config.mounts.example.json

{
  "_comment": "Storage proxy mount table. Copy to config.mounts.json (gitignored) and set ENABLE_STORAGE_PROXY=1. Each mount serves an S3 bucket as read-only byte passthrough from a backend, ALONGSIDE the relational->Iceberg path. Backends: 'local' (a filesystem path, incl. an OS-mounted NFS/SMB share), 's3' (a native upstream S3/MinIO/S3-compatible bucket), and 'azure' (a native Azure Blob/ADLS Gen2 container). 'root' is the filesystem path / upstream bucket / container respectively; secrets live in the encrypted credential store keyed by 'credential' (never inline) — a credential-less s3 mount must set 'auth' ('anonymous'/'instance'), a credential-less azure mount must set 'auth' ('default'/'managed_identity'/'anonymous'). The bucket must differ from the DB warehouse bucket (S3_BUCKET).",
  "mounts": [
    {
      "bucket": "secure-nfs",
      "backend": "local",
      "root": "/mnt/finance",
      "prefix": "",
      "read_only": true
    },
    {
      "bucket": "team-smb",
      "backend": "local",
      "root": "\\\\fileserver01\\team",
      "prefix": "reports/",
      "read_only": true
    },
    {
      "bucket": "s3vault",
      "backend": "s3",
      "root": "reports-bucket",
      "prefix": "2026/",
      "endpoint": "https://minio.local:9000",
      "region": "us-east-1",
      "addressing_style": "path",
      "credential": "s3vault",
      "read_only": true
    },
    {
      "bucket": "public-open",
      "backend": "s3",
      "root": "open-data",
      "auth": "anonymous",
      "read_only": true
    },
    {
      "bucket": "blobvault",
      "backend": "azure",
      "root": "reports",
      "prefix": "2026/",
      "account": "mystorageacct",
      "credential": "blobvault",
      "read_only": true
    },
    {
      "bucket": "adls-open",
      "backend": "azure",
      "root": "public",
      "account": "opendatalake",
      "auth": "default",
      "read_only": true
    }
  ]
}