Connecting¶
Click New Connection at the top of the Connections sidebar and choose S3 Object Storage, or run New Object Storage Connection from the command palette. Object Storage Connections in the palette lists every saved connection, with buttons to open, edit, duplicate and delete each one.
The form¶
| Field | What goes in it |
|---|---|
| Name | What the sidebar and the tab show. |
| Provider | A preset that fills in the endpoint and region. Leave it on Custom for anything not listed. |
| Endpoint URL | Where the store answers, starting with https:// (or http:// — see below). |
| Region | The region requests are signed for. For AWS it must be the bucket's region; many other stores accept anything, and R2 wants auto. |
| Access key / Secret key | The key pair from your provider. |
| Default bucket | Optional. The tab opens inside this bucket instead of at the list of buckets. |
| Group, Tab color | As for SSH connections. |
| Addressing | Whether the bucket goes in the path or the host name. Automatic suits almost every store. |
Test Connection makes one request with what is in the form and says what came back, without saving anything.
The access key ID is stored in Cleat's connection database. The secret key is not: it goes to the operating system's credential store (Keychain, Credential Manager, Secret Service), the same place SSH passwords are kept.
A key that can only see one bucket
A key scoped to a single bucket is usually refused when it asks for the list of buckets. Set Default bucket and the tab starts inside it; the list is never asked for.
Presets¶
Linode (Atlanta, Newark, Chicago, Frankfurt, Singapore), AWS S3 (us-east-1, us-west-2), DigitalOcean Spaces (NYC3, SFO3), Backblaze B2 (us-west-004), Cloudflare R2 and a local MinIO.
A preset is a starting point. A provider's other regions are an edit of the host name
and the region away — a Linode bucket in us-ord-10 uses
https://us-ord-10.linodeobjects.com with region us-ord-10. The R2 preset contains
<account_id>, which the form asks you to replace with your own.
If a bucket turns out to be in a different region from the one you entered and the store says which, Cleat retries there by itself.
Importing from lolrus¶
If you used lolrus, Import → lolrus Connections in the Connections sidebar (or Import lolrus Connections in the command palette) lists the connections it saved. Tick the ones you want and import them.
lolrus keeps each connection's access key and secret key in the system credential store, and Cleat reads them from there for the connections you import. On macOS you are asked for permission, once for each key; Always Allow stops it asking again.
A connection whose keys cannot be read is still imported, and Cleat tells you which. Edit it to enter them. Connections already in Cleat under the same name and endpoint are marked Duplicate and left unticked.
lolrus saved every connection with the region us-east-1 unless you changed it. Where
the endpoint's host name says otherwise — us-ord-10.linodeobjects.com, for example —
the import uses the host's region.
Nothing of lolrus's is changed or removed.
TLS options¶
These are under Security and are for self-hosted stores. A public provider needs neither.
- Custom CA bundle (PEM file) — the path to a PEM file holding the certificate authority that signed your store's certificate. Use this for a store behind a private CA. Certificates are still verified, against your bundle.
- Verify the store's TLS certificate — on by default. Turning it off accepts any certificate, including one presented by something between you and the store. Prefer the CA bundle; turn verification off only for a test instance on a network you trust.
An endpoint starting with http:// is allowed, for a local MinIO for instance, and is
marked not encrypted in the connection list: your keys' signatures and everything you
transfer cross the network in the clear.