[jakduch]

Why

The Active Storage framework from #11314 is merged, but production still selects a disk directory unconditionally. Web and worker processes on separate machines cannot share attachments through that directory without shared filesystem storage.

This change lets standalone and distributed deployments select the same private S3-compatible bucket through settings or environment variables. Local disk remains the default; there is no Kubernetes-specific application mode.

What changes

• Add the AWS S3 runtime dependency and a safely quoted S3 service configuration.
• Support AWS credential-chain authentication (including workload/instance roles) or an explicit access-key pair.
• Reject unsupported services, missing bucket/region, and partial explicit credentials at startup.
• Document configuration, private downloads, backup requirements, and the distinction between enabling a service and migrating existing files.

Existing installations

The framework is in Foreman's 5.1.0-develop branch. This is not an activation or backport for an installed Foreman 3.19 system.

No existing files are moved or deleted. Existing blobs keep their service_name; changing the default applies to new blobs only. Consumer-specific migrations and a verified copy between services are separate changes. Generic Rails attachment routes remain disabled.

RPM availability of the S3 SDK depends on the packaging series ending in theforeman/foreman-packaging#14207; this PR does not bypass distribution packaging.

Testing

• Configuration unit tests: 6 tests, 10 assertions passed locally with the existing system Ruby using a minimal Minitest adapter (no Rails boot).
• Added Rails tests for configuration rendering/quoting and environment-variable loading.
• Ruby syntax checks and git diff --check passed.
• Full Rails/database CI and a live S3 integration were not run locally; no new test environment was installed.

Fixes https://projects.theforeman.org/issues/39856

AI assistance: Codex. Project signature: GPT_5.6 Sol.

[jakduch]

The RPM build currently stops while installing build dependencies: nothing provides requested (rubygem(aws-sdk-s3) >= 1.0 with rubygem(aws-sdk-s3) < 2.0). The required packaging series ends in theforeman/foreman-packaging#14207. This needs those packages to be published before the RPM checks can pass; changing application code or retrying the same build will not supply the missing package.

[lzap]

There is a lot going on around ActiveStorage and general direction of Foreman was to simplify the project rather than getting it more complex. I see several PRs around this and I wonder why this is needed, so far I only saw using it for avatars which is a niché feature. I suggest you to open up a discourse about this.

To be clear, I am not against, I just would like others to discuss this.

[jakduch]

The remaining RPM build failure is a packaging prerequisite, not the S3 renderer tests: COPR cannot resolve rubygem(aws-sdk-s3). The package chain is in theforeman/foreman-packaging#14203, #14204, #14205, #14206 and #14207. Those must be merged and published before this build can pass; the Rails checks are green.