A small dashboard for managing buckets, keys, cluster health, and objects — built for self-hosted Garage v2, and usable as a generic object browser against any S3-compatible endpoint: AWS S3, MinIO, Cloudflare R2, Backblaze B2, Wasabi.
Admin mode for Garage • S3 mode for everything else
Everything you need for day-to-day cluster operations. Nothing you don't.
All /v2/* calls flow through the BFF — your admin token never touches the browser.
Skip the admin mode and sign in with just an access key + secret. Point it at AWS S3, Cloudflare R2, MinIO, Backblaze B2, Wasabi, Garage — anything S3-compatible.
List, drag-drop upload, download via presigned URL, delete. Uploads stream direct from the browser to your bucket, never through the server.
Check-box matrix for read/write/owner per key. Allow and deny in one click.
Enable per-bucket S3 CORS from the UI — no AWS CLI scripts to babysit.
Iron-session AES-256-GCM. HttpOnly, SameSite=Lax, 24h expiry. No accounts, no database.
Garage ships an HTTP admin API, not a UI — useful for scripts, painful for ad-hoc work. Hand-rolling curl commands every time you want to create a bucket or rotate a key gets old quickly.
garage-ui takes a different shape than the obvious single-page app: a Next.js BFF holds the admin token in an encrypted cookie on the server, and the browser only ever sees opaque API responses. CORS pain on the admin API disappears. S3 uploads still stream direct from the browser via presigned URLs, but a one-click button enables the necessary bucket CORS for you.
Don't run Garage? Sign in with just an S3 access key + secret and use it as a lightweight object browser against AWS S3, Cloudflare R2, MinIO, Backblaze B2, Wasabi — anything that speaks the S3 protocol. The UI quietly drops the cluster-admin panels and shows only what that key can touch.
Garage cluster? Sign in with your admin URL + token. Just an S3 key from AWS, R2, MinIO, or elsewhere? Switch to the S3 tab instead. Either way, the session is server-side and encrypted.