Ostra
Ostra is a self-hosted, S3-compatible object storage platform in the spirit of Cloudflare R2, featuring an admin dashboard and per-bucket custom domains.
Ostra is an open-source, self-hosted object storage platform created to deliver the streamlined developer experience of Cloudflare R2 on personal infrastructure. Built to eliminate the complexity and resource overhead of traditional multi-tenant storage systems, it unites Garage as a lightweight S3-compatible engine, Caddy for automatic edge TLS, and a dedicated Go control-plane with a modern React dashboard.
The system operates across three coordinated tiers. Garage handles data replication and low-level S3 endpoints, while Caddy acts as the public reverse proxy for both API traffic and custom bucket domains. A lightweight Go daemon (built with Chi, Goose migrations, and pure-Go SQLite via modernc) provides the REST API, coordinates with the Garage admin API, and answers Caddy’s internal authorization checks.
A hallmark capability is per-bucket custom domains with automated HTTPS. Users can map vanity hostnames (e.g., cdn.domain.com) directly to specific buckets. The control-plane validates ownership via automated DNS checks (CNAME or A/AAAA records plus a unique TXT token), and Caddy uses on-demand TLS to request Let's Encrypt certificates only for domains pre-approved by the control-plane’s webhook.
The web console—crafted with React 19, Vite, TanStack Router, TanStack Query, Tailwind CSS v4, and shadcn/ui—delivers an intuitive management interface. It features an object browser with folder navigation, drag-and-drop chunked uploads with progress tracking, file previews, and temporary signed share links, alongside granular S3 access key generation with per-bucket read, write, or admin permissions.
Designed production-ready by default, Ostra enforces Argon2id password hashing, rotating httpOnly JWT refresh cookies, login rate limiting, strict CSP headers, and non-root scratch containers. It deploys with a single docker compose up, supports zero-downtime integration behind external proxies like Coolify or Traefik, and includes automated scripts for cold backups, disaster recovery, and multi-arch release builds.