refactor rustfs docs

.agents/skills/rustfs-docs/SKILL.md

@@ -12,8 +12,8 @@ description: >-
 # Writing RustFS documentation
 
 This is a **FumaPress** site (Waku + Fumadocs). Pages live in `content/`; each
-page's URL mirrors its path (`content/management/bucket/creation.md` →
-`/management/bucket/creation`). Navigation is defined by `content/meta.json`
+page's URL mirrors its path (`content/administration/data/bucket/creation.md` →
+`/administration/data/bucket/creation`). Navigation is defined by `content/meta.json`
 (root sidebar) and per-folder `meta.json` files.
 
 Read `STYLE.md` (repo root) for the full style guide and `AGENTS.md` for repo
@@ -93,8 +93,8 @@ Second person ("you"). Official recommendations as "We recommend". No
 superlatives or promises (fastest, perfect, 100% …). Technical pages carry
 instructions, not sales copy — solutions/marketing content belongs on the main
 site (rustfs.com), not in these docs. The docs sidebar has seven sections:
-Getting Started · Core Concepts · Installation · Administration · Operations ·
-Developer · Reference. New pages go into one of these.
+Installation · Administration · Security & Compliance · Operations ·
+Troubleshooting · Developer · Reference. New pages go into one of these.
 
 ## 6. Navigation
 

AGENTS.md

@@ -8,7 +8,7 @@ This playbook directs AI agents working in the RustFS documentation repository s
 - Framework: **FumaPress** (static-site generator powered by Waku + Fumadocs). Content lives in `content/`; site configuration is in `press.config.tsx`, `source.config.ts`, and `waku.config.ts`.
 - Goal: produce documentation for a distributed object storage product aimed at a global audience, currently English-first with room for other locales.
 - Navigation: `content/meta.json` (root sidebar: section order, labels, links) and per-folder `content/**/meta.json` (nested group titles/order) define the site structure. New pages must be reflected there immediately.
-- Routing: a page's URL mirrors its path under `content/` (e.g. `content/management/bucket/index.md` → `/management/bucket`). `.md` links between pages are resolved automatically; you can write `./sibling.md` or `/absolute/path`.
+- Routing: a page's URL mirrors its path under `content/` (e.g. `content/administration/data/bucket/creation.md` → `/administration/data/bucket/creation`). `.md` links between pages are resolved automatically; you can write `./sibling.md` or `/absolute/path`.
 
 ## 2. Core Principles
 1. **Accuracy**: Data, APIs, and commands must be reproducible; cite third-party information with a concise source note.

STYLE.md

@@ -9,7 +9,7 @@ This guide defines the writing and formatting conventions for all pages under `c
 - No superlatives or promises: avoid *fastest*, *best-in-class*, *world-leading*, *100% secure*, *100% compatible*, *perfect*, *military-grade*.
 - No marketing CTAs ("Contact us immediately", "Buy now") inside technical pages.
 - Every factual claim must be verifiable against the [rustfs/rustfs](https://github.com/rustfs/rustfs) source or an official release. Never document hypothetical commands, flags, or components. If you are unsure whether a capability exists, remove the claim.
-- Do not restate performance numbers on feature pages; link to `/concepts/comparison` instead so figures live in one place.
+- Keep performance figures in one verified reference location instead of repeating them across pages.
 - Use USD (`$`) for any cost examples; never mix currencies.
 
 ## Page Skeleton
@@ -74,7 +74,7 @@ RUSTFS_VOLUMES="/data"
 
 ## Links
 
-- Internal links are root-relative paths without file extension: `/installation/linux/quick-start`, `/concepts/comparison`.
+- Internal links are root-relative paths without file extension: `/installation/linux/quick-start`, `/operations/status-check`.
 - Link text describes the target ("see the cloud-native installation guide"), never "click here".
 
 ## Images and Screenshots
@@ -89,11 +89,11 @@ RUSTFS_VOLUMES="/data"
 - Plain Markdown pages use `.md`.
 - Pages that need JSX components (`<Cards>`, `<Tabs>`, `<Steps>`, etc.) must use the `.mdx` extension. Do not put JSX in `.md` files.
 - Mermaid diagrams are supported in fenced ```mermaid blocks.
-- **Card icons:** when a landing grid (`<Cards>`) uses icons, use a single consistent set of monochrome line icons from `lucide-react` (registered in `press.config.tsx`), one semantically matched icon per card, applied to **every** card in the grid — never a partial set. Do not use emoji-as-icons and do not mix brand logos (e.g. the Docker whale) with abstract icons. Pass them via `<Card icon={<Rocket />} …>`.
+- **Card icons:** use one consistent icon family within each landing grid and apply an icon to every card. Use Lucide for abstract concepts. A platform-selection grid may use brand logos from `react-icons` when every primary card icon is a brand logo. Do not mix brand logos with abstract primary icons or use emoji as icons.
 
 ## Product Terminology
 
 - The product is **RustFS** (capital R, capital FS) — never "rustFS", "Rustfs", or "RUSTFS".
-- RustFS ships as a single binary and an official **Helm chart** for Kubernetes. There is **no Operator, no Tenant CRD, and no KES component** — do not reference them.
+- RustFS ships as a single binary and an official **Helm chart** for Kubernetes. The separate official **RustFS Operator** repository provides a pre-release `Tenant` CRD; verify its current release status before documenting it. RustFS has no KES component.
 - Key management is the **built-in KMS** with `local`, `vault`, and `vault-transit` backends.
 - Observability is **OpenTelemetry (OTLP)**-based: metrics, logs, and traces export through an OTLP endpoint.

content/administration/console/index.md

@@ -0,0 +1,69 @@
+---
+title: "Console"
+description: "Enable the RustFS Console, connect it to a server, and sign in securely."
+---
+
+The **RustFS Console** is the web administration interface for RustFS. Use this page to enable the Console, open the login page, and choose the appropriate sign-in method. Detailed procedures for buckets, objects, and identity management are covered in their respective documentation sections.
+
+## Enable the Console
+
+The Console is enabled by default and listens on port `9001`, separately from the S3 API on port `9000`. You can set the behavior explicitly with the following environment variables:
+
+```ini title="/etc/default/rustfs"
+RUSTFS_CONSOLE_ENABLE=true
+RUSTFS_CONSOLE_ADDRESS=":9001"
+```
+
+Restart RustFS after changing these values. Set `RUSTFS_CONSOLE_ENABLE=false` when the Console must not run.
+
+The equivalent command-line options are `--console-enable` and `--console-address`. See the [CLI reference](/reference/cli) and [environment variable reference](/reference/environment-variables) for the complete server configuration.
+
+## Open the Console
+
+Open the following address, replacing `<server-ip>` with the RustFS server address:
+
+```text
+http://<server-ip>:9001
+```
+
+![RustFS Console login page with key, STS, and OIDC sign-in options](./images/rustfs-console-login.png)
+
+For a local deployment, use `http://localhost:9001`. Windows and macOS desktop launchers use port `7001` instead.
+
+If the login page cannot reach the target RustFS service, select **Server Configuration** or open `/config`. Enter the externally reachable RustFS service address and save it after the health check succeeds. **Reset** clears the saved address; **Skip** returns to login without changing it.
+
+## Log in
+
+The login methods shown depend on the deployment configuration:
+
+- **Key Login** uses the access key and secret key configured for the RustFS deployment. This is the standard login method for a local administrator.
+- **STS Login** uses temporary Security Token Service (STS) credentials. Use it only when your identity workflow has issued a valid session token.
+- **OIDC Login** appears when an OpenID Connect (OIDC) provider is configured. Select the provider and complete authentication with the identity provider.
+
+After login, the Console opens the first page your account can access. Menus and actions vary by account policy and enabled platform capabilities; a missing menu does not necessarily indicate a Console error.
+
+If login fails, verify the selected login method, credentials, target server address, and account status before retrying.
+
+:::warning[Do not expose default credentials]
+
+RustFS falls back to `rustfsadmin` / `rustfsadmin` when custom credentials are not configured. Use these defaults only for a throwaway local test. Configure a unique access key and a strong secret key before making the Console reachable by other users.
+
+:::
+
+## Operational notes
+
+- Use [TLS](/integration/tls-configured) before exposing the Console outside a trusted network.
+- Restrict network access to the Console listener and configure [Console CORS](/administration/cors) only when cross-origin access is required.
+- The Console session inherits the permissions of the signed-in identity. Use a least-privilege account for routine work.
+- Signing out or an expired session returns you to the login page. Do not store administrator credentials in shared browsers.
+
+## Management workflows
+
+- [Create and manage buckets](/administration/data/bucket/creation)
+- [Upload and manage objects](/administration/data/object/creation)
+- [Manage access keys](/security-compliance/iam/access-token)
+- [Configure identity and access management](/security-compliance/iam)
+
+## Next steps
+
+Review the [security checklist](/installation/requirement/checklists/security-checklists) before exposing the Console outside a trusted network. For OIDC-based login, continue with the [OIDC configuration guide](/security-compliance/oidc).

content/administration/cors/index.md

@@ -0,0 +1,50 @@
+---
+title: "CORS Configuration"
+description: "Configure allowed browser origins for the RustFS S3 API and Console."
+---
+
+Cross-Origin Resource Sharing (CORS) controls which browser origins can access the RustFS S3 API and Console. Configure each listener separately, then restart RustFS to apply the environment changes.
+
+## S3 API origins
+
+Set `RUSTFS_CORS_ALLOWED_ORIGINS` to a comma-separated list of trusted origins:
+
+```ini title="/etc/default/rustfs"
+RUSTFS_CORS_ALLOWED_ORIGINS="https://app.example.com,https://admin.example.com"
+```
+
+When this variable is unset or empty, the S3 endpoint does not add generic CORS response headers. A list of explicit origins allows credentialed browser requests from matching origins.
+
+You can set the value to `*` to allow requests from any origin. Wildcard mode does not allow browser credentials.
+
+:::warning[Use explicit origins in production]
+
+Use a comma-separated allowlist for applications that send credentials. Reserve `*` for public resources that do not require credentialed browser requests.
+
+:::
+
+## Console origins
+
+The Console uses a separate variable:
+
+```ini title="/etc/default/rustfs"
+RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS="https://admin.example.com"
+```
+
+Use a comma-separated list when more than one browser origin must access the Console. Set `*` only when any origin must be allowed.
+
+## Verify the response
+
+Send a request with an `Origin` header and inspect the CORS response headers:
+
+```bash
+curl -i \
+  -H "Origin: https://app.example.com" \
+  http://localhost:9000/
+```
+
+Confirm that `Access-Control-Allow-Origin` contains the expected origin. Repeat the check with an unlisted origin and confirm that it is not allowed.
+
+## Next steps
+
+See the [environment variable reference](/reference/environment-variables#cors) for the verified defaults and configuration formats.

content/management/bucket/creation.md → content/administration/data/bucket/creation.md

@@ -1,15 +1,14 @@
 ---
 title: "RustFS Bucket Creation"
-description: "Create buckets using the RustFS UI, MinIO Client, or API."
+description: "Create buckets using the RustFS UI, rc, or the S3 API."
 ---
 
-This guide explains how to create buckets using the RustFS UI, `mc` (MinIO Client), or API.
+This guide explains how to create buckets using the RustFS UI, `rc`, or the S3 API.
 
-## Creating Buckets
+## Requirements
 
-Prerequisites:
-
-- A running RustFS instance (see [Installation Guide](../../installation/index.md)).
+- A running RustFS instance (see [Installation Guide](../../../installation/index.md)).
+- [`rc`](/operations/rc) installed and configured with an alias for the command-line workflow.
 
 ## Using the RustFS UI
 
@@ -19,22 +18,22 @@ Prerequisites:
 
 ![bucket creation](images/bucket-creation-by-ui.png)
 
-### Using `mc`
+## Using `rc`
 
-> See the [`mc` Usage Guide](../../developer/mc.md) for installation and configuration.
+See the [`rc` guide](/operations/rc) for installation and alias configuration.
 
 Create a bucket:
 
 ```bash
-# create rustfs bucket
-mc mb rustfs/bucket-creation-by-mc
-Bucket created successfully `rustfs/bucket-creation-by-mc`.
+rc bucket create rustfs/my-bucket
+rc bucket list rustfs/
+```
 
-# confirm bucket creation
-mc ls rustfs/bucket-creation-by-mc
+```text
+✓ Bucket 'rustfs/my-bucket' created successfully.
 ```
 
-### Using the API
+## Using the API
 
 Create a bucket via API:
 

content/management/bucket/deletion.md → content/administration/data/bucket/deletion.md

@@ -1,9 +1,14 @@
 ---
 title: "RustFS Bucket Deletion"
-description: "Delete buckets using the RustFS UI, MinIO Client, or API."
+description: "Delete buckets using the RustFS UI, rc, or the S3 API."
 ---
 
-This guide explains how to delete buckets using the RustFS UI, `mc` (MinIO Client), or API.
+This guide explains how to delete buckets using the RustFS UI, `rc`, or the S3 API.
+
+## Requirements
+
+- Install and configure [`rc`](/operations/rc) before using the command-line workflow.
+- Empty the target bucket before deleting it, or use `--force` only after reviewing the objects that will be removed.
 
 **Warning**: Deleting a bucket is irreversible and may break applications relying on it. Ensure you have backed up any necessary data before proceeding.
 
@@ -16,20 +21,18 @@ This guide explains how to delete buckets using the RustFS UI, `mc` (MinIO Clien
 
 ![bucket deletion](images/bucket-deletion-on-ui.png)
 
-## Using `mc`
+## Using `rc`
 
-See the [`mc` Usage Guide](../../developer/mc.md) for installation and configuration.
+See the [`rc` guide](/operations/rc) for installation and alias configuration.
 
 Delete a bucket:
 
 ```bash
-# delete bucket
-mc rb rustfs/bucket-creation-by-mc
-Removed `rustfs/bucket-creation-by-mc` successfully.
+rc bucket remove rustfs/my-bucket
+```
 
-# confirm bucket deletion
-mc ls rustfs/bucket-creation-by-mc
-mc: <ERROR> Unable to list folder. Bucket `bucket-creation-by-mc` does not exist.
+```text
+✓ Bucket 'rustfs/my-bucket' removed successfully.
 ```
 
 ## Using the API

content/administration/data/bucket/meta.json

@@ -0,0 +1,10 @@
+{
+  "title": "Bucket",
+  "pages": [
+    "creation",
+    "deletion",
+    "quota",
+    "replication",
+    "policy"
+  ]
+}