Artifact storage
Store generated HTML research reports in a private S3-compatible bucket.
Tasuku can publish deep-research results as private HTML artifacts instead of
placing the full report in Slack. The Slack reply links to
TASUKU_PUBLIC_URL/artifact/<artifact-id>. Tasuku authenticates the viewer,
reads the stored object through the server-side S3 endpoint, and streams the
HTML through a same-origin response into a sandboxed iframe.
Configure an environment default with the TASUKU_ARTIFACT_S3_* variables, or
open Integrations → Artifact storage as a super user to test and save an
organization override. Organization credentials are encrypted with
TASUKU_MASTER_KEY and are never returned by the API.
The server endpoint is used by the Tasuku server and worker. The public endpoint
is retained for API consumers that request a short-lived signed preview URL, so
it must still be configured. In production both endpoints must use HTTPS, and
the public endpoint must use a different hostname from TASUKU_PUBLIC_URL. The
dashboard viewer does not expose bucket credentials or contact that public
storage origin.
Objects remain private. Reports are single UTF-8 HTML documents capped at 512 KiB. The viewer permits scripts, forms, popups, and downloads inside a sandboxed iframe, but it does not allow the report to navigate Tasuku's top-level page. When storage is unavailable or publication fails, Tasuku keeps the Markdown research result on the work item.
Local MinIO
docker-compose.dev.yml includes MinIO with a private tasuku-artifacts
bucket:
- S3 API:
http://127.0.0.1:9000 - Console:
http://127.0.0.1:9001 - Internal Tasuku endpoint:
http://minio:9000
The development compose file supplies the matching artifact environment
variables automatically. Override MINIO_ROOT_USER and
MINIO_ROOT_PASSWORD when shared local credentials are unsuitable.