4. Save exports in object storage

Keep notes in the database and move newly generated JSON exports into a private bucket. The web app streams downloads from S3; browser code never receives bucket credentials.

1. Create the bucket

Dashboard: in go add Object Storage, name notes-exports, tier Capacity, quota 1 GB. Leave it private and wait until provisioned. Capacity is suitable here because exports can be recreated from notes. Use High availability for irreplaceable files.

CLI:

paas buckets create notes-exports --tier capacity --quota-gb 1 -o "$TUTORIAL_ORG" -p examples -e go
paas buckets info -a notes-exports -o "$TUTORIAL_ORG" -p examples -e go

Wait for available: true; keep public: false.

2. Attach the bucket to both apps

Dashboard: open each app’s Config tab, choose bucket notes-exports in the attachment card, leave the credential prefix blank, and click Attach.

CLI:

paas apps attach notes-web notes-exports -o "$TUTORIAL_ORG" -p examples -e go
paas apps attach notes-worker notes-exports -o "$TUTORIAL_ORG" -p examples -e go
paas apps attachments notes-web -o "$TUTORIAL_ORG" -p examples -e go
paas apps attachments notes-worker -o "$TUTORIAL_ORG" -p examples -e go

The primary attachment injects S3_ENDPOINT, S3_BUCKET, S3_REGION, AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY. The storage implementation passes the endpoint and region explicitly and uses path-style S3 requests. Do not add these credentials to frontend code, Git, or ordinary config variables. Wait for both apps to restart with the new attachment before testing.

3. Generate a new export

Open the app and request a new export. Exports made before the bucket attachment still live in Redis, so their old download links no longer work while S3 mode is enabled. Download the new JSON and confirm your note appears.

Dashboard: open notes-exports → Files → exports/. The file named <job-id>.json should be present. CLI:

paas buckets ls exports/ -a notes-exports -o "$TUTORIAL_ORG" -p examples -e go

A direct anonymous object request should return 403; downloading through the app succeeds because its server uses the attachment credentials. The bucket stays private, but the example app itself has no user authentication. Do not enter confidential data.

4. Verify durability and diagnose failures

Restart notes-worker, submit another export, and check that it completes. Restart notes-web and download the completed export again. No result depends on either app’s local filesystem. If a job stays queued, check worker logs, both apps’ attachment lists, and bucket readiness. After fixing a failed S3 write, the unacknowledged job retries after its 30-second idle interval.

Export files and Redis status records have no expiration in this teaching example. Delete unneeded files in the bucket’s Files tab, or clean up the entire isolated Environment when done.

Continue with MariaDB or MongoDB if you want to compare primary stores. Each is optional and starts a separate dataset. Then prepare the app for production or clean up the tutorial resources.