fix(minio): migrate to pgsty/minio community fork (upstream is source-only and archived)

MinIO Inc. stopped publishing Docker images and pre-built binaries in
October 2025 and archived the minio/minio repository in February 2026.
The official minio/minio image is frozen at RELEASE.2025-09-07T16-13-09Z
and no longer receives security fixes (the fix for CVE-2025-62506 was
never published as an image).

- Switch image to pgsty/minio:RELEASE.2026-06-18T00-00-00Z, the actively
  maintained community fork (drop-in replacement, AGPLv3, same env vars,
  same /data on-disk format, restores the full web console)
- Route the S3 API (port 9000) through its own generated domain instead
  of publishing host port 9000, per repo conventions
- Update meta.json links/description to point at the maintained fork

Closes #469

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/minio/docker-compose.yml

@@ -1,9 +1,14 @@
 services:
   minio:
-    # after RELEASE.2025-04-22T22-12-26Z, minio removed most of the admin UI, if you want to use the admin UI, uncomment the line below
-    # image: minio/minio:RELEASE.2025-04-22T22-12-26Z
-    # if you uncommented the line above, comment the line below
-    image: minio/minio
+    # MinIO Inc. stopped publishing Docker images and pre-built binaries in October 2025
+    # (https://github.com/minio/minio/issues/21647) and archived the minio/minio repository
+    # in February 2026. The official minio/minio image is frozen at RELEASE.2025-09-07T16-13-09Z
+    # and no longer receives security fixes (e.g. the fix for CVE-2025-62506 was never published
+    # as an image). This template uses pgsty/minio, the actively maintained community fork
+    # (https://github.com/pgsty/minio, AGPLv3). It is a drop-in replacement: same environment
+    # variables, same `server` command, same /data on-disk format (existing minio-data volumes
+    # keep working), and it restores the full web console that upstream removed.
+    image: pgsty/minio:RELEASE.2026-06-18T00-00-00Z
     restart: unless-stopped
     volumes:
       # by default, the MinIO container will use a volume named minio-data
@@ -19,12 +24,10 @@ services:
       - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
       - MINIO_BROWSER_REDIRECT_URL=${MINIO_BROWSER_REDIRECT_URL}
     command: server /data --console-address ":9001"
-    ports:
-      # by default, the MinIO container will use port 9000 to expose its API
-      # and port 9001 to expose its web console
-      # minio requires port to be specified when making a request to the API
-      - 9000:9000
     expose:
+      # port 9000 serves the S3 API (routed through the api domain defined in template.toml)
+      # port 9001 serves the web console (routed through the main domain)
+      - 9000
       - 9001
 
 # comment the line below if you specified a local directory in the volumes section of the minio service

blueprints/minio/meta.json

@@ -1,13 +1,13 @@
 {
   "id": "minio",
   "name": "Minio",
-  "description": "Minio is an open source object storage server compatible with Amazon S3 cloud storage service.",
+  "description": "MinIO is an open source object storage server compatible with Amazon S3 cloud storage service. This template uses pgsty/minio, the actively maintained community fork, because MinIO Inc. stopped publishing Docker images in October 2025 and archived the upstream open source project in February 2026.",
   "logo": "minio.png",
-  "version": "latest",
+  "version": "RELEASE.2026-06-18T00-00-00Z",
   "links": {
-    "github": "https://github.com/minio/minio",
-    "website": "https://minio.io/",
-    "docs": "https://docs.minio.io/"
+    "github": "https://github.com/pgsty/minio",
+    "website": "https://silo.pigsty.io/",
+    "docs": "https://silo.pigsty.io/docs/"
   },
   "tags": [
     "storage"

blueprints/minio/template.toml

@@ -5,11 +5,18 @@ api_domain = "${domain}"
 [config]
 mounts = []
 
+# Web console - log in with the generated root credentials below
 [[config.domains]]
 serviceName = "minio"
 port = 9_001
 host = "${main_domain}"
 
+# S3-compatible API - point AWS CLI / SDKs / rclone / backup tools at this domain
+[[config.domains]]
+serviceName = "minio"
+port = 9_000
+host = "${api_domain}"
+
 [config.env]
 MINIO_ROOT_USER = "minioadmin"
 MINIO_ROOT_PASSWORD = "${password:16}"