# Installation

> Build the okuri binary from source or run the container image, and point it at a bucket.

okuri is one binary named `okuri`. It needs exactly two things: a bucket to
own and credentials to reach it.

## From source

```console
cargo build --release -p okuri-server
```

This produces `target/release/okuri`. Point it at a bucket via environment
variables or a config file and start it:

```console
export OKURI_S3_BUCKET=my-bucket
export OKURI_S3_ENDPOINT=http://localhost:9000   # MinIO; omit for AWS S3
export OKURI_S3_ACCESS_KEY=...
export OKURI_S3_SECRET_KEY=...
export OKURI_RECEIPT_HANDLE_KEY=$(head -c 32 /dev/urandom | base64)
export OKURI_API_KEYS=default:$(head -c 32 /dev/urandom | base64)
export OKURI_SQS_CREDENTIALS=default:AKIDEXAMPLE:$(head -c 32 /dev/urandom | base64)

okuri serve
```

`okuri serve --config okuri.toml` (or `OKURI_CONFIG=okuri.toml`) reads a
TOML file instead; see [configuration](/docs/configuration) for the full
reference and for what each of the required keys above does.

## Container image

The repository's `Dockerfile` builds a distroless image
(`gcr.io/distroless/cc-debian12:nonroot`) whose entrypoint is the binary:

```console
docker build -t okuri:dev .
docker run -p 8080:8080 -p 9090:9090 \
  -e OKURI_S3_BUCKET=... \
  -e OKURI_S3_ENDPOINT=... \
  -e OKURI_S3_ACCESS_KEY=... \
  -e OKURI_S3_SECRET_KEY=... \
  -e OKURI_RECEIPT_HANDLE_KEY=... \
  -e OKURI_API_KEYS=... \
  -e OKURI_SQS_CREDENTIALS=... \
  okuri:dev
```

## Ports

| port | serves |
| --- | --- |
| :8080 | the API: gRPC, HTTP/JSON, and SQS on one listener |
| :9090 | admin: `/healthz` and `/readyz` for orchestrators |

The two listeners are separate so one can be exposed without the other.

## Object stores

Any S3-compatible store works. Tested and supported today:

- **AWS S3.** Leave `endpoint` unset; credentials may come from the
  provider chain (instance role, environment, credentials file).
- **MinIO.** Set `endpoint` to the MinIO address.
- **Cloudflare R2.** Set `endpoint` to your account's R2 endpoint.

GCS and Azure Blob support is planned.

## Toolchain note

okuri pins its Rust toolchain in `rust-toolchain.toml` (Rust 1.97.1,
edition 2024). `rustup` picks this up automatically when building from
source.