dsh-webfile

Configuration

Override the plugin config by id in the profile's cordis.patch.yml ($DSH_HOME/profiles//cordis.patch.yml):

- id: dsh-webfile
  config:
    connections:
      prod-logs:
        protocol: s3
        endpoint: https://oss.example.com   # omit for AWS public cloud
        region: cn-north-1
        bucket: prod-logs
        pathStyle: true                     # required for MinIO
        accessKeyRef: OSS_ACCESS_KEY        # credential reference name, see below
        secretKeyRef: OSS_SECRET_KEY
      legacy-ftp:
        protocol: ftp
        host: ftp.example.com
        port: 21
        userRef: FTP_USER
        passwordRef: FTP_PASSWORD
        tls: explicit                       # none | explicit | implicit
      mi-fds:
        protocol: fds
        endpoint: https://cnbj2.fds.api.xiaomi.com   # minimal config: endpoint + bucket + ak/sk
        bucket: mi-bucket
        accessKeyRef: FDS_ACCESS_KEY        # required: FDS has no ambient credential chain
        secretKeyRef: FDS_SECRET_KEY
        # region: cnbj2                     # or set region instead and let it derive the host
        # https: false                      # default true; set false for plain HTTP
    maxTransferBytes: 2147483648            # per-file transfer cap, default 2 GiB
    multipartThresholdBytes: 67108864       # S3/FDS multipart threshold, default 64 MiB

Connection fields

Field	Protocol	Notes
protocol	all three	s3, fds, or ftp (required)
endpoint	s3	Custom endpoint (MinIO etc.); omit for AWS public cloud
region	s3	Region (required)
bucket	s3	Default bucket
pathStyle	s3	Path-style addressing; MinIO needs true
accessKeyRef / secretKeyRef / sessionTokenRef	s3	Credential reference names, see below
region	fds	FDS region (cnbj2 / awsbj0 / awsusor0 / awssgp0 / awsde0 / ksyru0-eco / awsind0-eco); either region or endpoint
endpoint	fds	Full host with or without scheme; takes precedence over region — when set, region may be omitted
bucket	fds	Default bucket
https	fds	Default true; FDS also serves plain HTTP
accessKeyRef / secretKeyRef	fds	Credential reference names (required — FDS has no ambient credential chain), see below
host	ftp	Server address (required)
port	ftp	Default 21; 990 for implicit FTPS
userRef / passwordRef	ftp	Credential reference names; omit for anonymous login
tls	ftp	none / explicit / implicit (required)
passive	ftp	Default true; only passive mode is supported

Patch semantics

• Target by id: patch rows without an id are skipped with a warning;
• Whole-value replace: config shallow-replaces the entire value; omitted fields fall back to schema defaults;
• Do not re-mount: never insert another row with the same name in the user layer — configure through id overrides only;
• Disable: - id: dsh-webfile / disabled: true turns the plugin off for that profile;
• Hot reload: long-lived surfaces watch this file — saving replays the patch transactionally via HMR, no restart needed; a parse failure fails loud and keeps the last good tree.