diff --git a/s3/middleware.go b/s3/middleware.go
index 2183402dcbb20bcbd16c3ba68bb3db9a8a873540..db6c70ea72a13b6d718de9115291675d61c1e9dd 100644
--- a/s3/middleware.go
+++ b/s3/middleware.go
@@ -2,9 +2,12 @@ package s3
 
 import (
 	"context"
+	"errors"
 	"net/http"
 
 	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+	"github.com/vaughan0/go-ini"
 )
 
 var minioCtxKey = &contextKey{"minio"}
@@ -34,3 +37,27 @@ 		panic("Invalid minio context")
 	}
 	return raw
 }
+
+var ErrDisabled = errors.New("object storage is not enabled for this server")
+
+func NewClient(conf ini.File) (*minio.Client, error) {
+	upstream, _ := conf.Get("objects", "s3-upstream")
+	accessKey, _ := conf.Get("objects", "s3-access-key")
+	secretKey, _ := conf.Get("objects", "s3-secret-key")
+	if upstream == "" || accessKey == "" || secretKey == "" {
+		return nil, ErrDisabled
+	}
+
+	return minio.New(upstream, &minio.Options{
+		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
+		Secure: true,
+	})
+}
+
+func URL(conf ini.File, bucket string) string {
+	upstream, _ := conf.Get("objects", "s3-upstream")
+	if upstream == "" {
+		return ""
+	}
+	return "https://" + upstream
+}