S3 has two names

Name	For	Serves
https://s3.gewis.nl	every S3 client: cluster workloads, the KV endpoint, anything outside	the S3 API only
http://s3.net.gewis.nl:8333	terraform/40_seaweedfs-buckets and admins	S3 and IAM, straight to s3-01

Both reach the same SeaweedFS gateway on s3-01. Clients use path-style and region us-east-1. The .net name is LAN-internal: only the cluster resolver answers it, so it works from the LAN, pods and NetBird peers using NetBird DNS.

s3.gewis.nl refuses IAM

Port 8333 also serves the IAM and STS APIs, which are always POST /; the S3 API never uses that method on the root. The route in flux/40_services/s3/ matches Host(`s3.gewis.nl`) && !(Method(`POST`) && Path(`/`)), so Traefik returns 404 for every IAM and STS call and forwards everything else, including the S3 POSTs (/bucket?delete, /bucket/key?uploads, /bucket/key?uploadId=…). Users, keys and policies are managed only over s3.net.gewis.nl.

Traefik reaches s3-01 over the LAN

The backend is the selectorless Service s3-01 with a hand-written EndpointSlice for 10.82.50.100:8333, the same pattern as the LAN hosts of the external proxy. Loki, Mimir, Tempo and the database backups all write through this route. The cost is one more place that hardcodes s3-01's DHCP-reserved address, see s3-01 gotchas.

Inside, s3.gewis.nl points straight at Traefik

The cluster resolver answers s3.gewis.nl with 10.82.50.10, Traefik's own address, so pods and LAN clients skip the round trip through router02's public address. Everyone else follows the public CNAME onto router02.

Clients

Path-style is mandatory: <bucket>.s3.gewis.nl is outside the wildcard certificate. Signatures stay valid through Traefik, which passes the Host header unchanged and sets X-Forwarded-Proto: https, from which SeaweedFS rebuilds the signed host without the default port.