v1.3.0 cannot access Wasabi bucket via custom hostname over Cloudflare

[Natsuki-Kaede]

What happened:
hello everyone, here's my situation:
i am using Wasabi as my storage provider and have configured a custom hostname (which reverse proxied the endpoint over Cloudflare) as my bucket name
after upgrading to v1.3.0, i cannot access my storage and am getting some errors.

What you expected to happen:
ready and access successfully

How to reproduce it (as minimally and precisely as possible):
in v1.3.0, configure a hostname such as mybucket.mydomain.tld as the bucket name, reverse proxy it to the Wasabi endpoint in Cloudflare, and then create or config juicefs using --bucket https://mybucket.mydomain.tld

Anything else we need to know?
it worked correctly in v1.2.3
logs here

2025/07/09 09:44:12.599124 juicefs[1752808] <INFO>: Ping redis latency: 194.513µs [checkServerConfig@redis.go:3692]
2025/07/09 09:44:14.243444 juicefs[1752808] <WARNING>: Test storage wasabi://xxx/(encrypted) failed: Failed to create bucket wasabi://xxx/(encrypted): operation error S3: CreateBucket, https response error StatusCode: 403, RequestID: xxx, HostID: xxx, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method., previous error: operation error S3: PutObject, https response error StatusCode: 403, RequestID: xxx, HostID: xxx, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method., tries: #1 [test@format.go:374]
2025/07/09 09:44:16.824811 juicefs[1752808] <WARNING>: Test storage wasabi://xxx/(encrypted) failed: Failed to create bucket wasabi://xxx/(encrypted): operation error S3: CreateBucket, https response error StatusCode: 403, RequestID: xxx, HostID: xxx, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method., previous error: operation error S3: PutObject, https response error StatusCode: 403, RequestID: xxx, HostID: xxx, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method., tries: #2 [test@format.go:374]

Environment:

• JuiceFS version (use juicefs --version) or Hadoop Java SDK version: juicefs version 1.3.0+2025-07-03.30190ca
• Cloud provider or hardware configuration running JuiceFS: netcup (AMD EYPC 9634)
• OS (e.g cat /etc/os-release): Debian GNU/Linux 12 (bookworm)
• Kernel (e.g. uname -a): Linux v2202505276482344355 6.1.0-37-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.140-1 (2025-05-22) x86_64 GNU/Linux
• Object storage (cloud provider and region, or self maintained): Wasabi EU-Central-2 (Frankfurt)
• Metadata engine info (version, cloud provider managed or self maintained): Redis 8.0.3
• Network connectivity (JuiceFS to metadata engine, JuiceFS to object storage): local redis server as metadata engine and Wasabi object storage
• Others:

[zhijian-pro]

I have no problem directly connecting to the Wasabi bucket, but how did you set up the reverse proxy you mentioned?

[Natsuki-Kaede]

I have no problem directly connecting to the Wasabi bucket, but how did you set up the reverse proxy you mentioned?

Thank you for your response.
I apologize for not expressing my issue clearly: it’s not a DIRECT connection, but a connection via a custom domain proxy.
In Wasabi, you can configure a custom domain for a bucket.

For example, to use the domain mybucket.mydomain.tld, name your bucket exactly mybucket.mydomain.tld and set up a reverse proxy so that requests to https://mybucket.mydomain.tld are forwarded to https://s3.<region>.wasabisys.com. Then you can access your bucket via https://mybucket.mydomain.tld instead of <bucket>.s3.<region>.wasabisys.com

command example:

juicefs format \
    --storage wasabi \
    --bucket https://mybucket.mydomain.tld \
    --access-key xxx \
    --secret-key xxx \
    redis://127.0.0.1:6379/11 \
    testwasabi

In v1.3.0, the above method cannot be used to access the bucket.

[solracsf]

@Natsuki-Kaede you said:

and set up a reverse proxy

How is this set up ?

[Natsuki-Kaede]

@Natsuki-Kaede you said:

and set up a reverse proxy

How is this set up ?

We proxied the endpoint through Cloudflare. After talking with other contributors, we discovered that using a standard web server as a proxy works, but with Cloudflare we get a SignatureDoesNotMatch error.
Sorry for not adding this in time, I've edited issue.

[jiefenghuang]

 we discovered that using a standard web server as a proxy works, but with Cloudflare we get a SignatureDoesNotMatch error.

Have you compared the differences in the requests received by the two? There should be some debug logs available for the proxy