The Two-Layer Cache Architecture

Part of the MediaBridge series. Why Cache S3 at All S3 ListObjectsV2 is not free. Each call costs money, takes time, and returns at most 1,000 objects per page. A bucket with 10,000 files in a single prefix requires 10 paginated S3 calls just to render one folder. Do that on every page load and you burn money, slow the UI, and hit S3 rate limits under concurrent users. Presigned URL generation is also not free. It is CPU work on the server. A folder with 50 files requires 50 presigned PUT or GET URL generations per load if nothing is cached. ...

February 25, 2026 · 5 min · 1065 words · Sagar Nayak

Zero-Tolerance Security Model

Part of the MediaBridge series. The Design Premise Most access control systems respond to violations with a 403. You tried to access something you should not have - here is a polite rejection. Come back when you have the right permissions. MediaBridge takes a different position. Certain violation types are not mistakes. A user navigating to a URL they are not supposed to reach is an accident. A user constructing a request with a path outside their assigned root prefix is not. The system treats the latter as an active intrusion attempt and terminates the session immediately, rather than returning a 403 and letting the session continue. ...

February 13, 2026 · 6 min · 1088 words · Sagar Nayak

Direct-to-S3 Upload with Presigned URLs

Part of the MediaBridge series. The Upload Problem The obvious way to handle file uploads in a web app is to pipe them through the backend: browser sends the file to your server, server writes it to S3. This works. It also means every upload byte travels twice - once from the browser to your server, and again from your server to S3. Your server becomes a bottleneck, your bandwidth bill doubles, and large files tie up server connections. ...

February 7, 2026 · 6 min · 1163 words · Sagar Nayak

MediaBridge: Self-Hosted S3 File Management for Teams

What MediaBridge is a self-hosted file management layer over AWS S3. It gives teams a proper interface for uploading, browsing, and sharing files across multiple S3 buckets without AWS console access and without distributing IAM credentials to individuals. It runs in production managing 33 S3 buckets. Backend: github.com/sagarnayak/mediabridgeBackend-public Frontend: github.com/sagarnayak/mediabridgeFrontend-public Why The access problem Content teams upload files constantly: images for a web app, PDFs for client portals, videos for a dashboard. Those files need to live in S3 and they need URLs. The question is how the team gets them there. ...

February 1, 2026 · 6 min · 1079 words · Sagar Nayak

Mount AWS S3 as a Windows Drive with rclone

What rclone can mount an S3 bucket as a Windows drive letter, making it appear in File Explorer like a local drive. This guide covers configuring one S3 remote, writing a mount batch file, and optionally starting it at sign-in. You need an AWS account with an S3 bucket and IAM user, rclone for Windows, and WinFSP installed (required for rclone mount on Windows). Why Faster access: Browse S3 in File Explorer without separate apps or consoles. Simplicity: Open, copy, rename like a normal drive letter. Integrations: Any Windows app that works with drive letters can work with S3. How Step 1: Install rclone + WinFSP ...

October 15, 2025 · 3 min · 616 words · Sagar Nayak