Does rclone serve s3 not support using subdirectories as a reverse proxy?

Help and Support
1

In nginx, I set up a reverse proxy with the URI /s3/, but I get an error when using it.

PS D:Downloads> rclone lsd myS3:
2026/08/06 12:11:55 ERROR : error listing: operation error S3: ListBuckets, https response error StatusCode: 403, RequestID: , HostID: , api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2026/08/06 12:11:55 NOTICE: Failed to lsd with 2 errors: last error was: operation error S3: ListBuckets, https response error StatusCode: 403, RequestID: , HostID: , api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.

rclone serve s3

2026/08/06 12:11:55 INFO  : serve s3: Access Denied: 127.0.0.1:50612 => /?x-id=ListBuckets

But using / works fine, and that's the only difference in the configuration.

Do I still need to set up anything extra?

2

Hi @Tty725

This isn't currently supported.

The problem is that the client literally signs the request it uses to access the s3 service, and by the time it has got to gofakes3 it has changed.

To get it working we'd need to do a bit of plumbing in the gofakes3 library we use.

The standard work-around would be to use a subdomain e.g. s3.example.com (which is in fact what MinIO and friends recommend).

Some things you should bear in mind with nginx (not that they will fix the problem but if it is ever going to work...)

  1. nginx must not re-normalize the path: proxy_pass with any URI component makes nginx decode/re-encode, which breaks signatures on keys containing +, =, spaces, etc. proxy_pass http://127.0.0.1:PORT; with no URI passes it byte-for-byte.
  2. Host is a signed header, so either proxy_set_header Host $http_host; or leave the SDK to sign the backend host.
  3. Don't add/modify anything in the SignedHeaders list.

Let me know if the subdomain will work for you, if not I'll have a go at a fix.