feat(config): add MAXIO_PUBLIC_BUCKETS for anonymous public-read buckets

[lord007tn]

Closes #18.

What

Adds MAXIO_PUBLIC_BUCKETS (env / --public-buckets, alias MINIO_PUBLIC_BUCKETS): a comma-separated list of buckets that, on boot, are created if missing and flagged public-read (read = true, list = false) — the single-binary equivalent of MinIO's mc anonymous set download. It mirrors the existing MAXIO_DEFAULT_BUCKETS and runs immediately after it, through the same provisioning path.

Why

See #18: MaxIO already supports anonymous public-read per bucket, but only via the interactive console — there's no startup option, and no PutBucketPolicy for mc anonymous to target. This closes that gap for the common "serve public media over unsigned GET from an unattended boot" use case (e.g. a docker compose stack with no human to click through the console).

Behavior

• Creates listed buckets on demand, so a public bucket need not also appear in MAXIO_DEFAULT_BUCKETS.
• For a bucket that already exists, forces public_read on while preserving its current public_list — a restart never silently reverts a console-set listing. Only the read flag is forced.
• Invalid names are skipped; all errors are non-fatal (logged), same as provision_default_buckets.

Included hardening

While making public-read a first-class startup option, I also tightened the anonymous public-read bypass: ?uploadId and ?partNumber now go through the bypass deny-list, so an anonymous GET on a public_read bucket can no longer reach multipart list_parts and enumerate in-progress upload metadata (a surface distinct from object read). Without this, exposing a bucket via MAXIO_PUBLIC_BUCKETS would also expose multipart listing.

Config

Variable	Flag	Default	Description
MAXIO_PUBLIC_BUCKETS	--public-buckets	(none)	Comma-separated buckets to expose as anonymous public-read, created on boot if missing (alias MINIO_PUBLIC_BUCKETS)

Tests

New integration coverage: create-and-flag (read=true/list=false), flip-existing-private, preserve operator-set public_list, invalid/empty input, and the anonymous ?uploadId bypass block.

Local checks matching CI: cargo fmt --all -- --check clean, cargo clippy --all-targets --all-features -- -D warnings clean. cargo test is green except the two pre-existing test_folder_marker_with_children / test_multipart_sse_c_part_key_mismatch_rejected cases, which reproduce on a clean main on Windows and are unrelated to this change.

Notes

• Follows CLAUDE.md conventions (MaxIO in prose, MAXIO_ env prefix, MinIO-aliased for parity with the other vars).
• README config table updated.

🤖 Generated with Claude Code