Self-Hosted S3 Object Storage with MinIO on VPS: Setup

Cloud Storage Structure
✓ MinIO RELEASE.2026 Verified

Hyperscale cloud storage suppliers impose punishing egress surcharges on each gigabyte transferred to the web. Deploying self-hosted S3 object storage utilizing MinIO on a high-speed Linux VPS eliminates variable information switch charges fully. This technical deployment blueprint covers erasure coding, Bitrot safety, Nginx TLS 1.3 reverse proxying, asynchronous bucket mirroring, Direct I/O kernel tuning, and immutable WORM compliance on an reasonably priced UK VPS internet hosting platform.

📅 Final Technical Audit: September 2026

⚡ Government Abstract: Eliminating Hyperscale Cloud Egress Penalties

Public cloud object storage providers (akin to Amazon S3, Google Cloud Storage, and Azure Blob) provide handy scalability, however their pricing fashions penalize data-intensive functions via punishing outbound information switch (egress) charges. Organizations streaming wealthy media, distributing software program installers, or sustaining large automated database backup archives incessantly uncover that cloud egress charges far exceed the price of uncooked storage capability. MinIO offers a high-performance, Kubernetes-native, S3-compatible object storage server engineered in Go. This technical deployment blueprint explores deploying self-hosted S3 object storage utilizing MinIO on a Linux VPS, configuring erasure coding bitrot safety, enabling TLS encryption, managing IAM entry keys, and slashing egress prices to zero.

# Obtain and set up MinIO binary
wget https://dl.min.io/server/minio/launch/linux-amd64/minio
chmod +x minio
sudo mv minio /usr/native/bin/

# Create system person and multi-drive storage mounts
sudo useradd -r -s /bin/false minio-user
sudo mkdir -p /mnt/minio-storage/{data1,data2,data3,data4}
sudo chown -R minio-user:minio-user /mnt/minio-storage

MINIO_VOLUMES="/mnt/minio-storage/data1 /mnt/minio-storage/data2 /mnt/minio-storage/data3 /mnt/minio-storage/data4"
MINIO_OPTS="--address 127.0.0.1:9000 --console-address 127.0.0.1:9001"
MINIO_ROOT_USER="minio_admin"
MINIO_ROOT_PASSWORD="SuperSecretMasterPassword123!"
MINIO_BROWSER_REDIRECT_URL="https://minio-console.instance.co.uk"
MINIO_SERVER_URL="https://s3.instance.co.uk"

[Unit]
Description=MinIO Excessive-Efficiency Object Storage
Documentation=https://docs.min.io
Needs=network-online.goal
After=network-online.goal

[Service]
WorkingDirectory=/usr/native/
Person=minio-user
Group=minio-user
ProtectProc=invisible
EnvironmentFile=/and many others/default/minio
ExecStart=/usr/native/bin/minio server $MINIO_OPTS $MINIO_VOLUMES
Restart=all the time
LimitNOFILE=65536
TasksMax=infinity
TimeoutStopSec=infinity
SendSIGKILL=no

[Install]
WantedBy=multi-user.goal

# S3 API Endpoint (Publicly Accessible)
server {
    pay attention 443 ssl http2;
    server_name s3.instance.co.uk;

    ssl_certificate /and many others/letsencrypt/dwell/s3.instance.co.uk/fullchain.pem;
    ssl_certificate_key /and many others/letsencrypt/dwell/s3.instance.co.uk/privkey.pem;

    client_max_body_size 0; # Disable buffer measurement limits for giant multipart uploads
    proxy_buffering off;
    proxy_request_buffering off;

    location / {
        proxy_pass http://127.0.0.1:9000;
        proxy_set_header Host $http_host;
        proxy_set_header X-Actual-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
    }
}

# MinIO Administrative Net Console (VPN Restricted)
server {
    pay attention 443 ssl http2;
    server_name minio-console.instance.co.uk;

    ssl_certificate /and many others/letsencrypt/dwell/minio-console.instance.co.uk/fullchain.pem;
    ssl_certificate_key /and many others/letsencrypt/dwell/minio-console.instance.co.uk/privkey.pem;

    # Limit console entry strictly to company VPN subnet
    permit 10.50.0.0/16;
    deny all;

    location / {
        proxy_pass http://127.0.0.1:9001;
        proxy_set_header Host $http_host;
        proxy_set_header Improve $http_upgrade;
        proxy_set_header Connection "improve";
        proxy_http_version 1.1;
    }
}

# Configure native and offsite MinIO clusters
mc alias set local-s3 https://s3.instance.co.uk minio_app_key SecretAppKey123!
mc alias set offsite-s3 https://dr-s3.instance.co.uk minio_dr_key SecretDrKey456!

# Execute steady asynchronous mirror
mc mirror --watch --remove local-s3/media-assets offsite-s3/media-assets-backup

# Mount high-performance NVMe storage with noatime and discard
UUID=xxxx-xxxx /mnt/minio-storage/data1 xfs noatime,nodiratime,logbufs=8,logbsize=256k 0 2

# Maximize socket buffer queues for 10GbE S3 streaming
web.core.rmem_max = 67108864
web.core.wmem_max = 67108864
web.ipv4.tcp_rmem = 4096 87380 33554432
web.ipv4.tcp_wmem = 4096 65536 33554432
web.core.somaxconn = 65535
web.ipv4.tcp_max_syn_backlog = 32768

# Configure exterior webhook endpoint in MinIO
mc occasion add local-s3/user-uploads arn:minio:sqs::webhook_queue:webhook 
    --event put --suffix .jpg

# Goal configuration in MinIO setting
export MINIO_NOTIFY_WEBHOOK_ENABLE_webhook_queue="on"
export MINIO_NOTIFY_WEBHOOK_ENDPOINT_webhook_queue="https://api.instance.co.uk/webhooks/s3-image-process"
export MINIO_NOTIFY_WEBHOOK_AUTH_TOKEN_webhook_queue="SecretWebhookToken123!"

# Allow versioning on safe bucket
mc model allow local-s3/financial-audits

# Configure Object Lock in COMPLIANCE mode for 7 years (2555 days)
mc retention set --default COMPLIANCE 2555d local-s3/financial-audits

# Mechanically expire short-term debug logs after 90 days
mc ilm rule add --expire-days 90 local-s3/application-logs

# Run combined learn/write warp benchmark utilizing 16 concurrent shopper staff
warp combined --host=127.0.0.1:9000 --access-key=minio_admin --secret-key=SuperSecretMasterPassword123! 
    --duration=1m --concurrent=16 --obj.measurement=4MiB

# Configure encrypted rclone distant for MinIO
rclone config create s3-archive s3 env_auth=false 
    access_key_id=minio_admin secret_access_key=SuperSecretMasterPassword123! 
    endpoint=https://s3.instance.co.uk

# Sync utility buckets with client-side encryption
rclone sync s3-archive:media-assets /mnt/cold-storage/archives/ --transfers 8 --checkers 16

# Allow automated bucket encryption for all incoming uploads
mc encrypt set sse-kms my-kms-key local-s3/financial-audits