By default, Funkwhale stores all media data in the `/srv/funkwhale/data/media` directory. If you prefer to use an S3-compatible object store, follow the instructions in this guide.
```{contents}
:local:
:depth: 1
```
## Secure your object store
Before you begin, you need to secure your object store. Many S3-compatible stores list contents in the root by default. This exposes the URLs of your audio files and means that users can bypass authentication.
To prevent listing content, add the following policy to your S3-compatible object store.
```{code} json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Resource": [
"arn:aws:s3:::<yourbucketname>/*"
],
"Sid": "Public"
}
]
}
```
If you're using `awscli`, you can store this policy in a `/tmp/policy` file and apply it using the following command:
To set up S3-compatible storage, fill out the relevant details in the `.env` file. If you want to serve audio files from the bucket, set `PROXY_MEDIA` to `false`.
6. Restart Funkwhale and Nginx to pick up the changes.
````{tabbed} Debian
```{code} bash
sudo systemctl restart funkwhale.target
sudo systemctl restart nginx
```
````
````{tabbed} Docker
```{code} bash
docker-compose restart
sudo systemctl restart nginx
```
````
That's it! Files are now uploaded to and stored from your S3 bucket.
## Troubleshooting
````{dropdown} No Resolver Found
You may see the following error when streaming music from your S3-compatible store:
```{code}
[error] 2832#2832: *1 no resolver defined to resolve [address] client: [IP], server: [servername], request: "GET API request", host: "[your_domain]", referrer: "[your_domain/library]"
```
This happens when the Nginx config is unable to use your server’s DNS resolver. We're still looking into this issue. You can work around this by adding a resolver to the `location ~/_protected/media/(.+)` block.