wolfdisk v2.10.1: configurable S3 region for the gateway (klasSponsor)

The S3-compatible gateway hardcoded its region to us-east-1, returned in
the GetBucketLocation LocationConstraint. Some S3 clients and services
validate the bucket region and refuse to proceed unless it matches their
own configured region, so the region must be settable.

- New [s3] region config key, #[serde(default)] -> us-east-1 so existing
  configs upgrade cleanly (Golden Rule). Threaded through to S3State.
- GetBucketLocation now mirrors the AWS spec: an EMPTY LocationConstraint
  for us-east-1 (the historical default's special case), the region name
  otherwise. SigV4 auth is unaffected (it verifies against the client's
  own signed region, not the server's).
- 3 config tests cover default, legacy-without-region, and explicit.

Author: Paul C

wolfdisk/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "wolfdisk"
-version = "2.10.0"
+version = "2.10.1"
 edition = "2021"
 authors = ["Wolf Software Systems Ltd"]
 description = "Distributed file system with replicated and shared storage modes"

wolfdisk/Cargo.toml

@@ -216,6 +216,15 @@ pub struct S3Config {
     /// Optional secret key for authentication
     pub secret_key: Option<String>,
 
+    /// AWS region this gateway reports for the bucket (the value returned in
+    /// the GetBucketLocation `LocationConstraint`). SigV4 signatures are
+    /// verified against whatever region the client signed with, so this does
+    /// not affect authentication — but some S3 clients/services validate the
+    /// bucket's region and refuse to proceed unless it matches their own
+    /// configured region. Defaults to `us-east-1` (the historical behaviour).
+    #[serde(default = "default_s3_region")]
+    pub region: String,
+
     /// Optional bucket → folder mappings, relative to the WolfDisk root.
     /// A bucket listed here serves the given folder instead of a same-named
     /// top-level directory, e.g. in `[s3.buckets]`:
@@ -235,6 +244,7 @@ impl Default for S3Config {
             bind: default_s3_bind(),
             access_key: None,
             secret_key: None,
+            region: default_s3_region(),
             buckets: std::collections::HashMap::new(),
         }
     }
@@ -257,6 +267,10 @@ fn default_s3_bind() -> String {
     "0.0.0.0:9878".to_string()
 }
 
+fn default_s3_region() -> String {
+    "us-east-1".to_string()
+}
+
 impl Default for Config {
     fn default() -> Self {
         Self {
@@ -396,3 +410,29 @@ fn copy_dir_files(src: &Path, dst: &Path) -> std::io::Result<()> {
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn s3_config_default_region_is_us_east_1() {
+        assert_eq!(S3Config::default().region, "us-east-1");
+    }
+
+    #[test]
+    fn s3_config_without_region_defaults_for_existing_installs() {
+        // Golden Rule: an existing [s3] config written before the region field
+        // existed must still deserialize, falling back to us-east-1.
+        let s3: S3Config = toml::from_str("enabled = true\nbind = \"0.0.0.0:9878\"\n")
+            .expect("legacy s3 config without region should parse");
+        assert_eq!(s3.region, "us-east-1");
+    }
+
+    #[test]
+    fn s3_config_honours_explicit_region() {
+        let s3: S3Config = toml::from_str("enabled = true\nregion = \"eu-west-1\"\n")
+            .expect("s3 config with region should parse");
+        assert_eq!(s3.region, "eu-west-1");
+    }
+}

wolfdisk/src/config.rs

@@ -2332,6 +2332,7 @@ fn main() {
                 let s3_next_inode = next_inode.clone();
                 let s3_bind = config.s3.bind.clone();
                 let s3_credentials = config.s3.credentials();
+                let s3_region = config.s3.region.clone();
                 let s3_meta_path = wolfdisk::s3::meta::meta_path(&config.index_dir());
                 let s3_buckets = config.s3.buckets.clone();
 
@@ -2350,6 +2351,7 @@ fn main() {
                             s3_inode_table,
                             s3_next_inode,
                             s3_credentials,
+                            s3_region,
                             s3_meta_path,
                             s3_buckets,
                         );

wolfdisk/src/main.rs

@@ -83,17 +83,25 @@ impl S3Server {
         inode_table: Arc<RwLock<InodeTable>>,
         next_inode: Arc<RwLock<u64>>,
         credentials: Option<S3Credentials>,
+        region: String,
         meta_path: PathBuf,
         bucket_mappings: HashMap<String, String>,
     ) -> Self {
         let meta = S3MetaStore::load(&meta_path);
+        // An empty region in the config falls back to the historical default so
+        // GetBucketLocation never returns a blank LocationConstraint.
+        let region = if region.trim().is_empty() {
+            "us-east-1".to_string()
+        } else {
+            region
+        };
         let state = S3State {
             file_index,
             chunk_store,
             inode_table,
             next_inode,
             credentials,
-            region: "us-east-1".to_string(),
+            region,
             multipart: Arc::new(RwLock::new(HashMap::new())),
             meta: Arc::new(RwLock::new(meta)),
             meta_path,
@@ -336,10 +344,19 @@ async fn list_buckets(state: S3State) -> Response {
 
 /// GET /bucket?location → GetBucketLocation
 async fn get_bucket_location(state: S3State) -> Response {
+    // AWS reports us-east-1 buckets with an EMPTY LocationConstraint (the
+    // historical default region's special case); every other region returns
+    // its own name. Strict AWS SDKs validate the bucket region against this,
+    // so mirror the spec exactly rather than emitting the literal "us-east-1".
+    let body = if state.region == "us-east-1" {
+        String::new()
+    } else {
+        xml_escape(&state.region)
+    };
     let xml = format!(
         "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\
          <LocationConstraint xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">{}</LocationConstraint>",
-        state.region
+        body
     );
     (
         StatusCode::OK,