Self-hosted S3-compatible object storage in Go: single binary with web console and CLI, erasure coding, clustering, IAM, presigned URLs, CloudFront-style custom domains with caching. A MinIO alternative under AGPL-3.0.
Go
3
72 commits
updated Oct 18, 2026
English | Italiano
Nexo is an object store compatible with the Amazon S3 API, written in Go. A single binary
(nexo) contains the S3 server, the Admin API and the web console; nexoctl is the CLI for data and
administration. The same binary runs on one drive, on multiple drives with erasure coding and as a
multi-node cluster, with no external metadata database.
Sign in, a versioned bucket, an upload, a preview and a share link in the web console (recorded with make demo-gif).
s3-tests suite and the 638 of MinIO's mint SDK suites, on single drive, multiple drives and
cluster.Coming from MinIO? Follow the migration guide (every version, policies
and users, verified with nexoctl diff). Choosing a store? See how Nexo compares
with MinIO, SeaweedFS, Garage and Ceph RGW, including where another project fits better.
The overview of the web console (shown in dark mode when your browser prefers it). The images are
taken from a demo deployment with make screenshots; drive capacity is shown as 4 × 1 TiB for illustration.
 Object browser: folders, uploads, versions, previews and share links |
 Bucket lifecycle: expiration, noncurrent versions and incomplete uploads |
 IAM policy editor: AWS policy JSON with completion, validation and a visual builder |
 Access rules: allow and deny by prefix, glob or regex, with conditions |
 Distributions: buckets served on custom domains, with TLS and traffic |
 Distribution cache: hit ratio, bandwidth saved and top domains |
 Monitoring: requests, errors, latency and bandwidth of every node |
 Cluster: pools, erasure sets, nodes and drives at a glance |
 Users: IAM users with their policies and groups |
 Sign in: the console uses the same access keys as the S3 API |
With Docker:
docker run -d --name nexo -p 9000:9000 -p 9001:9001 \
-e NEXO_ROOT_USER=admin -e NEXO_ROOT_PASSWORD=supersecret \
-v nexo-data:/data paolor/nexo:latest server /data
The images are on Docker Hub: paolor/nexo (server and CLI) and
paolor/nexoctl (CLI only).
With the binary (releases or make build):
export NEXO_ROOT_USER=admin NEXO_ROOT_PASSWORD=supersecret
nexo server ~/nexo-data # absolute path; multiple drives: nexo server /mnt/disk{1...4}
Then open the console at http://localhost:9001 (user admin, password supersecret) or use the CLI:
nexoctl alias set local http://localhost:9000 admin supersecret
nexoctl mb local/photos
nexoctl cp hello.txt local/photos/
nexoctl share download --expire 2h local/photos/hello.txt # revocable link
Any S3 client works with the endpoint http://localhost:9000 and the same credentials, for example
aws --endpoint-url http://localhost:9000 s3 ls.
📖 Documentation site: https://r3n3r0.github.io/Nexo/ (Italian: https://r3n3r0.github.io/Nexo/it/), with search, the CLI reference and the Admin API.
The same pages are in docs/user, in English with an Italian translation next to every
page (<page>.it.md; also at https://github.com/R3n3r0/Nexo/tree/main/docs/user, for those reading this file
from a release archive):
| Quickstart | the complete walkthrough in five minutes |
| Installation | binaries, deb/rpm, Homebrew, Docker, Compose, Helm, systemd |
| Deployment modes | single drive, multiple drives, cluster, sizing |
| Configuration | flags, environment variables, dynamic configuration |
| Operations guide | monitoring, healing, upgrades, backup, troubleshooting |
| Security | policies, sharing, access rules, TLS, KMS |
| Distributions and cache | custom domains, with a complete tutorial |
| Reference | CLI, Admin API, S3 compatibility |
make docs-site publishes it as a static site with MkDocs (in bin/site, in English and in Italian under /it/).
| # | Document | Contents |
|---|---|---|
| 1 | Architecture | Components, repository layout, stack, technical choices |
| 2 | Features | Catalog of the server, dashboard and CLI features, differences from S3 |
| 3 | Cluster | Topology, erasure coding, quorum, distributed locks, healing, expansion |
| 4 | API | Supported S3 APIs, Admin API, internode RPC |
| 5 | Roadmap and tasks | Milestones, tasks with IDs, dependencies and acceptance criteria, status |
| 6 | Test plan | Strategy and test cases for server, CLI, dashboard and cluster |
| 7 | Security and operations | Threat model, TLS, KMS, observability |
| 8 | Modes and release | Deployment modes, packaging and release process |
| 9 | Presigned URLs, policies and sharing | Presigned URLs, POST policies, policies, revocable share links |
| 10 | Access, domains and distributions | Access rules, domains, distributions behind proxies |
| 11 | Per-domain cache | Memory/disk cache, per-level policies, invalidation, cluster cache |
| 12 | Service architecture | Binding convention for services, routes and composition in internal/app |
The changes of every release are in the CHANGELOG; the test coverage of every feature in the catalog is in the traceability matrix.
You need Go (the version in go.mod) and, for the console, Node.js.
| Command | What it runs |
|---|---|
make build | React console and the bin/nexo and bin/nexoctl binaries with the console embedded (make build-go: Go only) |
make test / make test-race | Go tests (unit and in-process integration in the three modes) |
make test-integration | S3/IAM/presigned integration suite in every mode, slow tests included |
make test-cluster | cluster tests with 4 real bin/nexo processes (kill, pause, restart) |
make test-s3compat | Ceph s3-tests compatibility suite |
make lint / make web-lint / make web-test / make e2e | Go lint, console lint and tests, Playwright |
make run-cluster | local cluster of 4 processes with S3 on 127.0.0.1:9101, 9103, 9105, 9107 and the console on the next port (Linux) |
make docs / make docs-check | CLI reference in docs/user/cli |
make traceability / make traceability-check | feature → test matrix in test/TRACEABILITY.md |
make security | govulncheck, gosec and npm audit |
make zap-scan | authenticated OWASP ZAP active scan of the Admin API from api/openapi.yaml against bin/nexo (needs Java; test/security/zap-api-scan.sh) |
make screenshots | regenerates the console screenshots in docs/images/screenshots from a seeded demo deployment (Playwright; scripts/screenshots) |
make dco | the sign-off check of the pull requests on the commits of the branch (CONTRIBUTING.md) |
make help | all the targets |
The code follows the convention of docs/12: every service has
an interface and an unexported implementation, and composition happens only in internal/app.
Nexo is free software licensed under the GNU Affero General Public License v3.0 only
(AGPL-3.0-only): if you modify it and let users interact with it over a network, you must offer them the
source code of your version. The NOTICE file adds attribution terms (AGPL section 7(b)): keep it, and
keep "Powered by Nexo (https://github.com/R3n3r0/Nexo)" in the legal notices of the user interface. Organizations
that cannot comply with the AGPL can buy a commercial license from the copyright holder;
contributions are accepted under the terms of CONTRIBUTING.md. Archives, deb/rpm packages,
container images and the Helm chart carry LICENSE (and NOTICE in archives and packages).
Self-hosted S3-compatible object storage in Go: single binary with web console and CLI, erasure coding, clustering, IAM, presigned URLs, CloudFront-style custom domains with caching. A MinIO alternative under AGPL-3.0.
Go
3
72 commits
updated Oct 18, 2026
English | Italiano
Nexo is an object store compatible with the Amazon S3 API, written in Go. A single binary
(nexo) contains the S3 server, the Admin API and the web console; nexoctl is the CLI for data and
administration. The same binary runs on one drive, on multiple drives with erasure coding and as a
multi-node cluster, with no external metadata database.
Sign in, a versioned bucket, an upload, a preview and a share link in the web console (recorded with make demo-gif).
s3-tests suite and the 638 of MinIO's mint SDK suites, on single drive, multiple drives and
cluster.Coming from MinIO? Follow the migration guide (every version, policies
and users, verified with nexoctl diff). Choosing a store? See how Nexo compares
with MinIO, SeaweedFS, Garage and Ceph RGW, including where another project fits better.
The overview of the web console (shown in dark mode when your browser prefers it). The images are
taken from a demo deployment with make screenshots; drive capacity is shown as 4 × 1 TiB for illustration.
|
Object browser: folders, uploads, versions, previews and share links |
Bucket lifecycle: expiration, noncurrent versions and incomplete uploads |
|
IAM policy editor: AWS policy JSON with completion, validation and a visual builder |
Access rules: allow and deny by prefix, glob or regex, with conditions |
|
Distributions: buckets served on custom domains, with TLS and traffic |
Distribution cache: hit ratio, bandwidth saved and top domains |
|
Monitoring: requests, errors, latency and bandwidth of every node |
Cluster: pools, erasure sets, nodes and drives at a glance |
|
Users: IAM users with their policies and groups |
Sign in: the console uses the same access keys as the S3 API |
With Docker:
docker run -d --name nexo -p 9000:9000 -p 9001:9001 \
-e NEXO_ROOT_USER=admin -e NEXO_ROOT_PASSWORD=supersecret \
-v nexo-data:/data paolor/nexo:latest server /data
The images are on Docker Hub: paolor/nexo (server and CLI) and
paolor/nexoctl (CLI only).
With the binary (releases or make build):
export NEXO_ROOT_USER=admin NEXO_ROOT_PASSWORD=supersecret
nexo server ~/nexo-data # absolute path; multiple drives: nexo server /mnt/disk{1...4}
Then open the console at http://localhost:9001 (user admin, password supersecret) or use the CLI:
nexoctl alias set local http://localhost:9000 admin supersecret
nexoctl mb local/photos
nexoctl cp hello.txt local/photos/
nexoctl share download --expire 2h local/photos/hello.txt # revocable link
Any S3 client works with the endpoint http://localhost:9000 and the same credentials, for example
aws --endpoint-url http://localhost:9000 s3 ls.
📖 Documentation site: https://r3n3r0.github.io/Nexo/ (Italian: https://r3n3r0.github.io/Nexo/it/), with search, the CLI reference and the Admin API.
The same pages are in docs/user, in English with an Italian translation next to every
page (<page>.it.md; also at https://github.com/R3n3r0/Nexo/tree/main/docs/user, for those reading this file
from a release archive):
| Quickstart | the complete walkthrough in five minutes |
| Installation | binaries, deb/rpm, Homebrew, Docker, Compose, Helm, systemd |
| Deployment modes | single drive, multiple drives, cluster, sizing |
| Configuration | flags, environment variables, dynamic configuration |
| Operations guide | monitoring, healing, upgrades, backup, troubleshooting |
| Security | policies, sharing, access rules, TLS, KMS |
| Distributions and cache | custom domains, with a complete tutorial |
| Reference | CLI, Admin API, S3 compatibility |
make docs-site publishes it as a static site with MkDocs (in bin/site, in English and in Italian under /it/).
| # | Document | Contents |
|---|---|---|
| 1 | Architecture | Components, repository layout, stack, technical choices |
| 2 | Features | Catalog of the server, dashboard and CLI features, differences from S3 |
| 3 | Cluster | Topology, erasure coding, quorum, distributed locks, healing, expansion |
| 4 | API | Supported S3 APIs, Admin API, internode RPC |
| 5 | Roadmap and tasks | Milestones, tasks with IDs, dependencies and acceptance criteria, status |
| 6 | Test plan | Strategy and test cases for server, CLI, dashboard and cluster |
| 7 | Security and operations | Threat model, TLS, KMS, observability |
| 8 | Modes and release | Deployment modes, packaging and release process |
| 9 | Presigned URLs, policies and sharing | Presigned URLs, POST policies, policies, revocable share links |
| 10 | Access, domains and distributions | Access rules, domains, distributions behind proxies |
| 11 | Per-domain cache | Memory/disk cache, per-level policies, invalidation, cluster cache |
| 12 | Service architecture | Binding convention for services, routes and composition in internal/app |
The changes of every release are in the CHANGELOG; the test coverage of every feature in the catalog is in the traceability matrix.
You need Go (the version in go.mod) and, for the console, Node.js.
| Command | What it runs |
|---|---|
make build | React console and the bin/nexo and bin/nexoctl binaries with the console embedded (make build-go: Go only) |
make test / make test-race | Go tests (unit and in-process integration in the three modes) |
make test-integration | S3/IAM/presigned integration suite in every mode, slow tests included |
make test-cluster | cluster tests with 4 real bin/nexo processes (kill, pause, restart) |
make test-s3compat | Ceph s3-tests compatibility suite |
make lint / make web-lint / make web-test / make e2e | Go lint, console lint and tests, Playwright |
make run-cluster | local cluster of 4 processes with S3 on 127.0.0.1:9101, 9103, 9105, 9107 and the console on the next port (Linux) |
make docs / make docs-check | CLI reference in docs/user/cli |
make traceability / make traceability-check | feature → test matrix in test/TRACEABILITY.md |
make security | govulncheck, gosec and npm audit |
make zap-scan | authenticated OWASP ZAP active scan of the Admin API from api/openapi.yaml against bin/nexo (needs Java; test/security/zap-api-scan.sh) |
make screenshots | regenerates the console screenshots in docs/images/screenshots from a seeded demo deployment (Playwright; scripts/screenshots) |
make dco | the sign-off check of the pull requests on the commits of the branch (CONTRIBUTING.md) |
make help | all the targets |
The code follows the convention of docs/12: every service has
an interface and an unexported implementation, and composition happens only in internal/app.
Nexo is free software licensed under the GNU Affero General Public License v3.0 only
(AGPL-3.0-only): if you modify it and let users interact with it over a network, you must offer them the
source code of your version. The NOTICE file adds attribution terms (AGPL section 7(b)): keep it, and
keep "Powered by Nexo (https://github.com/R3n3r0/Nexo)" in the legal notices of the user interface. Organizations
that cannot comply with the AGPL can buy a commercial license from the copyright holder;
contributions are accepted under the terms of CONTRIBUTING.md. Archives, deb/rpm packages,
container images and the Helm chart carry LICENSE (and NOTICE in archives and packages).