Schema for storage provider configurations.

Buckets represent storage locations where files can be stored. They can be:

• Local filesystem storage
• AWS S3 buckets
• Backblaze B2 buckets
• Cloudflare R2 buckets
• Tigris buckets

Priority (legacy)

Where new files go is decided by the storage profile, which has an upload order (write_priority) per bucket. A bucket's own priority is no longer shown or edited in the admin and is not copied into any profile. It is read only by the pre-profile selection (Manager.store_file/2 with :redundancy_copies / :priority_buckets, or a database with no profiles) and to order the buckets a read falls back to when a file has no recorded location:

• priority = 0 (default): the pool, in random order when writing
• priority > 0: a fixed position (1 = first, 2 = second, etc.)

Fields

• name - Display name for the bucket
• provider - Storage provider: "local", "s3", "b2", "r2", "tigris"
• region - AWS region or equivalent (nullable)
• endpoint - Custom S3-compatible endpoint (nullable)
• bucket_name - S3 bucket name (nullable)
• access_key_id - Credentials identifier (nullable, stored as-is — not a secret)
• secret_access_key - Encrypted at rest via PhoenixKit.Integrations.Encryption (nullable); decrypted only at the point of use (e.g. Providers.S3's AWS config builder), never by a general accessor like Storage.get_bucket/1. A value already in this column when encryption was added is migrated opportunistically, not by a bulk backfill: the changeset re-derives and re-encrypts it on the next save of the bucket for ANY reason (see encrypt_secret_access_key/1), so it stays plaintext only until then
• integration_uuid - Alternative credential source: a PhoenixKit.Integrations connection uuid (nullable, no FK). Mutually exclusive with access_key_id/secret_access_key — a changeset may set one source or the other, never both
• cdn_url - CDN endpoint for file serving (nullable)
• access_type - How files are served: "public", "private", "signed" (default: "public")
• enabled - Whether bucket is active
• priority - Legacy selection priority (0 = random); see above
• max_size_mb - Maximum storage capacity in MB (nullable = unlimited)
• owner_uuid - Whose bucket it is (V206). NULL is the site's, which is every bucket an admin creates. A user's own bucket carries its owner, never appears in a site listing (Storage.list_buckets/0, Storage.list_enabled_buckets/0), cannot be local, and takes its keys from the owner's personal connection only. Never cast from params: only owned_changeset/3 sets it, from the signed-in user. No foreign key (see Migrations.Postgres.V206).

Access Types

• public - Redirect to public URL (default, fastest, uses CDN)
• private - Proxy files through server (for ACL-protected buckets)
• signed - Redirect to a presigned URL made for each request (5 minutes); proxied when the provider cannot sign. The plain object URL is never handed out

Examples

# Local storage bucket
%Bucket{
  name: "Local SSD",
  provider: "local",
  enabled: true,
  priority: 0,
  max_size_mb: 512_000  # 500 GB
}

# AWS S3 bucket
%Bucket{
  name: "Production S3",
  provider: "s3",
  region: "us-east-1",
  bucket_name: "my-app-files",
  access_key_id: "AKIA...",
  secret_access_key: "...",
  cdn_url: "https://cdn.example.com",
  enabled: true,
  priority: 1  # Highest priority
}

# Backblaze B2 bucket
%Bucket{
  name: "Backup B2",
  provider: "b2",
  endpoint: "s3.us-west-002.backblazeb2.com",
  bucket_name: "my-backup-bucket",
  access_key_id: "...",
  secret_access_key: "...",
  enabled: true,
  priority: 2
}