Reduce tu factura de AWS S3 un 75% con Cifrado Zero-Trust en el Cliente

version: '3.8'
services:
  sttp-proxy:
    image: modlabsys/sttp-engine:v0.2.4-slim
    container_name: sttp_sidecar
    restart: unless-stopped
    ports:
      - "127.0.0.1:9000:9000" # Interceptador S3 Local
    environment:
      - STTP_LISTEN_ADDR=0.0.0.0:9000
      - STTP_UPSTREAM_S3_ENDPOINT=https://s3.us-east-1.amazonaws.com
      - STTP_ZSTD_LEVEL=19
      - STTP_ENCRYPTION_CIPHER=AES_256_GCM
      - STTP_LOCAL_KEY_PATH=/etc/sttp/master.key
      - STTP_DETERMINISM_STRICT=true
    volumes:
      - ./keys/master.key:/etc/sttp/master.key:ro
    deploy:
      resources:
        limits:
          memory: 32M

# /etc/systemd/system/sttp.service
[Unit]
Description=ModLabSys STTP Zero-Knowledge Storage Engine
After=network.target
Wants=network-online.target

[Service]
Type=exec
User=sttp-daemon
Group=sttp-daemon
ExecStart=/usr/local/bin/sttp-engine \
  --listen 127.0.0.1:9000 \
  --upstream s3.us-east-1.amazonaws.com \
  --zstd-threads auto \
  --cipher aes-256-gcm \
  --key-file /etc/sttp/production.key
Restart=always
LimitNOFILE=65536
MemoryMax=64M

[Install]
WantedBy=multi-user.target

# 1. Instalar binario compilado estático (musl) desde el dominio oficial
curl -sSL https://modlabsys.pages.dev/install.sh | sudo bash

# 2. Generar llave criptográfica Zero-Trust (Local Enclave)
sttp-engine keygen --out ./vault.key --cipher aes-256-gcm

# 3. Iniciar Proxy Daemon interactivo en segundo plano
sttp-engine daemon \
  --bind 127.0.0.1:9000 \
  --upstream s3.us-east-1.amazonaws.com \
  --key ./vault.key \
  --zstd-level 19 \
  --metrics-port 9100

// Node.js / TypeScript: AWS SDK v3 Client Drop-in
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: "us-east-1",
  // Simplemente apunta tu endpoint al proxy local STTP:
  endpoint: "http://127.0.0.1:9000",
  forcePathStyle: true,
  credentials: {
    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
  }
});

// STTP comprime y cifra automáticamente en vuelo antes de enviar a AWS
await s3.send(new PutObjectCommand({
  Bucket: "mi-bucket-telemetria",
  Key: "logs/2026-08-22/server-01.json",
  Body: hugeJsonPayloadBuffer
}));