S3 Object Storage in Estonia — StorageVault

terraform {
  backend "s3" {
    bucket = "my-tfstate"
    key    = "production/terraform.tfstate"

    endpoint = "https://s3.pilw.io"
    region   = "eu-west-1"  # required by Terraform, any string works

    # Required for non-AWS S3-compatible providers:
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    skip_requesting_account_id  = true
    skip_s3_checksum            = true
    force_path_style            = true
  }
}

# Terraform >= 1.11.2 checksum workaround:
# export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
# export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required

Outcome: Terraform state lives in Estonia, the team can collaborate, and state locking prevents conflicts.

# GitHub Actions schedule → Google API → JSON → StorageVault → site
curl -s "https://api.example.com/data" \
  | aws s3 cp - s3://site-cache/data.json \
      --endpoint-url https://s3.pilw.io

Outcome: The site loads fast (data is already prepared), no API call is made on every page load, and rate limits are a non-issue.

# GitHub Actions: upload build artifact
aws s3 cp ./dist/app.tar.gz s3://builds/app-${GITHUB_SHA}.tar.gz \
  --endpoint-url https://s3.pilw.io

# Deploy: pull artifact on production VM
ssh production "aws s3 cp s3://builds/app-${GITHUB_SHA}.tar.gz /tmp/ \
  --endpoint-url https://s3.pilw.io && tar xzf /tmp/app-*.tar.gz -C /opt/app"

# Nightly database dump to StorageVault
pg_dump mydb | gzip | aws s3 cp - \
  s3://backups/db-$(date +%Y%m%d).sql.gz \
  --endpoint-url https://s3.pilw.io

# Sync web files
rclone sync /var/www/html storagevault:website-backup/

Outcome: Off-server backups on a schedule, no separate backup service required.

import boto3

s3 = boto3.client('s3',
    endpoint_url='https://s3.pilw.io',
    aws_access_key_id='YOUR_KEY',
    aws_secret_access_key='YOUR_SECRET'
)

s3.upload_file('photo.jpg', 'media-bucket', 'images/photo.jpg')

# Signed URL (valid 1 h)
url = s3.generate_presigned_url('get_object',
    Params={'Bucket': 'media-bucket', 'Key': 'images/photo.jpg'},
    ExpiresIn=3600
)

# Hugo build + deploy
hugo --minify
aws s3 sync ./public/ s3://my-website/ \
  --endpoint-url https://s3.pilw.io \
  --delete

# .github/workflows/sync-to-s3.yml
name: Sync content to StorageVault
on:
  push:
    branches: [main]
    paths: ['content/**']

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Sync to StorageVault
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.SV_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.SV_SECRET_KEY }}
        run: |
          aws s3 sync ./content/ s3://site-content/ \
            --endpoint-url https://s3.pilw.io \
            --delete