$ MINIO_ROOT_USER=testenvvar MINIO_ROOT_PASSWORD=testenvpass ~/src/minio/minio server  --console-address=":9001"  /mnt/minio{1...4}
MinIO Object Storage Server
Copyright: 2015-2024 MinIO, Inc.
License: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html
Version: DEVELOPMENT.2024-07-11T23-13-15Z (go1.22.4 linux/amd64)

API: http://192.168.86.164:9500  http://100.111.197.108:9500  http://10.42.0.1:9500  http://10.42.0.0:9500  http://127.0.0.1:9500
   RootUser: testenvvar
   RootPass: testenvpass

$ cat /lib/systemd/system/minio.service
...
EnvironmentFile=-/etc/default/minio
...

$ sudo cat /proc/<pidnumber>/environ | tr '\0' '\n' | grep ROOT
MINIO_ROOT_PASSWORD=rootpass
MINIO_ROOT_USER=roottest

server {
 listen 443 ssl;
 ssl_certificate /home/minio/.minio/certs/public.crt;
 ssl_certificate_key /home/minio/.minio/certs/private.key;
 server_name play.min.io play.minio.io;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 100m;
 # To disable buffering
 proxy_buffering off;

 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;
   proxy_set_header X-NginX-Proxy true;

   # This is necessary to pass the correct IP to be hashed
   real_ip_header X-Real-IP;
   
   proxy_connect_timeout 300;
   # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
   proxy_http_version 1.1;
   proxy_set_header Connection "";
   chunked_transfer_encoding off;

   proxy_pass https://127.0.0.1:9500; # If you are using docker-compose this would be the hostname i.e. minio
 }
}

server {
 listen 9443 ssl;
 ssl_certificate /home/minio/.minio/certs/public.crt;
 ssl_certificate_key /home/minio/.minio/certs/private.key;
 server_name play.min.io play.minio.io;

 # To allow special characters in headers
 ignore_invalid_headers off;
 # Allow any size file to be uploaded.
 # Set to a value such as 1000m; to restrict file size to a specific value
 client_max_body_size 100m;
 # To disable buffering
 proxy_buffering off;

 location / {
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;
   proxy_set_header X-NginX-Proxy true;

   # This is necessary to pass the correct IP to be hashed
   real_ip_header X-Real-IP;

   proxy_connect_timeout 300;

   # To support websocket
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "upgrade";

   chunked_transfer_encoding off;

   proxy_pass https://127.0.0.1:9001; # If you are using docker-compose this would be the hostname i.e. minio
 }
}

mc alias list play
play
  URL       : https://play.min.io
  AccessKey : Q3AM3UQ867SPQQA43P2F
  SecretKey : zuf tfteSlswRu7BJ86wekitnifILbZam1KYY3TG
  API       : S3v4
  Path      : auto

upstream minio_s3 {
        least_conn;
        server localhost:9500;
}

upstream minio_console {
        least_conn;
        server localhost:9001;
}

server {
        listen 80;

        server_name *.minio.dev.test minio.dev.test;

        return 301 https://$host$request_uri;
}

server {
        listen 443 ssl;
        server_name minio.dev.test;

        include /etc/nginx/snippets/minio_ssl.conf;

        # Allow special characters in headers
        ignore_invalid_headers off;

        # Allow any size file for upload.
        # Set to a value such as 1000M to restrict to specific values.
        client_max_body_size 0;

        # Disable buffering
        proxy_buffering off;
        proxy_request_buffering off;

        location / {
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_connect_timeout 300;
                # Default is HTTP/1, keepalive only in HTTP/1.1
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                chunked_transfer_encoding off;

                proxy_pass http://minio_s3;
        }
}

server {
        listen 443 ssl;
        server_name console.minio.dev.test;

        include /etc/nginx/snippets/minio_ssl.conf;

        # Allow special characters in headers
        ignore_invalid_headers off;

        # Allow any size file for upload.
        client_max_body_size 0;

        # Disable buffering
        proxy_buffering off;
        proxy_request_buffering off;

        location / {
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-NginX-Proxy true;

                # This is necessary to pass the correct IP to be hashed
                real_ip_header X-Real-IP;

                proxy_connect_timeout 300;

                # To support websocket
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

                chunked_transfer_encoding off;

                proxy_pass http://minio_console/;
        }
}

ssl_certificate /etc/ssl/_.minio.dev.test/fullchain.pem;
ssl_certificate_key /etc/ssl/_.minio.dev.test/privkey.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY130;
ssl_prefer_server_ciphers off;

# MINIO_ROOT_USER and MINIO_ROOT_PASSWORD sets the root account for the MinIO server.
# This user has unrestricted permissions to perform S3 and administrative API operations on any resource in the deployment.
# Omit to use the default values 'minioadmin:minioadmin'.
# MinIO recommends setting non-default values as a best practice, regardless of environment.

MINIO_ROOT_USER=REDACTED
MINIO_ROOT_PASSWORD=REDACTED

# MINIO_VOLUMES sets the storage volumes or paths to use for the MinIO server.
# The specified path uses MinIO expansion notation to denote a sequential series of drives between 1 and 4, inclusive.
# All drives or paths included in the expanded drive list must exist *and* be empty or freshly formatted for MinIO to start successfully.

MINIO_VOLUMES="/minio/data{1...2}"

# MINIO_OPTS sets any additional commandline options to pass to the MinIO server.
# For example, `--console-address :9001` sets the MinIO Console listen port
MINIO_OPTS="--console-address :9001"

# MINIO_SERVER_URL sets the hostname of the local machine for use with the MinIO Server.
# MinIO assumes your network control plane can correctly resolve this hostname to the local machine.

# Uncomment the following line and replace the value with the correct hostname for the local machine.

MINIO_SERVER_URL="https://minio.dev.test"
MINIO_BROWSER_REDIRECT_URL="https://console.minio.dev.test"