picos3: a tiny S3 you can actually own
I've been building an iPhone photo backup app (not released yet), and sooner or later it needs somewhere to put the photos. The obvious answer is S3-compatible object storage. Cloudflare R2, Backblaze B2, that whole category. Cheap, reliable, done.
Except... I have a tonne of storage sitting right here. And my server backups already go offsite, flat rate, whether I use it or not. So if the photos land on my box first, they ride along to offsite for free, and I get an extra layer of safety out of the deal. The only missing piece was the S3 endpoint in the middle.
So I made one.
picos3, a tiny single-bucket S3-compatible object store
One Go binary, stdlib only, one bucket per process. Objects land on disk as plain files at their key paths, so you can browse them with ls. No clustering, no syncing, no policy engine, no web console. It's a drop-in S3 endpoint and nothing else. Tested against rclone, the AWS SDKs' signing modes, and my own app.
The bits that make it a good backup target
- Read-only credentials alongside the read-write pair, so restore tools never hold a key that can delete
- Append-only mode. A leaked key can add data, but it can never destroy what's already there
- Or a retention window, if you want normal S3 semantics: deletes and overwrites park the old version in a browsable trash/ tree for N days
- A size cap that counts real disk usage, trash included
- Periodic scrubbing that re-reads every object and checks its checksum. Cheap bit-rot detection for stuff you plan to keep for years
- TLS three ways: your own certs, automatic Let's Encrypt, or Tailscale node certs pulled from the local tailscaled the way Caddy does it
That last one is my favourite. On a host already running Tailscale, this is the whole deployment:
picos3 --tailscale-tls --data /srv/photos
Real TLS that strict clients trust, reachable only from the tailnet. No ports open to the internet, no reverse proxy, no certs to babysit.
Deliberately small
It's not MinIO. One bucket, one key, no ACLs, no S3-level versioning. If you want an industrial object store, go get one. This is for when you just need something sensible on the other end of an S3 client.
MIT licensed. Homebrew, Docker, or go install.
---
Viewed 282 times (last updated 2026-07-23 · r2)