. You do not need a separate CLI download to begin.
Your data. Your infrastructure.
Lens Collector and Grafana datasource
Linux ARM64 and x86-64. Downloads contain no credentials; create your private configuration in your account.
Download the Keldra CLI
Choose your operating system and processor. Standalone packages are shown only when a verified download is available. The Docker image already includes the CLI for Linux ARM64 and x86_64.
0.22.0
Windows
x86_64
Use the Docker image
Windows
ARM64
Use the Docker image
Linux
x86_64
Use the Docker image
Linux
ARM64
Use the Docker image
macOS
x86_64
Use the Docker image
macOS
ARM64
Use the Docker image
Windows
x86_64
Use the Docker image
Windows
ARM64
Use the Docker image
Linux
x86_64
Use the Docker image
Linux
ARM64
Use the Docker image
macOS
x86_64
Use the Docker image
macOS
ARM64
Use the Docker image
Windows
x86_64
Use the Docker image
Windows
ARM64
Use the Docker image
Linux
x86_64
Use the Docker image
Linux
ARM64
Use the Docker image
macOS
x86_64
Use the Docker image
macOS
ARM64
Use the Docker image
Start now with Docker
The commands below run the included CLI inside the server container. On Windows, use WSL with Docker; on macOS, use Docker with your usual terminal.
From a local server to your first file
Follow these steps in order. Each command builds on the previous step; keep the same terminal and working directory.
You need Docker, a POSIX shell, OpenSSL and curl 7.75 or later.
This setup binds the server to localhost and creates a private bucket. Do not expose this development setup directly to the internet. Credentials are kept in owner-only files rather than command arguments.
1
Start Keldra with Docker
Prepare the signing key and data volume, then start the official server image. Wait for startup to finish before provisioning your tenant.
export KELDRA_IMAGE=ghcr.io/keldra-store/keldra:0.22.0
umask 077
mkdir -p keldra-data
head -c 64 /dev/urandom > keldra-data/token-signing-key
chmod 0600 keldra-data/token-signing-key
docker run --rm --user 0 \
-v "$PWD/keldra-data/token-signing-key:/key" \
"$KELDRA_IMAGE" chown 10001:10001 /key
docker volume create keldra-demo-data
docker run --rm --user 0 -v keldra-demo-data:/var/lib/keldra \
"$KELDRA_IMAGE" chown 10001:10001 /var/lib/keldra
docker run -d --name keldra-demo \
-p 127.0.0.1:50051:50051 \
-v keldra-demo-data:/var/lib/keldra \
-v "$PWD/keldra-data/token-signing-key:/run/secrets/keldra-token-signing-key:ro" \
-e KELDRA_RUN_SYSTEM_BOOTSTRAP=true "$KELDRA_IMAGE"
docker logs keldra-demo
2
Create your tenant and private bucket
Use the CLI inside the container. Save the administrator credential securely; your application's client secret is separate. Buckets start private and unversioned.
openssl rand -hex 32 | tr -d '\n' > keldra-data/owner.secret
docker cp keldra-data/owner.secret keldra-demo:/tmp/owner.secret
docker exec --user 0 keldra-demo chown 10001:10001 /tmp/owner.secret
docker exec keldra-demo keldra --endpoint http://127.0.0.1:50051 \
--credentials-file /var/lib/keldra/system-bootstrap-credential.json \
provision-tenant example example-owner example-client \
--owner-client-secret-file /tmp/owner.secret
docker cp keldra-demo:/var/lib/keldra/system-bootstrap-credential.json \
keldra-data/system-bootstrap-credential.json
chmod 0600 keldra-data/system-bootstrap-credential.json
docker exec --user 0 keldra-demo rm /var/lib/keldra/system-bootstrap-credential.json
docker exec -e KELDRA_CLIENT_ID=example-client keldra-demo \
keldra --endpoint http://127.0.0.1:50051 \
--client-secret-file /tmp/owner.secret create-bucket objects
3
Upload your first file with the CLI
Create a small text file and upload it to greetings/hello.txt in your objects bucket.
printf 'hello from Keldra\n' > keldra-data/hello.txt
docker cp keldra-data/hello.txt keldra-demo:/tmp/hello.txt
docker exec --user 0 keldra-demo chown 10001:10001 /tmp/hello.txt
docker exec -e KELDRA_CLIENT_ID=example-client keldra-demo \
keldra --endpoint http://127.0.0.1:50051 \
--client-secret-file /tmp/owner.secret \
put example objects greetings/hello.txt /tmp/hello.txt \
--content-type text/plain --command-id first-upload
4
Download the file with curl
Sign the request with your application's credentials using curl's AWS Signature Version 4 support. The bucket remains private.
printf 'user = "example-client:%s"\n' "$(cat keldra-data/owner.secret)" \
> keldra-data/curl.credentials
chmod 0600 keldra-data/curl.credentials
curl --fail --show-error --config keldra-data/curl.credentials \
--aws-sigv4 'aws:amz:eu-west-2:s3' \
http://127.0.0.1:50051/objects/greetings/hello.txt \
--output keldra-data/downloaded.txt
5
Compare the uploaded and downloaded files
No output means the downloaded bytes match the original file.
cmp keldra-data/hello.txt keldra-data/downloaded.txt
6
Restart without bootstrap enabled
Bootstrap is for initial provisioning only. Restart using the same volume and signing key, without the bootstrap flag. Your uploaded file remains in the volume.
docker stop keldra-demo
docker rm keldra-demo
docker run -d --name keldra-demo \
-p 127.0.0.1:50051:50051 \
-v keldra-demo-data:/var/lib/keldra \
-v "$PWD/keldra-data/token-signing-key:/run/secrets/keldra-token-signing-key:ro" \
"$KELDRA_IMAGE"
Keep building on your own infrastructure
Use the local setup to explore object storage and indexing. Create an account when you need a development or production licence. Do not delete a running installation's data volume when upgrading.