diff --git a/client/src/api/configTemplates.ts b/client/src/api/configTemplates.ts
new file mode 100644
index 00000000000..5ca51cf7e2e
--- /dev/null
+++ b/client/src/api/configTemplates.ts
@@ -0,0 +1,25 @@
+import type { components } from "@/api/schema/schema";
+
+export type Instance =
+    | components["schemas"]["UserFileSourceModel"]
+    | components["schemas"]["UserConcreteObjectStoreModel"];
+
+export type TemplateVariable =
+    | components["schemas"]["TemplateVariableString"]
+    | components["schemas"]["TemplateVariableInteger"]
+    | components["schemas"]["TemplateVariablePathComponent"]
+    | components["schemas"]["TemplateVariableBoolean"];
+export type TemplateSecret = components["schemas"]["TemplateSecret"];
+export type VariableValueType = (string | boolean | number) | undefined;
+export type VariableData = { [key: string]: VariableValueType };
+export type SecretData = { [key: string]: string };
+
+export interface TemplateSummary {
+    description: string | null;
+    hidden?: boolean;
+    id: string;
+    name: string | null;
+    secrets?: TemplateSecret[] | null;
+    variables?: TemplateVariable[] | null;
+    version?: number;
+}
diff --git a/client/src/api/fileSources.ts b/client/src/api/fileSources.ts
new file mode 100644
index 00000000000..68935db4573
--- /dev/null
+++ b/client/src/api/fileSources.ts
@@ -0,0 +1,6 @@
+import { type components } from "@/api/schema";
+
+export type FileSourceTemplateSummary = components["schemas"]["FileSourceTemplateSummary"];
+export type FileSourceTemplateSummaries = FileSourceTemplateSummary[];
+
+export type UserFileSourceModel = components["schemas"]["UserFileSourceModel"];
diff --git a/client/src/api/objectStores.ts b/client/src/api/objectStores.ts
index 0a9089e5df4..b6c1f6c59f7 100644
--- a/client/src/api/objectStores.ts
+++ b/client/src/api/objectStores.ts
@@ -1,4 +1,9 @@
 import { fetcher } from "@/api/schema";
+import type { components } from "@/api/schema/schema";
+
+export type UserConcreteObjectStore = components["schemas"]["UserConcreteObjectStoreModel"];
+
+export type ObjectStoreTemplateType = "aws_s3" | "azure_blob" | "boto3" | "disk" | "generic_s3";
 
 const getObjectStores = fetcher.path("/api/object_stores").method("get").create();
 
diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 08dc0ec7402..4f98526ffec 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -318,6 +318,24 @@ export interface paths {
         /** Download */
         get: operations["download_api_drs_download__object_id__get"];
     };
+    "/api/file_source_instances": {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        get: operations["file_sources__instances_index"];
+        /** Create a user-bound object store. */
+        post: operations["file_sources__create_instance"];
+    };
+    "/api/file_source_instances/{user_file_source_id}": {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        get: operations["file_sources__instances_get"];
+        /** Update or upgrade user file source instance. */
+        put: operations["file_sources__instances_update"];
+        /** Purge user file source instance. */
+        delete: operations["file_sources__instances_purge"];
+    };
+    "/api/file_source_templates": {
+        /** Get a list of file source templates available to build user defined file sources from */
+        get: operations["file_sources__templates_index"];
+    };
     "/api/folders/{folder_id}/contents": {
         /**
          * Returns a list of a folder's contents (files and sub-folders) with additional metadata about the folder.
@@ -1256,6 +1274,8 @@ export interface paths {
         get: operations["object_stores__instances_get"];
         /** Update or upgrade user object store instance. */
         put: operations["object_stores__instances_update"];
+        /** Purge user object store instance. */
+        delete: operations["object_stores__instances_purge"];
     };
     "/api/object_store_templates": {
         /** Get a list of object store templates available to build user defined object stores from */
@@ -5238,6 +5258,43 @@ export interface components {
              */
             update_time: string;
         };
+        /** FileSourceTemplateSummaries */
+        FileSourceTemplateSummaries: components["schemas"]["FileSourceTemplateSummary"][];
+        /** FileSourceTemplateSummary */
+        FileSourceTemplateSummary: {
+            /** Description */
+            description: string | null;
+            /**
+             * Hidden
+             * @default false
+             */
+            hidden?: boolean;
+            /** Id */
+            id: string;
+            /** Name */
+            name: string | null;
+            /** Secrets */
+            secrets?: components["schemas"]["TemplateSecret"][] | null;
+            /**
+             * Type
+             * @enum {string}
+             */
+            type: "ftp" | "posix" | "s3fs" | "azure";
+            /** Variables */
+            variables?:
+                | (
+                      | components["schemas"]["TemplateVariableString"]
+                      | components["schemas"]["TemplateVariableInteger"]
+                      | components["schemas"]["TemplateVariablePathComponent"]
+                      | components["schemas"]["TemplateVariableBoolean"]
+                  )[]
+                | null;
+            /**
+             * Version
+             * @default 0
+             */
+            version?: number;
+        };
         /** FilesSourcePlugin */
         FilesSourcePlugin: {
             /**
@@ -9929,13 +9986,6 @@ export interface components {
              */
             up_to_date: boolean;
         };
-        /** ObjectStoreTemplateSecret */
-        ObjectStoreTemplateSecret: {
-            /** Help */
-            help: string | null;
-            /** Name */
-            name: string;
-        };
         /** ObjectStoreTemplateSummaries */
         ObjectStoreTemplateSummaries: components["schemas"]["ObjectStoreTemplateSummary"][];
         /** ObjectStoreTemplateSummary */
@@ -9954,32 +10004,27 @@ export interface components {
             /** Name */
             name: string | null;
             /** Secrets */
-            secrets?: components["schemas"]["ObjectStoreTemplateSecret"][] | null;
+            secrets?: components["schemas"]["TemplateSecret"][] | null;
             /**
              * Type
              * @enum {string}
              */
-            type: "s3" | "azure_blob" | "disk" | "generic_s3";
+            type: "aws_s3" | "azure_blob" | "boto3" | "disk" | "generic_s3";
             /** Variables */
-            variables?: components["schemas"]["ObjectStoreTemplateVariable"][] | null;
+            variables?:
+                | (
+                      | components["schemas"]["TemplateVariableString"]
+                      | components["schemas"]["TemplateVariableInteger"]
+                      | components["schemas"]["TemplateVariablePathComponent"]
+                      | components["schemas"]["TemplateVariableBoolean"]
+                  )[]
+                | null;
             /**
              * Version
              * @default 0
              */
             version?: number;
         };
-        /** ObjectStoreTemplateVariable */
-        ObjectStoreTemplateVariable: {
-            /** Help */
-            help: string | null;
-            /** Name */
-            name: string;
-            /**
-             * Type
-             * @enum {string}
-             */
-            type: "string" | "boolean" | "integer";
-        };
         /** OutputReferenceByLabel */
         OutputReferenceByLabel: {
             /**
@@ -11856,6 +11901,92 @@ export interface components {
          * @enum {string}
          */
         TaskState: "PENDING" | "STARTED" | "RETRY" | "FAILURE" | "SUCCESS";
+        /** TemplateSecret */
+        TemplateSecret: {
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+        };
+        /** TemplateVariableBoolean */
+        TemplateVariableBoolean: {
+            /**
+             * Default
+             * @default false
+             */
+            default?: boolean;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "boolean";
+        };
+        /** TemplateVariableInteger */
+        TemplateVariableInteger: {
+            /**
+             * Default
+             * @default 0
+             */
+            default?: number;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "integer";
+        };
+        /** TemplateVariablePathComponent */
+        TemplateVariablePathComponent: {
+            /** Default */
+            default?: string | null;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "path_component";
+        };
+        /** TemplateVariableString */
+        TemplateVariableString: {
+            /**
+             * Default
+             * @default
+             */
+            default?: string;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "string";
+        };
         /** ToolDataDetails */
         ToolDataDetails: {
             /**
@@ -12200,8 +12331,12 @@ export interface components {
         };
         /** UpdateInstancePayload */
         UpdateInstancePayload: {
+            /** Active */
+            active?: boolean | null;
             /** Description */
             description?: string | null;
+            /** Hidden */
+            hidden?: boolean | null;
             /** Name */
             name?: string | null;
             /** Variables */
@@ -12513,12 +12648,16 @@ export interface components {
         };
         /** UserConcreteObjectStoreModel */
         UserConcreteObjectStoreModel: {
+            /** Active */
+            active: boolean;
             /** Badges */
             badges: components["schemas"]["BadgeDict"][];
             /** Description */
             description?: string | null;
             /** Device */
             device?: string | null;
+            /** Hidden */
+            hidden: boolean;
             /** Id */
             id: number | string;
             /** Name */
@@ -12527,6 +12666,8 @@ export interface components {
             object_store_id?: string | null;
             /** Private */
             private: boolean;
+            /** Purged */
+            purged: boolean;
             quota: components["schemas"]["QuotaModel"];
             /** Secrets */
             secrets: string[];
@@ -12538,7 +12679,7 @@ export interface components {
              * Type
              * @enum {string}
              */
-            type: "s3" | "azure_blob" | "disk" | "generic_s3";
+            type: "aws_s3" | "azure_blob" | "boto3" | "disk" | "generic_s3";
             /** Uuid */
             uuid: string;
             /** Variables */
@@ -12588,6 +12729,40 @@ export interface components {
              */
             id: string;
         };
+        /** UserFileSourceModel */
+        UserFileSourceModel: {
+            /** Active */
+            active: boolean;
+            /** Description */
+            description: string | null;
+            /** Hidden */
+            hidden: boolean;
+            /** Id */
+            id: string | number;
+            /** Name */
+            name: string;
+            /** Purged */
+            purged: boolean;
+            /** Secrets */
+            secrets: string[];
+            /** Template Id */
+            template_id: string;
+            /** Template Version */
+            template_version: number;
+            /**
+             * Type
+             * @enum {string}
+             */
+            type: "ftp" | "posix" | "s3fs" | "azure";
+            /** Uri Root */
+            uri_root: string;
+            /** Uuid */
+            uuid: string;
+            /** Variables */
+            variables: {
+                [key: string]: (string | boolean | number) | undefined;
+            } | null;
+        };
         /**
          * UserModel
          * @description User in a transaction context.
@@ -14777,6 +14952,169 @@ export interface operations {
             };
         };
     };
+    file_sources__instances_index: {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"][];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__create_instance: {
+        /** Create a user-bound object store. */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateInstancePayload"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__instances_get: {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The index for a persisted UserFileSourceStore object. */
+            path: {
+                user_file_source_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__instances_update: {
+        /** Update or upgrade user file source instance. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The index for a persisted UserFileSourceStore object. */
+            path: {
+                user_file_source_id: string;
+            };
+        };
+        requestBody: {
+            content: {
+                "application/json":
+                    | components["schemas"]["UpdateInstanceSecretPayload"]
+                    | components["schemas"]["UpgradeInstancePayload"]
+                    | components["schemas"]["UpdateInstancePayload"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__instances_purge: {
+        /** Purge user file source instance. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The index for a persisted UserFileSourceStore object. */
+            path: {
+                user_file_source_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__templates_index: {
+        /** Get a list of file source templates available to build user defined file sources from */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        responses: {
+            /** @description A list of the configured file source templates. */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["FileSourceTemplateSummaries"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     index_api_folders__folder_id__contents_get: {
         /**
          * Returns a list of a folder's contents (files and sub-folders) with additional metadata about the folder.
@@ -20608,6 +20946,33 @@ export interface operations {
             };
         };
     };
+    object_stores__instances_purge: {
+        /** Purge user object store instance. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The identifier used to index a persisted UserObjectStore object. */
+            path: {
+                user_object_store_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     object_stores__templates_index: {
         /** Get a list of object store templates available to build user defined object stores from */
         parameters?: {
@@ -20647,7 +21012,10 @@ export interface operations {
             /** @description A list of the configured object stores. */
             200: {
                 content: {
-                    "application/json": components["schemas"]["ConcreteObjectStoreModel"][];
+                    "application/json": (
+                        | components["schemas"]["ConcreteObjectStoreModel"]
+                        | components["schemas"]["UserConcreteObjectStoreModel"]
+                    )[];
                 };
             };
             /** @description Validation Error */
diff --git a/client/src/components/ConfigTemplates/CreateInstance.test.ts b/client/src/components/ConfigTemplates/CreateInstance.test.ts
new file mode 100644
index 00000000000..fe4e59ad4a5
--- /dev/null
+++ b/client/src/components/ConfigTemplates/CreateInstance.test.ts
@@ -0,0 +1,32 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import CreateInstance from "./CreateInstance.vue";
+
+const localVue = getLocalVue(true);
+
+describe("CreateInstance", () => {
+    it("should render a loading message during loading", async () => {
+        const wrapper = shallowMount(CreateInstance, {
+            propsData: {
+                loading: true,
+                loadingMessage: "component loading...",
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeTruthy();
+    });
+
+    it("should hide a loading message after loading", async () => {
+        const wrapper = shallowMount(CreateInstance, {
+            propsData: {
+                loading: false,
+                loadingMessage: "component loading...",
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeFalsy();
+    });
+});
diff --git a/client/src/components/ConfigTemplates/CreateInstance.vue b/client/src/components/ConfigTemplates/CreateInstance.vue
new file mode 100644
index 00000000000..334d341bc59
--- /dev/null
+++ b/client/src/components/ConfigTemplates/CreateInstance.vue
@@ -0,0 +1,21 @@
+<script lang="ts" setup>
+import { BContainer } from "bootstrap-vue";
+
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    loading: boolean;
+    loadingMessage: string;
+}
+
+defineProps<Props>();
+</script>
+
+<template>
+    <BContainer fluid class="p-0">
+        <LoadingSpan v-if="loading" :message="loadingMessage" />
+        <div v-else>
+            <slot />
+        </div>
+    </BContainer>
+</template>
diff --git a/client/src/components/ConfigTemplates/EditSecretsForm.test.ts b/client/src/components/ConfigTemplates/EditSecretsForm.test.ts
new file mode 100644
index 00000000000..3a6252da0e2
--- /dev/null
+++ b/client/src/components/ConfigTemplates/EditSecretsForm.test.ts
@@ -0,0 +1,36 @@
+import { mount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE, STANDARD_OBJECT_STORE_TEMPLATE } from "./test_fixtures";
+
+import EditSecretsForm from "./EditSecretsForm.vue";
+
+const localVue = getLocalVue(true);
+
+describe("EditSecretsForm", () => {
+    it("should render a secrets for for file source templates", async () => {
+        const wrapper = mount(EditSecretsForm, {
+            propsData: {
+                template: STANDARD_FILE_SOURCE_TEMPLATE,
+                title: "Secrets FORM for file source",
+            },
+            localVue,
+        });
+        const titleText = wrapper.find(".portlet-title-text");
+        expect(titleText.exists()).toBeTruthy();
+        expect(titleText.text()).toEqual("Secrets FORM for file source");
+    });
+
+    it("should render a secrets for for object store templates", async () => {
+        const wrapper = mount(EditSecretsForm, {
+            propsData: {
+                template: STANDARD_OBJECT_STORE_TEMPLATE,
+                title: "Secrets FORM for object store",
+            },
+            localVue,
+        });
+        const titleText = wrapper.find(".portlet-title-text");
+        expect(titleText.exists()).toBeTruthy();
+        expect(titleText.text()).toEqual("Secrets FORM for object store");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/EditSecretsForm.vue b/client/src/components/ConfigTemplates/EditSecretsForm.vue
new file mode 100644
index 00000000000..9baa7ac5f7c
--- /dev/null
+++ b/client/src/components/ConfigTemplates/EditSecretsForm.vue
@@ -0,0 +1,39 @@
+<script setup lang="ts">
+import { TemplateSummary } from "@/api/configTemplates";
+
+import VaultSecret from "./VaultSecret.vue";
+import FormCard from "@/components/Form/FormCard.vue";
+
+interface Props {
+    template: TemplateSummary;
+    title: string;
+}
+
+defineProps<Props>();
+
+const emit = defineEmits<{
+    (e: "update", secretName: string, secretValue: string): void;
+}>();
+
+async function update(secretName: string, secretValue: string) {
+    emit("update", secretName, secretValue);
+}
+</script>
+
+<template>
+    <FormCard :title="title">
+        <template v-slot:body>
+            <div>
+                <div v-for="secret in template.secrets" :key="secret.name">
+                    <VaultSecret
+                        :label="secret.label || secret.name"
+                        :name="secret.name"
+                        :help="secret.help || ''"
+                        :is-set="true"
+                        @update="update">
+                    </VaultSecret>
+                </div>
+            </div>
+        </template>
+    </FormCard>
+</template>
diff --git a/client/src/components/ConfigTemplates/InstanceDropdown.test.ts b/client/src/components/ConfigTemplates/InstanceDropdown.test.ts
new file mode 100644
index 00000000000..2d41abb5b34
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceDropdown.test.ts
@@ -0,0 +1,40 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import InstanceDropdown from "./InstanceDropdown.vue";
+
+const localVue = getLocalVue(true);
+
+describe("InstanceDropdown", () => {
+    it("should render a drop down without upgrade if upgrade unavailable as an option", async () => {
+        const wrapper = shallowMount(InstanceDropdown, {
+            propsData: {
+                prefix: "file-source",
+                name: "my cool instance",
+                routeEdit: "/object_store_instance/edit",
+                routeUpgrade: "/object_store_instance/upgrade",
+                isUpgradable: false,
+            },
+            localVue,
+        });
+        const menu = wrapper.find(".dropdown-menu");
+        const links = menu.findAll("a");
+        expect(links.length).toBe(2);
+    });
+
+    it("should render a drop down with upgrade if upgrade available as an option", async () => {
+        const wrapper = shallowMount(InstanceDropdown, {
+            propsData: {
+                prefix: "file-source",
+                name: "my cool instance",
+                routeEdit: "/object_store_instance/edit",
+                routeUpgrade: "/object_store_instance/upgrade",
+                isUpgradable: true,
+            },
+            localVue,
+        });
+        const menu = wrapper.find(".dropdown-menu");
+        const links = menu.findAll("a");
+        expect(links.length).toBe(3);
+    });
+});
diff --git a/client/src/components/ConfigTemplates/InstanceDropdown.vue b/client/src/components/ConfigTemplates/InstanceDropdown.vue
new file mode 100644
index 00000000000..72089a4e086
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceDropdown.vue
@@ -0,0 +1,58 @@
+<script setup lang="ts">
+import "./icons";
+
+import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BLink } from "bootstrap-vue";
+import { useRouter } from "vue-router/composables";
+
+interface Props {
+    prefix: string;
+    name: string;
+    routeEdit: string;
+    routeUpgrade: string;
+    isUpgradable: boolean;
+}
+
+const title = "";
+
+const router = useRouter();
+
+defineProps<Props>();
+
+const emit = defineEmits<{
+    (e: "remove"): void;
+}>();
+</script>
+
+<template>
+    <div>
+        <BLink
+            v-b-tooltip.hover
+            :class="`${prefix}-instance-dropdown font-weight-bold`"
+            data-toggle="dropdown"
+            :title="title"
+            aria-haspopup="true"
+            aria-expanded="false">
+            <FontAwesomeIcon icon="caret-down" />
+            <span class="instance-dropdown-name">{{ name }}</span>
+        </BLink>
+        <div class="dropdown-menu" :aria-labelledby="`${prefix}-instance-dropdown`">
+            <a
+                v-if="isUpgradable"
+                class="dropdown-item"
+                @keypress="router.push(routeUpgrade)"
+                @click.prevent="router.push(routeUpgrade)">
+                <span class="fa fa-edit fa-fw mr-1" />
+                <span v-localize>Upgrade</span>
+            </a>
+            <a class="dropdown-item" @keypress="router.push(routeEdit)" @click.prevent="router.push(routeEdit)">
+                <span class="fa fa-edit fa-fw mr-1" />
+                <span v-localize>Edit configuration</span>
+            </a>
+            <a class="dropdown-item" @keypress="emit('remove')" @click.prevent="emit('remove')">
+                <span class="fa fa-edit fa-fw mr-1" />
+                <span v-localize>Remove instance</span>
+            </a>
+        </div>
+    </div>
+</template>
diff --git a/client/src/components/ConfigTemplates/InstanceForm.test.ts b/client/src/components/ConfigTemplates/InstanceForm.test.ts
new file mode 100644
index 00000000000..546a6670d68
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceForm.test.ts
@@ -0,0 +1,42 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import InstanceForm from "./InstanceForm.vue";
+
+const localVue = getLocalVue(true);
+
+const inputs: any[] = [];
+const SUBMIT_TITLE = "Submit the form!";
+
+describe("InstanceForm", () => {
+    it("should render a loading message and not submit button if inputs is null", async () => {
+        const wrapper = shallowMount(InstanceForm, {
+            propsData: {
+                title: "MY FORM",
+                loading: true,
+                inputs: null,
+                submitTitle: SUBMIT_TITLE,
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeTruthy();
+        expect(wrapper.find("#submit").exists()).toBeFalsy();
+    });
+
+    it("should hide a loading message after loading", async () => {
+        const wrapper = shallowMount(InstanceForm, {
+            propsData: {
+                title: "MY FORM",
+                loading: false,
+                inputs: inputs,
+                submitTitle: SUBMIT_TITLE,
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeFalsy();
+        expect(wrapper.find("#submit").exists()).toBeTruthy();
+        expect(wrapper.find("#submit").text()).toEqual(SUBMIT_TITLE);
+    });
+});
diff --git a/client/src/components/ObjectStore/Instances/InstanceForm.vue b/client/src/components/ConfigTemplates/InstanceForm.vue
similarity index 79%
rename from client/src/components/ObjectStore/Instances/InstanceForm.vue
rename to client/src/components/ConfigTemplates/InstanceForm.vue
index 97d4525aa4c..7e9bba13e4a 100644
--- a/client/src/components/ObjectStore/Instances/InstanceForm.vue
+++ b/client/src/components/ConfigTemplates/InstanceForm.vue
@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { BButton } from "bootstrap-vue";
+
 import FormCard from "@/components/Form/FormCard.vue";
 import FormDisplay from "@/components/Form/FormDisplay.vue";
 import LoadingSpan from "@/components/LoadingSpan.vue";
@@ -7,6 +9,7 @@ interface Props {
     title: string;
     inputs: any | null; // not fully reactive so make sure these are ready to go when loading is false
     submitTitle: string;
+    loadingMessage: string;
 }
 
 defineProps<Props>();
@@ -26,7 +29,7 @@ async function handleSubmit() {
 </script>
 <template>
     <div>
-        <LoadingSpan v-if="inputs == null" message="Loading storage location template and instance information" />
+        <LoadingSpan v-if="inputs == null" :message="loadingMessage" />
         <div v-else>
             <FormCard :title="title">
                 <template v-slot:body>
@@ -34,9 +37,9 @@ async function handleSubmit() {
                 </template>
             </FormCard>
             <div class="mt-3">
-                <b-button id="submit" variant="primary" class="mr-1" @click="handleSubmit">
+                <BButton id="submit" variant="primary" class="mr-1" @click="handleSubmit">
                     {{ submitTitle }}
-                </b-button>
+                </BButton>
             </div>
         </div>
     </div>
diff --git a/client/src/components/ConfigTemplates/ManageIndexHeader.vue b/client/src/components/ConfigTemplates/ManageIndexHeader.vue
new file mode 100644
index 00000000000..880c1a92c3d
--- /dev/null
+++ b/client/src/components/ConfigTemplates/ManageIndexHeader.vue
@@ -0,0 +1,35 @@
+<script setup lang="ts">
+import "./icons";
+
+import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BAlert, BButton, BCol, BRow } from "bootstrap-vue";
+import { useRouter } from "vue-router/composables";
+
+import _l from "@/utils/localization";
+
+interface Props {
+    message: String | null | undefined;
+    createButtonId: string;
+    createRoute: string;
+}
+
+defineProps<Props>();
+
+const router = useRouter();
+</script>
+
+<template>
+    <div>
+        <BAlert v-if="message" show dismissible>
+            {{ message || "" }}
+        </BAlert>
+        <BRow class="mb-3">
+            <BCol>
+                <BButton :id="createButtonId" class="m-1 float-right" @click="router.push(createRoute)">
+                    <FontAwesomeIcon icon="plus" />
+                    {{ _l("Create") }}
+                </BButton>
+            </BCol>
+        </BRow>
+    </div>
+</template>
diff --git a/client/src/components/ConfigTemplates/SelectTemplate.test.js b/client/src/components/ConfigTemplates/SelectTemplate.test.js
new file mode 100644
index 00000000000..ce631ceb54d
--- /dev/null
+++ b/client/src/components/ConfigTemplates/SelectTemplate.test.js
@@ -0,0 +1,33 @@
+import { mount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE } from "./test_fixtures";
+
+import SelectTemplate from "./SelectTemplate.vue";
+
+const localVue = getLocalVue(true);
+
+const help = "some help text about selection";
+
+describe("SelectTemplate", () => {
+    it("should render a selection row for supplied templates", async () => {
+        const wrapper = mount(SelectTemplate, {
+            propsData: {
+                templates: [STANDARD_FILE_SOURCE_TEMPLATE],
+                selectText: help,
+                idPrefix: "file-source",
+            },
+            localVue,
+        });
+        console.log(wrapper.html());
+        const helpText = wrapper.find(".file-source-template-select-help");
+        expect(helpText.exists()).toBeTruthy();
+        expect(helpText.text()).toBeLocalizationOf(help);
+        const buttons = wrapper.findAll("button");
+        expect(buttons.length).toBe(1);
+        const button = buttons.at(0);
+        expect(button.attributes().id).toEqual("file-source-template-button-moo");
+        expect(button.attributes()["data-template-id"]).toEqual("moo");
+        expect(button.text()).toEqual("moo");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/SelectTemplate.vue b/client/src/components/ConfigTemplates/SelectTemplate.vue
new file mode 100644
index 00000000000..012edb83ebf
--- /dev/null
+++ b/client/src/components/ConfigTemplates/SelectTemplate.vue
@@ -0,0 +1,44 @@
+<script lang="ts" setup>
+import { BButton, BButtonGroup, BCol, BRow } from "bootstrap-vue";
+
+import type { TemplateSummary } from "@/api/configTemplates";
+
+interface Props {
+    selectText: string;
+    idPrefix: string;
+    templates: TemplateSummary[];
+}
+
+defineProps<Props>();
+
+const emit = defineEmits<{
+    (e: "onSubmit", id: string): void;
+}>();
+
+async function handleSubmit(templateId: string) {
+    emit("onSubmit", templateId);
+}
+</script>
+
+<template>
+    <BRow>
+        <BCol cols="7">
+            <BButtonGroup vertical size="lg" style="width: 100%">
+                <BButton
+                    v-for="template in templates"
+                    :id="`${idPrefix}-template-button-${template.id}`"
+                    :key="template.id"
+                    :class="`${idPrefix}-template-select-button`"
+                    :data-template-id="template.id"
+                    @click="handleSubmit(template.id)"
+                    >{{ template.name }}
+                </BButton>
+            </BButtonGroup>
+        </BCol>
+        <BCol cols="5">
+            <p v-localize style="float: right" :class="`${idPrefix}-template-select-help`">
+                {{ selectText }}
+            </p>
+        </BCol>
+    </BRow>
+</template>
diff --git a/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts b/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts
new file mode 100644
index 00000000000..e230874d65e
--- /dev/null
+++ b/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts
@@ -0,0 +1,22 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE } from "./test_fixtures";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const localVue = getLocalVue(true);
+
+describe("TemplateSummaryPopover", () => {
+    it("should render a secrets for for file source templates", async () => {
+        const wrapper = shallowMount(TemplateSummaryPopover, {
+            propsData: {
+                template: STANDARD_FILE_SOURCE_TEMPLATE,
+                target: "popover-target",
+            },
+            localVue,
+        });
+        const popover = wrapper.findComponent({ name: "BPopover" });
+        expect(popover.attributes().target).toEqual("popover-target");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue b/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue
new file mode 100644
index 00000000000..77484b6b8c9
--- /dev/null
+++ b/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue
@@ -0,0 +1,21 @@
+<script lang="ts" setup>
+import { BPopover } from "bootstrap-vue";
+
+import type { TemplateSummary } from "@/api/configTemplates";
+
+interface Props {
+    target: String;
+    template: TemplateSummary;
+}
+
+const props = defineProps<Props>();
+
+const popoverPlacement = "rightbottom";
+</script>
+
+<template>
+    <BPopover :target="target" triggers="hover" boundary="window" :placement="popoverPlacement">
+        <template v-slot:title>{{ props.template.name }}</template>
+        <slot />
+    </BPopover>
+</template>
diff --git a/client/src/components/ConfigTemplates/VaultSecret.test.ts b/client/src/components/ConfigTemplates/VaultSecret.test.ts
new file mode 100644
index 00000000000..6ab7e53f530
--- /dev/null
+++ b/client/src/components/ConfigTemplates/VaultSecret.test.ts
@@ -0,0 +1,25 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import VaultSecret from "./VaultSecret.vue";
+
+const localVue = getLocalVue(true);
+
+describe("VaultSecret", () => {
+    it("should render a form element", async () => {
+        const wrapper = shallowMount(VaultSecret, {
+            propsData: {
+                name: "secret name",
+                label: "Label Secret",
+                help: "here is some good *help*",
+                isSet: true,
+            },
+            localVue,
+        });
+        const titleWrapper = wrapper.find(".ui-form-title-text");
+        expect(titleWrapper.text()).toEqual("Label Secret");
+        const helpWrapper = wrapper.find(".ui-form-info p");
+        // verify markdown converted
+        expect(helpWrapper.html()).toEqual("<p>here is some good <em>help</em></p>");
+    });
+});
diff --git a/client/src/components/ObjectStore/Instances/VaultSecret.vue b/client/src/components/ConfigTemplates/VaultSecret.vue
similarity index 50%
rename from client/src/components/ObjectStore/Instances/VaultSecret.vue
rename to client/src/components/ConfigTemplates/VaultSecret.vue
index 41fb485bd67..11835fd4fe7 100644
--- a/client/src/components/ObjectStore/Instances/VaultSecret.vue
+++ b/client/src/components/ConfigTemplates/VaultSecret.vue
@@ -1,8 +1,12 @@
 <script setup lang="ts">
+import { BButton, BFormInput, BInputGroup, BInputGroupAppend } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
+import { markup } from "@/components/ObjectStore/configurationMarkdown";
+
 interface Props {
     name: string;
+    label: string;
     help: string;
     isSet: boolean;
 }
@@ -10,7 +14,8 @@ const props = defineProps<Props>();
 
 const showEdit = ref<boolean>(false);
 const secretValue = ref<string>("");
-const editTitle = computed(() => `Edit ${props.name}`);
+const editTitle = computed(() => `Edit ${props.label}`);
+const helpHtml = computed(() => markup(props.help, true));
 
 function onClick() {
     showEdit.value = true;
@@ -29,37 +34,35 @@ async function onOk() {
         <div class="ui-form-element section-row">
             <div class="ui-form-title">
                 <div class="ui-form-title-text">
-                    {{ name }}
+                    {{ label }}
                 </div>
             </div>
             <div class="ui-form-field">
                 <div>
-                    <b-input-group>
-                        <b-form-input type="password" value="*****************************" disabled @click="onClick" />
-                        <b-input-group-append>
-                            <b-button @click="onClick">
+                    <BInputGroup>
+                        <BFormInput type="password" value="*****************************" disabled @click="onClick" />
+                        <BInputGroupAppend>
+                            <BButton @click="onClick">
                                 <icon icon="edit" />
                                 Update
-                            </b-button>
-                        </b-input-group-append>
-                    </b-input-group>
+                            </BButton>
+                        </BInputGroupAppend>
+                    </BInputGroup>
                 </div>
             </div>
-            <span class="ui-form-info form-text text-muted">
-                {{ help }}
-            </span>
+            <!-- eslint-disable-next-line vue/no-v-html -->
+            <span class="ui-form-info form-text text-muted" v-html="helpHtml" />
         </div>
         <b-modal ref="edit-modal" v-model="showEdit" :title="editTitle" ok-title="Update" @ok="onOk">
             <div>
-                <b-form-input v-model="secretValue" type="password" />
-                <span class="ui-form-info form-text text-muted">
-                    {{ help }}
-                </span>
+                <BFormInput v-model="secretValue" type="password" />
+                <!-- eslint-disable-next-line vue/no-v-html -->
+                <span class="ui-form-info form-text text-muted" v-html="helpHtml" />
             </div>
         </b-modal>
     </div>
 </template>
 
 <style lang="scss" scoped>
-@import "../../Form/form-elements.scss";
+@import "../Form/form-elements.scss";
 </style>
diff --git a/client/src/components/ConfigTemplates/fields.ts b/client/src/components/ConfigTemplates/fields.ts
new file mode 100644
index 00000000000..33a00f7e69f
--- /dev/null
+++ b/client/src/components/ConfigTemplates/fields.ts
@@ -0,0 +1,25 @@
+import _l from "@/utils/localization";
+
+export const NAME_FIELD = {
+    key: "name",
+    label: _l("Name"),
+    sortable: true,
+};
+
+export const DESCRIPTION_FIELD = {
+    key: "description",
+    label: _l("Description"),
+    sortable: true,
+};
+
+export const TYPE_FIELD = {
+    key: "type",
+    label: _l("Type"),
+    sortable: true,
+};
+
+export const TEMPLATE_FIELD = {
+    key: "template",
+    label: _l("From Template"),
+    sortable: true,
+};
diff --git a/client/src/components/ConfigTemplates/formUtil.test.ts b/client/src/components/ConfigTemplates/formUtil.test.ts
new file mode 100644
index 00000000000..e95caf3d95f
--- /dev/null
+++ b/client/src/components/ConfigTemplates/formUtil.test.ts
@@ -0,0 +1,100 @@
+import { TemplateVariable } from "@/api/configTemplates";
+
+import { createTemplateForm, templateVariableFormEntry, upgradeForm } from "./formUtil";
+import {
+    GENERIC_FTP_FILE_SOURCE_TEMPLATE,
+    OBJECT_STORE_INSTANCE,
+    STANDARD_FILE_SOURCE_TEMPLATE,
+    STANDARD_OBJECT_STORE_TEMPLATE,
+} from "./test_fixtures";
+
+const FTP_VARIABLES = GENERIC_FTP_FILE_SOURCE_TEMPLATE.variables as TemplateVariable[];
+const PROJECT_VARIABLE = {
+    name: "Project",
+    type: "path_component",
+} as TemplateVariable;
+
+describe("formUtils", () => {
+    describe("createTemplateForm", () => {
+        it("should create a form from an object store templates", () => {
+            const form = createTemplateForm(STANDARD_OBJECT_STORE_TEMPLATE, "storage location");
+            expect(form.length).toBe(6);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("_meta_name");
+            expect(formEl0?.help).toEqual("Label this new storage location with a name.");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("_meta_description");
+        });
+
+        it("should create a form from a file source templates", () => {
+            const form = createTemplateForm(STANDARD_FILE_SOURCE_TEMPLATE, "file source");
+            expect(form.length).toBe(6);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("_meta_name");
+            expect(formEl0?.help).toEqual("Label this new file source with a name.");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("_meta_description");
+        });
+    });
+
+    describe("upgradeForm", () => {
+        it("should create a form from an object store templates", () => {
+            const form = upgradeForm(STANDARD_OBJECT_STORE_TEMPLATE, OBJECT_STORE_INSTANCE);
+            expect(form.length).toBe(3);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("oldvar");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("newvar");
+        });
+
+        it("should only ask for new secrets during upgrade", () => {
+            const form = upgradeForm(STANDARD_OBJECT_STORE_TEMPLATE, OBJECT_STORE_INSTANCE);
+            expect(form.length).toBe(3);
+            const formEl0 = form[2];
+            expect(formEl0?.name).toEqual("newsecret");
+            expect(formEl0?.type).toEqual("password");
+        });
+    });
+
+    describe("templateVariableFormEntry", () => {
+        it("should render string types as Galaxy text form inputs", () => {
+            const hostVariable = FTP_VARIABLES[0] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(hostVariable, undefined);
+            expect(formEntry.name).toBe("host");
+            expect(formEntry.label).toBe("FTP Host");
+            expect(formEntry.type).toBe("text");
+            expect(formEntry.help).toBe("<p>Host of FTP Server to connect to.</p>\n");
+        });
+        it("should render integer types as Galaxy integer inputs", () => {
+            const portVariable = FTP_VARIABLES[3] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(portVariable, undefined);
+            expect(formEntry.name).toBe("port");
+            expect(formEntry.label).toBe("FTP Port");
+            expect(formEntry.type).toBe("integer");
+            expect(formEntry.value).toBe(21);
+        });
+        it("should render boolean types as Galaxy boolean inputs", () => {
+            const writableVariable = FTP_VARIABLES[2] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(writableVariable, undefined);
+            expect(formEntry.name).toBe("writable");
+            expect(formEntry.label).toBe("Writable?");
+            expect(formEntry.type).toBe("boolean");
+            expect(formEntry.value).toBe(false);
+        });
+        it("should render path_component types as Galaxy text form inputs", () => {
+            const formEntry = templateVariableFormEntry(PROJECT_VARIABLE, undefined);
+            expect(formEntry.name).toBe("Project");
+            expect(formEntry.label).toBe("Project");
+            expect(formEntry.type).toBe("text");
+        });
+        it("should render path_component updated default values if supplied", () => {
+            const formEntry = templateVariableFormEntry(PROJECT_VARIABLE, "foobar");
+            expect(formEntry.value).toBe("foobar");
+        });
+        it("should render string types with updated default values if supplied", () => {
+            const hostVariable = FTP_VARIABLES[0] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(hostVariable, "mycoolhost.org");
+            expect(formEntry.value).toBe("mycoolhost.org");
+        });
+    });
+});
diff --git a/client/src/components/ConfigTemplates/formUtil.ts b/client/src/components/ConfigTemplates/formUtil.ts
new file mode 100644
index 00000000000..1f65581ffe5
--- /dev/null
+++ b/client/src/components/ConfigTemplates/formUtil.ts
@@ -0,0 +1,236 @@
+import type {
+    Instance,
+    SecretData,
+    TemplateSecret,
+    TemplateSummary,
+    TemplateVariable,
+    VariableData,
+    VariableValueType,
+} from "@/api/configTemplates";
+import { markup } from "@/components/ObjectStore/configurationMarkdown";
+
+export function metadataFormEntryName(what: string) {
+    return {
+        name: "_meta_name",
+        label: "Name",
+        type: "text",
+        optional: false,
+        help: `Label this new ${what} with a name.`,
+    };
+}
+
+export function metadataFormEntryDescription(what: string) {
+    return {
+        name: "_meta_description",
+        label: "Description",
+        optional: true,
+        type: "textarea",
+        help: `Provide some notes to yourself about this ${what} - perhaps to remind you how it is configured, where it stores the data, etc..`,
+    };
+}
+
+export function templateVariableFormEntry(variable: TemplateVariable, variableValue: VariableValueType) {
+    const common_fields = {
+        name: variable.name,
+        label: variable.label ?? variable.name,
+        help: markup(variable.help || "", true),
+    };
+    if (variable.type == "string") {
+        const defaultValue = variable.default ?? "";
+        return {
+            type: "text",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "path_component") {
+        const defaultValue = variable.default ?? "";
+        // TODO: do extra validation with form somehow...
+        return {
+            type: "text",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "integer") {
+        const defaultValue = variable.default ?? 0;
+        return {
+            type: "integer",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "boolean") {
+        const defaultValue = variable.default ?? false;
+        return {
+            type: "boolean",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else {
+        throw Error("Invalid template form input type found.");
+    }
+}
+
+export function templateSecretFormEntry(secret: TemplateSecret) {
+    return {
+        name: secret.name,
+        label: secret.label ?? secret.name,
+        type: "password",
+        help: markup(secret.help || "", true),
+        value: "",
+    };
+}
+
+export function editTemplateForm(template: TemplateSummary, what: string, instance: Instance) {
+    const form = [];
+    const nameInput = metadataFormEntryName(what);
+    form.push({ value: instance.name ?? "", ...nameInput });
+
+    const descriptionInput = metadataFormEntryDescription(what);
+    form.push({ value: instance.description ?? "", ...descriptionInput });
+
+    const variables = template.variables ?? [];
+    const variableValues: VariableData = instance.variables || {};
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
+    }
+    return form;
+}
+
+export function editFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const name = formData["_meta_name"];
+    const description = formData["_meta_description"];
+    const variableData: VariableData = {};
+    for (const variable of variables) {
+        const variableValue = formDataTypedGet(variable, formData);
+        if (variableValue !== undefined) {
+            variableData[variable.name] = variableValue;
+        }
+    }
+    const payload = {
+        name: name,
+        description: description,
+        variables: variableData,
+    };
+    return payload;
+}
+
+export function createTemplateForm(template: TemplateSummary, what: string) {
+    const form = [];
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    form.push(metadataFormEntryName(what));
+    form.push(metadataFormEntryDescription(what));
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, undefined));
+    }
+    for (const secret of secrets) {
+        form.push(templateSecretFormEntry(secret));
+    }
+    return form;
+}
+
+export function createFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    const variableData: VariableData = {};
+    const secretData: SecretData = {};
+    for (const variable of variables) {
+        const variableValue = formDataTypedGet(variable, formData);
+        if (variableValue !== undefined) {
+            variableData[variable.name] = variableValue;
+        }
+    }
+    for (const secret of secrets) {
+        secretData[secret.name] = formData[secret.name];
+    }
+    const name: string = formData._meta_name;
+    const description: string = formData._meta_description;
+    const payload = {
+        name: name,
+        description: description,
+        secrets: secretData,
+        variables: variableData,
+        template_id: template.id,
+        template_version: template.version ?? 0,
+    };
+    return payload;
+}
+
+export function formDataTypedGet(variableDefinition: TemplateVariable, formData: any): VariableValueType {
+    // galaxy form library doesn't type values traditionally, so add a typed
+    // access to the data if coming back as string. Though it does seem to be
+    // typed properly - this might not be needed anymore?
+    const variableType = variableDefinition.type;
+    const variableName = variableDefinition.name;
+    const rawValue: boolean | string | number | null | undefined = formData[variableName];
+    if (variableType == "string") {
+        if (rawValue == null || rawValue == undefined) {
+            return undefined;
+        } else {
+            return String(rawValue);
+        }
+    } else if (variableType == "path_component") {
+        if (rawValue == null || rawValue == undefined) {
+            return undefined;
+        } else {
+            return String(rawValue);
+        }
+    } else if (variableType == "boolean") {
+        if (rawValue == null || rawValue == undefined || typeof rawValue == "number") {
+            return undefined;
+        } else {
+            return String(rawValue).toLowerCase() == "true";
+        }
+    } else if (variableType == "integer") {
+        if (rawValue == null || rawValue == undefined || typeof rawValue == "boolean") {
+            return undefined;
+        } else {
+            if (typeof rawValue == "string") {
+                return parseInt(rawValue);
+            } else {
+                return rawValue;
+            }
+        }
+    } else {
+        throw Error("Unknown variable type encountered, shouldn't be possible.");
+    }
+}
+
+export function upgradeForm(template: TemplateSummary, instance: Instance): Array<any> {
+    const form = [];
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    const variableValues: VariableData = instance.variables || {};
+    const secretsSet = instance.secrets || [];
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
+    }
+    for (const secret of secrets) {
+        const secretName = secret.name;
+        if (secretsSet.indexOf(secretName) >= 0) {
+            console.log("skipping...");
+        } else {
+            form.push(templateSecretFormEntry(secret));
+        }
+    }
+    return form;
+}
+
+export function upgradeFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const variableData: VariableData = {};
+    for (const variable of variables) {
+        variableData[variable.name] = formData[variable.name];
+    }
+    const secrets = {};
+    // ideally we would be able to force a template version here,
+    // maybe rework backend types to force this in the API response
+    // even if we don't need it in the config files
+    const templateVersion: number = template.version || 0;
+    const payload = {
+        template_version: templateVersion,
+        variables: variableData,
+        secrets: secrets,
+    };
+    return payload;
+}
diff --git a/client/src/components/ObjectStore/Instances/icons.ts b/client/src/components/ConfigTemplates/icons.ts
similarity index 100%
rename from client/src/components/ObjectStore/Instances/icons.ts
rename to client/src/components/ConfigTemplates/icons.ts
diff --git a/client/src/components/ConfigTemplates/test_fixtures.ts b/client/src/components/ConfigTemplates/test_fixtures.ts
new file mode 100644
index 00000000000..9e90afa3396
--- /dev/null
+++ b/client/src/components/ConfigTemplates/test_fixtures.ts
@@ -0,0 +1,122 @@
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+import type { UserConcreteObjectStore } from "@/components/ObjectStore/Instances/types";
+import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templates/types";
+
+export const STANDARD_OBJECT_STORE_TEMPLATE: ObjectStoreTemplateSummary = {
+    type: "aws_s3",
+    name: "moo",
+    description: null,
+    variables: [
+        {
+            name: "oldvar",
+            type: "string",
+            help: "old var help",
+        },
+        {
+            name: "newvar",
+            type: "string",
+            help: "new var help",
+        },
+    ],
+    secrets: [
+        {
+            name: "oldsecret",
+            help: "old secret help",
+        },
+        {
+            name: "newsecret",
+            help: "new secret help",
+        },
+    ],
+    id: "moo",
+    version: 2,
+    badges: [],
+};
+
+export const STANDARD_FILE_SOURCE_TEMPLATE: FileSourceTemplateSummary = {
+    type: "s3fs",
+    name: "moo",
+    description: null,
+    variables: [
+        {
+            name: "oldvar",
+            type: "string",
+            help: "old var help",
+        },
+        {
+            name: "newvar",
+            type: "string",
+            help: "new var help",
+        },
+    ],
+    secrets: [
+        {
+            name: "oldsecret",
+            help: "old secret help",
+        },
+        {
+            name: "newsecret",
+            help: "new secret help",
+        },
+    ],
+    id: "moo",
+    version: 2,
+};
+
+export const GENERIC_FTP_FILE_SOURCE_TEMPLATE: FileSourceTemplateSummary = {
+    id: "ftp",
+    type: "ftp",
+    name: "Generic FTP Server",
+    description: "Generic FTP configuration with all configuration options exposed.",
+    variables: [
+        { name: "host", label: "FTP Host", type: "string", help: "Host of FTP Server to connect to." },
+        {
+            name: "user",
+            label: "FTP User",
+            type: "string",
+            help: "Username to login to target FTP server with.",
+        },
+        {
+            name: "writable",
+            label: "Writable?",
+            type: "boolean",
+            help: "Is this an FTP server you have permission to write to?",
+            default: false,
+        },
+        {
+            name: "port",
+            label: "FTP Port",
+            type: "integer",
+            help: "Port used to connect to the FTP server.",
+            default: 21,
+        },
+    ],
+    secrets: [
+        {
+            name: "password",
+            label: "FTP Password",
+            help: "Password to connect to FTP server with.",
+        },
+    ],
+};
+
+export const OBJECT_STORE_INSTANCE: UserConcreteObjectStore = {
+    type: "aws_s3",
+    name: "moo",
+    description: undefined,
+    template_id: "moo",
+    template_version: 1,
+    badges: [],
+    variables: {
+        oldvar: "my old value",
+        droppedvar: "this will be dropped",
+    },
+    secrets: ["oldsecret", "droppedsecret"],
+    quota: { enabled: false },
+    private: false,
+    id: 4,
+    uuid: "112f889f-72d7-4619-a8e8-510a8c685aa7",
+    active: true,
+    hidden: false,
+    purged: false,
+};
diff --git a/client/src/components/ConfigTemplates/useInstanceFiltering.ts b/client/src/components/ConfigTemplates/useInstanceFiltering.ts
new file mode 100644
index 00000000000..6428b284f68
--- /dev/null
+++ b/client/src/components/ConfigTemplates/useInstanceFiltering.ts
@@ -0,0 +1,13 @@
+import { computed, type Ref } from "vue";
+
+import { type Instance } from "@/api/configTemplates";
+
+export function useFiltering<T extends Instance>(allInstances: Ref<T[]>) {
+    const activeInstances = computed(() => {
+        return allInstances.value.filter((item: T) => !item.hidden);
+    });
+
+    return {
+        activeInstances,
+    };
+}
diff --git a/client/src/components/FileSources/FileSourceTypeSpan.vue b/client/src/components/FileSources/FileSourceTypeSpan.vue
new file mode 100644
index 00000000000..538b635c4a4
--- /dev/null
+++ b/client/src/components/FileSources/FileSourceTypeSpan.vue
@@ -0,0 +1,23 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+const MESSAGES = {
+    posix: "This is a simple path based object store that assumes the all the relevant paths are already mounted on the Galaxy server and target worker nodes.",
+    s3fs: "This is an remote file source plugin based on the Amazon Simple Storage Service (S3) interface. The AWS interface has become an industry standard and many storage vendors support it and use it to expose 'object' based storage.",
+};
+
+interface Props {
+    type: "posix" | "s3fs";
+}
+
+const props = defineProps<Props>();
+const title = computed<string>(() => MESSAGES[props.type] ?? "");
+</script>
+
+<template>
+    <span v-b-tooltip.hover class="file-source-type file-source-help-on-hover" :title="title">{{ type }}</span>
+</template>
+
+<style scoped>
+@import "./style.css";
+</style>
diff --git a/client/src/components/FileSources/Instances/CreateForm.vue b/client/src/components/FileSources/Instances/CreateForm.vue
new file mode 100644
index 00000000000..7d8a8b7ecef
--- /dev/null
+++ b/client/src/components/FileSources/Instances/CreateForm.vue
@@ -0,0 +1,53 @@
+<script lang="ts" setup>
+import { BAlert } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { createFormDataToPayload, createTemplateForm } from "@/components/ConfigTemplates/formUtil";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { create } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface CreateFormProps {
+    template: FileSourceTemplateSummary;
+}
+const error = ref<string | null>(null);
+const props = defineProps<CreateFormProps>();
+const title = "Create a new file source for your data";
+const submitTitle = "Submit";
+const loadingMessage = "Loading file source template and instance information";
+
+const inputs = computed(() => {
+    return createTemplateForm(props.template, "file source");
+});
+
+async function onSubmit(formData: any) {
+    const payload = createFormDataToPayload(props.template, formData);
+    try {
+        const { data: fileSource } = await create(payload);
+        emit("created", fileSource);
+    } catch (e) {
+        error.value = errorMessageAsString(e);
+        return;
+    }
+}
+
+const emit = defineEmits<{
+    (e: "created", fileSource: UserFileSourceModel): void;
+}>();
+</script>
+<template>
+    <div id="create-file-source-landing">
+        <BAlert v-if="error" variant="danger" class="file-source-instance-creation-error" show>
+            {{ error }}
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/CreateInstance.vue b/client/src/components/FileSources/Instances/CreateInstance.vue
new file mode 100644
index 00000000000..9b93e2d7c26
--- /dev/null
+++ b/client/src/components/FileSources/Instances/CreateInstance.vue
@@ -0,0 +1,34 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import { useInstanceRouting } from "./routing";
+
+import CreateForm from "@/components/FileSources/Instances/CreateForm.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    templateId: string;
+}
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+fileSourceTemplatesStore.fetchTemplates();
+
+const { goToIndex } = useInstanceRouting();
+
+const props = defineProps<Props>();
+const template = computed(() => fileSourceTemplatesStore.getLatestTemplate(props.templateId));
+
+async function onCreated(objectStore: UserFileSourceModel) {
+    const message = `Created file source ${objectStore.name}`;
+    goToIndex({ message });
+}
+</script>
+
+<template>
+    <div>
+        <LoadingSpan v-if="!template" message="Loading file source templates" />
+        <CreateForm v-else :template="template" @created="onCreated"></CreateForm>
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/EditInstance.vue b/client/src/components/FileSources/Instances/EditInstance.vue
new file mode 100644
index 00000000000..311bb7fdc83
--- /dev/null
+++ b/client/src/components/FileSources/Instances/EditInstance.vue
@@ -0,0 +1,77 @@
+<script setup lang="ts">
+import { BTab, BTabs } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { editFormDataToPayload, editTemplateForm } from "@/components/ConfigTemplates/formUtil";
+
+import { useInstanceAndTemplate } from "./instance";
+import { useInstanceRouting } from "./routing";
+import { update } from "./services";
+
+import EditSecrets from "./EditSecrets.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface Props {
+    instanceId: number | string;
+}
+
+const props = defineProps<Props>();
+const { instance, template } = useInstanceAndTemplate(ref(props.instanceId));
+
+const inputs = computed(() => {
+    template.value;
+    instance.value;
+    if (template.value && instance.value) {
+        return editTemplateForm(template.value, "storage location", instance.value);
+    }
+    return null;
+});
+
+const title = computed(() => `Edit File Source ${instance.value?.name} Settings`);
+const hasSecrets = computed(() => instance.value?.secrets && instance.value?.secrets.length > 0);
+const submitTitle = "Update Settings";
+const loadingMessage = "Loading file source template and instance information";
+
+async function onSubmit(formData: any) {
+    if (template.value) {
+        const payload = editFormDataToPayload(template.value, formData);
+        const args = { user_file_source_id: String(instance?.value?.id) };
+        const { data: fileSource } = await update({ ...args, ...payload });
+        await onUpdate(fileSource);
+    }
+}
+
+const { goToIndex } = useInstanceRouting();
+
+async function onUpdate(instance: UserFileSourceModel) {
+    const message = `Updated file source ${instance.name}`;
+    goToIndex({ message });
+}
+</script>
+<template>
+    <div>
+        <BTabs v-if="hasSecrets">
+            <BTab title="Settings" active>
+                <InstanceForm
+                    :inputs="inputs"
+                    :title="title"
+                    :submit-title="submitTitle"
+                    :loading-message="loadingMessage"
+                    @onSubmit="onSubmit" />
+            </BTab>
+            <BTab title="Secrets">
+                <div v-if="instance && template">
+                    <EditSecrets :file-source="instance" :template="template" />
+                </div>
+            </BTab>
+        </BTabs>
+        <InstanceForm
+            v-else
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/EditSecrets.vue b/client/src/components/FileSources/Instances/EditSecrets.vue
new file mode 100644
index 00000000000..dd14126a124
--- /dev/null
+++ b/client/src/components/FileSources/Instances/EditSecrets.vue
@@ -0,0 +1,28 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+
+import { update } from "./services";
+
+import EditSecretsForm from "@/components/ConfigTemplates/EditSecretsForm.vue";
+
+interface Props {
+    fileSource: UserFileSourceModel;
+    template: FileSourceTemplateSummary;
+}
+const props = defineProps<Props>();
+const title = computed(() => `Update File Source ${props.fileSource?.name} Secrets`);
+
+async function onUpdate(secretName: string, secretValue: string) {
+    const payload = {
+        secret_name: secretName,
+        secret_value: secretValue,
+    };
+    const args = { user_file_source_id: String(props.fileSource.id) };
+    await update({ ...args, ...payload });
+}
+</script>
+<template>
+    <EditSecretsForm :title="title" :template="template" @update="onUpdate" />
+</template>
diff --git a/client/src/components/FileSources/Instances/InstanceDropdown.vue b/client/src/components/FileSources/Instances/InstanceDropdown.vue
new file mode 100644
index 00000000000..f71e3fd2302
--- /dev/null
+++ b/client/src/components/FileSources/Instances/InstanceDropdown.vue
@@ -0,0 +1,30 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import InstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+interface Props {
+    fileSource: UserFileSourceModel;
+}
+
+const props = defineProps<Props>();
+const routeEdit = computed(() => `/file_source_instances/${props.fileSource.id}/edit`);
+const routeUpgrade = computed(() => `/file_source_instances/${props.fileSource.id}/upgrade`);
+const isUpgradable = computed(() =>
+    fileSourceTemplatesStore.canUpgrade(props.fileSource.template_id, props.fileSource.template_version)
+);
+</script>
+
+<template>
+    <InstanceDropdown
+        prefix="file-source"
+        :name="fileSource.name || ''"
+        :is-upgradable="isUpgradable"
+        :route-upgrade="routeUpgrade"
+        :route-edit="routeEdit" />
+</template>
diff --git a/client/src/components/FileSources/Instances/ManageIndex.vue b/client/src/components/FileSources/Instances/ManageIndex.vue
new file mode 100644
index 00000000000..e064a873a99
--- /dev/null
+++ b/client/src/components/FileSources/Instances/ManageIndex.vue
@@ -0,0 +1,69 @@
+<script setup lang="ts">
+import "@/components/ConfigTemplates/icons";
+
+import { BTable } from "bootstrap-vue";
+import { computed } from "vue";
+
+import { DESCRIPTION_FIELD, NAME_FIELD, TEMPLATE_FIELD, TYPE_FIELD } from "@/components/ConfigTemplates/fields";
+import { useFileSourceInstancesStore } from "@/stores/fileSourceInstancesStore";
+
+import InstanceDropdown from "./InstanceDropdown.vue";
+import ManageIndexHeader from "@/components/ConfigTemplates/ManageIndexHeader.vue";
+import FileSourceTypeSpan from "@/components/FileSources/FileSourceTypeSpan.vue";
+import TemplateSummarySpan from "@/components/FileSources/Templates/TemplateSummarySpan.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+const fileSourceInstancesStore = useFileSourceInstancesStore();
+
+interface Props {
+    message: String | undefined | null;
+}
+
+defineProps<Props>();
+
+const fields = [NAME_FIELD, DESCRIPTION_FIELD, TYPE_FIELD, TEMPLATE_FIELD];
+
+const items = computed(() => fileSourceInstancesStore.getInstances);
+const loading = computed(() => fileSourceInstancesStore.loading);
+fileSourceInstancesStore.fetchInstances();
+</script>
+
+<template>
+    <div>
+        <ManageIndexHeader
+            :message="message"
+            create-button-id="file-source-create"
+            create-route="/file_source_instances/create">
+        </ManageIndexHeader>
+        <BTable
+            id="user-file-sources-index"
+            no-sort-reset
+            :fields="fields"
+            :items="items"
+            :hover="true"
+            :striped="true"
+            :caption-top="true"
+            :fixed="true"
+            :show-empty="true">
+            <template v-slot:empty>
+                <LoadingSpan v-if="loading" message="Loading your user's file source instances" />
+                <b-alert v-else id="no-file-source-instances" variant="info" show>
+                    <div>
+                        No file source instances found for your users, click the create button to configure a new one.
+                    </div>
+                </b-alert>
+            </template>
+            <template v-slot:cell(name)="row">
+                <InstanceDropdown :file-source="row.item" />
+            </template>
+            <template v-slot:cell(type)="row">
+                <FileSourceTypeSpan :type="row.item.type" />
+            </template>
+            <template v-slot:cell(template)="row">
+                <TemplateSummarySpan
+                    :template-version="row.item.template_version ?? 0"
+                    :template-id="row.item.template_id" />
+            </template>
+        </BTable>
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/UpgradeForm.vue b/client/src/components/FileSources/Instances/UpgradeForm.vue
new file mode 100644
index 00000000000..4ca85e7caf6
--- /dev/null
+++ b/client/src/components/FileSources/Instances/UpgradeForm.vue
@@ -0,0 +1,63 @@
+<script setup lang="ts">
+import { BAlert } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { upgradeForm, upgradeFormDataToPayload } from "@/components/ConfigTemplates/formUtil";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { useInstanceRouting } from "./routing";
+import { update } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface Props {
+    instance: UserFileSourceModel;
+    latestTemplate: FileSourceTemplateSummary;
+}
+
+const error = ref<string | null>(null);
+const props = defineProps<Props>();
+
+const inputs = computed<Array<any> | null>(() => {
+    const realizedInstance: UserFileSourceModel = props.instance;
+    const realizedLatestTemplate = props.latestTemplate;
+    const form = upgradeForm(realizedLatestTemplate, realizedInstance);
+    return form;
+});
+const title = computed(() => `Upgrade File Source ${props.instance.name}`);
+const submitTitle = "Update Settings";
+const loadingMessage = "Loading file source template and instance information";
+
+async function onSubmit(formData: any) {
+    const payload = upgradeFormDataToPayload(props.latestTemplate, formData);
+    const args = { user_file_source_id: String(props.instance.id) };
+    try {
+        const { data: fileSource } = await update({ ...args, ...payload });
+        await onUpgrade(fileSource);
+    } catch (e) {
+        error.value = errorMessageAsString(e);
+        return;
+    }
+}
+
+const { goToIndex } = useInstanceRouting();
+
+async function onUpgrade(fileSource: UserFileSourceModel) {
+    const message = `Upgraded file source ${fileSource.name}`;
+    goToIndex({ message });
+}
+</script>
+<template>
+    <div>
+        <BAlert v-if="error" variant="danger" class="file-source-instance-upgrade-error" show>
+            {{ error }}
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/UpgradeInstance.vue b/client/src/components/FileSources/Instances/UpgradeInstance.vue
new file mode 100644
index 00000000000..a2aa1ed672f
--- /dev/null
+++ b/client/src/components/FileSources/Instances/UpgradeInstance.vue
@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { computed, ref } from "vue";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import { useInstanceAndTemplate } from "./instance";
+
+import UpgradeForm from "./UpgradeForm.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    instanceId: number | string;
+}
+
+const props = defineProps<Props>();
+const { instance } = useInstanceAndTemplate(ref(props.instanceId));
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+const latestTemplate = computed(
+    () => instance.value && fileSourceTemplatesStore.getLatestTemplate(instance.value?.template_id)
+);
+</script>
+<template>
+    <LoadingSpan v-if="!instance || !latestTemplate" message="Loading file source instance and templates" />
+    <UpgradeForm v-else :instance="instance" :latest-template="latestTemplate" />
+</template>
diff --git a/client/src/components/FileSources/Instances/instance.ts b/client/src/components/FileSources/Instances/instance.ts
new file mode 100644
index 00000000000..f45fd6bf76d
--- /dev/null
+++ b/client/src/components/FileSources/Instances/instance.ts
@@ -0,0 +1,23 @@
+import { computed, type Ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceInstancesStore } from "@/stores/fileSourceInstancesStore";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+export function useInstanceAndTemplate(instanceIdRef: Ref<string | number>) {
+    const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+    const fileSourceInstancesStore = useFileSourceInstancesStore();
+    fileSourceInstancesStore.fetchInstances();
+    fileSourceTemplatesStore.fetchTemplates();
+
+    const instance = computed<UserFileSourceModel | null>(
+        () => fileSourceInstancesStore.getInstance(instanceIdRef.value) || null
+    );
+    const template = computed<FileSourceTemplateSummary | null>(() =>
+        instance.value
+            ? fileSourceTemplatesStore.getTemplate(instance.value?.template_id, instance.value?.template_version)
+            : null
+    );
+
+    return { instance, template };
+}
diff --git a/client/src/components/FileSources/Instances/routing.ts b/client/src/components/FileSources/Instances/routing.ts
new file mode 100644
index 00000000000..6d2ed12bae6
--- /dev/null
+++ b/client/src/components/FileSources/Instances/routing.ts
@@ -0,0 +1,16 @@
+import { useRouter } from "vue-router/composables";
+
+export function useInstanceRouting() {
+    const router = useRouter();
+
+    async function goToIndex(query: Record<"message", string>) {
+        router.push({
+            path: "/file_source_instances/index",
+            query: query,
+        });
+    }
+
+    return {
+        goToIndex,
+    };
+}
diff --git a/client/src/components/FileSources/Instances/services.ts b/client/src/components/FileSources/Instances/services.ts
new file mode 100644
index 00000000000..d5d4b855382
--- /dev/null
+++ b/client/src/components/FileSources/Instances/services.ts
@@ -0,0 +1,4 @@
+import { fetcher } from "@/api/schema/fetcher";
+
+export const create = fetcher.path("/api/file_source_instances").method("post").create();
+export const update = fetcher.path("/api/file_source_instances/{user_file_source_id}").method("put").create();
diff --git a/client/src/components/FileSources/Templates/CreateUserFileSource.vue b/client/src/components/FileSources/Templates/CreateUserFileSource.vue
new file mode 100644
index 00000000000..5cc4a9f8e3a
--- /dev/null
+++ b/client/src/components/FileSources/Templates/CreateUserFileSource.vue
@@ -0,0 +1,30 @@
+<script lang="ts" setup>
+import { computed } from "vue";
+import { useRouter } from "vue-router/composables";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import SelectTemplate from "./SelectTemplate.vue";
+import CreateInstance from "@/components/ConfigTemplates/CreateInstance.vue";
+
+const loadingTemplatesInfoMessage = "Loading file source templates";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+fileSourceTemplatesStore.ensureTemplates();
+
+const templates = computed(() => fileSourceTemplatesStore.latestTemplates);
+const loading = computed(() => fileSourceTemplatesStore.loading);
+
+const router = useRouter();
+
+async function chooseTemplate(selectTemplateId: string) {
+    router.push({
+        path: `/file_source_templates/${selectTemplateId}/new`,
+    });
+}
+</script>
+<template>
+    <CreateInstance :loading-message="loadingTemplatesInfoMessage" :loading="loading" prefix="file-source">
+        <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
+    </CreateInstance>
+</template>
diff --git a/client/src/components/FileSources/Templates/SelectTemplate.vue b/client/src/components/FileSources/Templates/SelectTemplate.vue
new file mode 100644
index 00000000000..6e45ab9f8d3
--- /dev/null
+++ b/client/src/components/FileSources/Templates/SelectTemplate.vue
@@ -0,0 +1,39 @@
+<script lang="ts" setup>
+import type { FileSourceTemplateSummaries } from "@/api/fileSources";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+import SelectTemplate from "@/components/ConfigTemplates/SelectTemplate.vue";
+
+interface Props {
+    templates: FileSourceTemplateSummaries;
+}
+
+defineProps<Props>();
+
+const selectText =
+    "Select file source template to create new file sources with. These templates are configured by your Galaxy administrator.";
+
+const emit = defineEmits<{
+    (e: "onSubmit", id: string): void;
+}>();
+
+async function handleSubmit(templateId: string) {
+    emit("onSubmit", templateId);
+}
+</script>
+
+<template>
+    <div>
+        <SelectTemplate
+            :templates="templates"
+            :select-text="selectText"
+            id-prefix="file-source"
+            @onSubmit="handleSubmit">
+        </SelectTemplate>
+        <TemplateSummaryPopover
+            v-for="template in templates"
+            :key="template.id"
+            :target="`file-source-template-button-${template.id}`"
+            :template="template" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummary.vue b/client/src/components/FileSources/Templates/TemplateSummary.vue
new file mode 100644
index 00000000000..6cef09f37ed
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummary.vue
@@ -0,0 +1,22 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+
+import FileSourceTypeSpan from "@/components/FileSources/FileSourceTypeSpan.vue";
+import ConfigurationMarkdown from "@/components/ObjectStore/ConfigurationMarkdown.vue";
+
+interface Props {
+    template: FileSourceTemplateSummary;
+}
+
+const props = defineProps<Props>();
+const fileSourceType = computed(() => props.template.type);
+</script>
+
+<template>
+    <div>
+        <div>This template produces file sources of type <FileSourceTypeSpan :type="fileSourceType" />.</div>
+        <ConfigurationMarkdown :markdown="template.description || ''" :admin="true" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue b/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue
new file mode 100644
index 00000000000..c056e03d9b7
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue
@@ -0,0 +1,19 @@
+<script lang="ts" setup>
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+
+import TemplateSummary from "./TemplateSummary.vue";
+import TemplateSummaryPopover from "@/components/ConfigTemplates/TemplateSummaryPopover.vue";
+
+interface Props {
+    target: String;
+    template: FileSourceTemplateSummary;
+}
+
+defineProps<Props>();
+</script>
+
+<template>
+    <TemplateSummaryPopover :target="target" :template="template">
+        <TemplateSummary :template="template" />
+    </TemplateSummaryPopover>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummarySpan.vue b/client/src/components/FileSources/Templates/TemplateSummarySpan.vue
new file mode 100644
index 00000000000..1c4291dc3aa
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummarySpan.vue
@@ -0,0 +1,32 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+interface Props {
+    templateId: string;
+    templateVersion: number;
+}
+
+const props = defineProps<Props>();
+
+const template = computed(() => fileSourceTemplatesStore.getTemplate(props.templateId, props.templateVersion));
+const target = `template-summary-span-${crypto.randomUUID()}`;
+fileSourceTemplatesStore.ensureTemplates();
+</script>
+
+<template>
+    <span>
+        <span v-if="template">
+            <span :id="target">
+                {{ template.name }}
+            </span>
+            <TemplateSummaryPopover :template="template" :target="target" />
+        </span>
+        <span v-else> Loading template information for {{ templateId }} {{ templateVersion }} </span>
+    </span>
+</template>
diff --git a/client/src/components/FileSources/style.css b/client/src/components/FileSources/style.css
new file mode 100644
index 00000000000..c2962e44de2
--- /dev/null
+++ b/client/src/components/FileSources/style.css
@@ -0,0 +1,4 @@
+.file-source-help-on-hover {
+    text-decoration-line: underline;
+    text-decoration-style: dashed;
+}
diff --git a/client/src/components/ObjectStore/Instances/CreateForm.test.ts b/client/src/components/ObjectStore/Instances/CreateForm.test.ts
index 381817bc8d5..0c631d31c0a 100644
--- a/client/src/components/ObjectStore/Instances/CreateForm.test.ts
+++ b/client/src/components/ObjectStore/Instances/CreateForm.test.ts
@@ -14,7 +14,7 @@ const FAKE_OBJECT_STORE = "A fake object store";
 const localVue = getLocalVue(true);
 
 const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
@@ -36,7 +36,7 @@ const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
 };
 
 const SIMPLE_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
diff --git a/client/src/components/ObjectStore/Instances/CreateForm.vue b/client/src/components/ObjectStore/Instances/CreateForm.vue
index e82f0f1c484..ddadbfccda6 100644
--- a/client/src/components/ObjectStore/Instances/CreateForm.vue
+++ b/client/src/components/ObjectStore/Instances/CreateForm.vue
@@ -1,18 +1,15 @@
 <script lang="ts" setup>
+import { BAlert } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
-import { create } from "@/components/ObjectStore/Instances/services";
-import type { SecretData, UserConcreteObjectStore, VariableData } from "@/components/ObjectStore/Instances/types";
-import {
-    metadataFormEntryDescription,
-    metadataFormEntryName,
-    templateSecretFormEntry,
-    templateVariableFormEntry,
-} from "@/components/ObjectStore/Instances/util";
+import { createFormDataToPayload, createTemplateForm } from "@/components/ConfigTemplates/formUtil";
+import type { UserConcreteObjectStore } from "@/components/ObjectStore/Instances/types";
 import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templates/types";
 import { errorMessageAsString } from "@/utils/simple-error";
 
-import InstanceForm from "./InstanceForm.vue";
+import { create } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface CreateFormProps {
     template: ObjectStoreTemplateSummary;
@@ -21,43 +18,14 @@ const error = ref<string | null>(null);
 const props = defineProps<CreateFormProps>();
 const title = "Create a new storage location for your data";
 const submitTitle = "Submit";
+const loadingMessage = "Loading storage location template and instance information";
 
 const inputs = computed(() => {
-    const form = [];
-    const variables = props.template.variables ?? [];
-    const secrets = props.template.secrets ?? [];
-    form.push(metadataFormEntryName());
-    form.push(metadataFormEntryDescription());
-    for (const variable of variables) {
-        form.push(templateVariableFormEntry(variable, undefined));
-    }
-    for (const secret of secrets) {
-        form.push(templateSecretFormEntry(secret));
-    }
-    return form;
+    return createTemplateForm(props.template, "storage location");
 });
 
 async function onSubmit(formData: any) {
-    const variables = props.template.variables ?? [];
-    const secrets = props.template.secrets ?? [];
-    const variableData: VariableData = {};
-    const secretData: SecretData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
-    }
-    for (const secret of secrets) {
-        secretData[secret.name] = formData[secret.name];
-    }
-    const name: string = formData._meta_name;
-    const description: string = formData._meta_description;
-    const payload = {
-        name: name,
-        description: description,
-        secrets: secretData,
-        variables: variableData,
-        template_id: props.template.id,
-        template_version: props.template.version ?? 0,
-    };
+    const payload = createFormDataToPayload(props.template, formData);
     try {
         const { data: objectStore } = await create(payload);
         emit("created", objectStore);
@@ -72,10 +40,15 @@ const emit = defineEmits<{
 }>();
 </script>
 <template>
-    <div>
-        <b-alert v-if="error" variant="danger" class="object-store-instance-creation-error" show>
+    <div id="create-object-store-landing">
+        <BAlert v-if="error" variant="danger" class="object-store-instance-creation-error" show>
             {{ error }}
-        </b-alert>
-        <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/EditInstance.vue b/client/src/components/ObjectStore/Instances/EditInstance.vue
index 16e4dd9c463..2569be94017 100644
--- a/client/src/components/ObjectStore/Instances/EditInstance.vue
+++ b/client/src/components/ObjectStore/Instances/EditInstance.vue
@@ -1,19 +1,16 @@
 <script setup lang="ts">
+import { BTab, BTabs } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
-import {
-    metadataFormEntryDescription,
-    metadataFormEntryName,
-    templateVariableFormEntry,
-} from "@/components/ObjectStore/Instances/util";
+import { editFormDataToPayload, editTemplateForm } from "@/components/ConfigTemplates/formUtil";
 
 import { useInstanceAndTemplate } from "./instance";
 import { useInstanceRouting } from "./routing";
 import { update } from "./services";
-import type { UserConcreteObjectStore, VariableData } from "./types";
+import type { UserConcreteObjectStore } from "./types";
 
 import EditSecrets from "./EditSecrets.vue";
-import InstanceForm from "./InstanceForm.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface Props {
     instanceId: number | string;
@@ -23,47 +20,26 @@ const props = defineProps<Props>();
 const { instance, template } = useInstanceAndTemplate(ref(props.instanceId));
 
 const inputs = computed(() => {
-    if (!template.value || !instance.value) {
-        return null;
-    }
-    const form = [];
-    const nameInput = metadataFormEntryName();
-    form.push({ value: instance?.value?.name ?? "", ...nameInput });
-
-    const descriptionInput = metadataFormEntryDescription();
-    form.push({ value: instance?.value?.description ?? "", ...descriptionInput });
-
+    template.value;
+    instance.value;
     if (template.value && instance.value) {
-        const realizedInstance: UserConcreteObjectStore = instance.value;
-        const variables = template.value?.variables ?? [];
-        const variableValues: VariableData = realizedInstance.variables || {};
-        for (const variable of variables) {
-            form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
-        }
+        return editTemplateForm(template.value, "storage location", instance.value);
     }
-    return form;
+    return null;
 });
 
 const title = computed(() => `Edit Storage Location ${instance.value?.name} Settings`);
 const hasSecrets = computed(() => instance.value?.secrets && instance.value?.secrets.length > 0);
 const submitTitle = "Update Settings";
+const loadingMessage = "Loading storage location template and instance information";
 
 async function onSubmit(formData: any) {
-    const variables = template?.value?.variables ?? [];
-    const name = formData["_meta_name"];
-    const description = formData["_meta_description"];
-    const variableData: VariableData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
+    if (template.value) {
+        const payload = editFormDataToPayload(template.value, formData);
+        const args = { user_object_store_id: String(instance?.value?.id) };
+        const { data: objectStore } = await update({ ...args, ...payload });
+        await onUpdate(objectStore);
     }
-    const payload = {
-        name: name,
-        description: description,
-        variables: variableData,
-    };
-    const args = { user_object_store_id: String(instance?.value?.id) };
-    const { data: objectStore } = await update({ ...args, ...payload });
-    await onUpdate(objectStore);
 }
 
 const { goToIndex } = useInstanceRouting();
@@ -75,16 +51,27 @@ async function onUpdate(objectStore: UserConcreteObjectStore) {
 </script>
 <template>
     <div>
-        <b-tabs v-if="hasSecrets">
-            <b-tab title="Settings" active>
-                <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
-            </b-tab>
-            <b-tab title="Secrets">
+        <BTabs v-if="hasSecrets">
+            <BTab title="Settings" active>
+                <InstanceForm
+                    :inputs="inputs"
+                    :title="title"
+                    :submit-title="submitTitle"
+                    :loading-message="loadingMessage"
+                    @onSubmit="onSubmit" />
+            </BTab>
+            <BTab title="Secrets">
                 <div v-if="instance && template">
                     <EditSecrets :object-store="instance" :template="template" />
                 </div>
-            </b-tab>
-        </b-tabs>
-        <InstanceForm v-else :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+            </BTab>
+        </BTabs>
+        <InstanceForm
+            v-else
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/EditSecrets.vue b/client/src/components/ObjectStore/Instances/EditSecrets.vue
index 42038241d42..56c1e7cd964 100644
--- a/client/src/components/ObjectStore/Instances/EditSecrets.vue
+++ b/client/src/components/ObjectStore/Instances/EditSecrets.vue
@@ -6,8 +6,7 @@ import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templa
 import { update } from "./services";
 import type { UserConcreteObjectStore } from "./types";
 
-import VaultSecret from "./VaultSecret.vue";
-import FormCard from "@/components/Form/FormCard.vue";
+import EditSecretsForm from "@/components/ConfigTemplates/EditSecretsForm.vue";
 
 interface Props {
     objectStore: UserConcreteObjectStore;
@@ -26,14 +25,5 @@ async function onUpdate(secretName: string, secretValue: string) {
 }
 </script>
 <template>
-    <FormCard :title="title">
-        <template v-slot:body>
-            <div>
-                <div v-for="secret in template.secrets" :key="secret.name">
-                    <VaultSecret :name="secret.name" :help="secret.help || ''" :is-set="true" @update="onUpdate">
-                    </VaultSecret>
-                </div>
-            </div>
-        </template>
-    </FormCard>
+    <EditSecretsForm :title="title" :template="template" @update="onUpdate" />
 </template>
diff --git a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
index aaa2836c828..e62239dc681 100644
--- a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
+++ b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
@@ -1,19 +1,14 @@
 <script setup lang="ts">
-import "./icons";
-
-import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { computed } from "vue";
-import { useRouter } from "vue-router/composables";
 
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 
+import { hide } from "./services";
 import type { UserConcreteObjectStore } from "./types";
 
-const objectStoreTemplatesStore = useObjectStoreTemplatesStore();
-const router = useRouter();
+import InstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
 
-// TODO?
-const title = "";
+const objectStoreTemplatesStore = useObjectStoreTemplatesStore();
 
 interface Props {
     objectStore: UserConcreteObjectStore;
@@ -25,33 +20,19 @@ const routeUpgrade = computed(() => `/object_store_instances/${props.objectStore
 const isUpgradable = computed(() =>
     objectStoreTemplatesStore.canUpgrade(props.objectStore.template_id, props.objectStore.template_version)
 );
+
+async function onRemove() {
+    await hide(props.objectStore);
+    console.log("HIDING!!!");
+}
 </script>
 
 <template>
-    <div>
-        <b-link
-            v-b-tooltip.hover
-            class="object-store-instance-dropdown font-weight-bold"
-            data-toggle="dropdown"
-            :title="title"
-            aria-haspopup="true"
-            aria-expanded="false">
-            <FontAwesomeIcon icon="caret-down" />
-            <span class="instance-dropdown-name">{{ props.objectStore.name }}</span>
-        </b-link>
-        <div class="dropdown-menu" aria-labelledby="object-store-instance-dropdown">
-            <a
-                v-if="isUpgradable"
-                class="dropdown-item"
-                @keypress="router.push(routeUpgrade)"
-                @click.prevent="router.push(routeUpgrade)">
-                <span class="fa fa-edit fa-fw mr-1" />
-                <span v-localize>Upgrade</span>
-            </a>
-            <a class="dropdown-item" @keypress="router.push(routeEdit)" @click.prevent="router.push(routeEdit)">
-                <span class="fa fa-edit fa-fw mr-1" />
-                <span v-localize>Edit configuration</span>
-            </a>
-        </div>
-    </div>
+    <InstanceDropdown
+        prefix="object-store"
+        :name="objectStore.name || ''"
+        :is-upgradable="isUpgradable"
+        :route-upgrade="routeUpgrade"
+        :route-edit="routeEdit"
+        @remove="onRemove" />
 </template>
diff --git a/client/src/components/ObjectStore/Instances/ManageIndex.vue b/client/src/components/ObjectStore/Instances/ManageIndex.vue
index 9695f492dad..1dd1c718c8d 100644
--- a/client/src/components/ObjectStore/Instances/ManageIndex.vue
+++ b/client/src/components/ObjectStore/Instances/ManageIndex.vue
@@ -1,20 +1,22 @@
 <script setup lang="ts">
-import "./icons";
+import "@/components/ConfigTemplates/icons";
 
-import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BTable } from "bootstrap-vue";
 import { computed } from "vue";
-import { useRouter } from "vue-router/composables";
 
+import type { UserConcreteObjectStore } from "@/api/objectStores";
+import { DESCRIPTION_FIELD, NAME_FIELD, TEMPLATE_FIELD, TYPE_FIELD } from "@/components/ConfigTemplates/fields";
+import { useFiltering } from "@/components/ConfigTemplates/useInstanceFiltering";
 import { useObjectStoreInstancesStore } from "@/stores/objectStoreInstancesStore";
 import _l from "@/utils/localization";
 
 import InstanceDropdown from "./InstanceDropdown.vue";
+import ManageIndexHeader from "@/components/ConfigTemplates/ManageIndexHeader.vue";
 import LoadingSpan from "@/components/LoadingSpan.vue";
 import ObjectStoreBadges from "@/components/ObjectStore/ObjectStoreBadges.vue";
 import ObjectStoreTypeSpan from "@/components/ObjectStore/ObjectStoreTypeSpan.vue";
 import TemplateSummarySpan from "@/components/ObjectStore/Templates/TemplateSummarySpan.vue";
 
-const router = useRouter();
 const objectStoreInstancesStore = useObjectStoreInstancesStore();
 
 interface Props {
@@ -23,59 +25,32 @@ interface Props {
 
 defineProps<Props>();
 
-const fields = [
-    {
-        key: "name",
-        label: _l("Name"),
-        sortable: true,
-    },
-    {
-        key: "description",
-        label: _l("Description"),
-        sortable: true,
-    },
-    {
-        key: "type",
-        label: _l("Type"),
-        sortable: true,
-    },
-    {
-        key: "template",
-        label: _l("From Template"),
-        sortable: true,
-    },
-    {
-        key: "badges",
-        label: _l(" "),
-        sortable: false,
-    },
-];
+const BADGE_FIELD = {
+    key: "badges",
+    label: _l(" "),
+    sortable: false,
+};
 
-const items = computed(() => objectStoreInstancesStore.getInstances);
+const fields = [NAME_FIELD, DESCRIPTION_FIELD, TYPE_FIELD, TEMPLATE_FIELD, BADGE_FIELD];
+
+const allItems = computed<UserConcreteObjectStore[]>(() => objectStoreInstancesStore.getInstances);
+const { activeInstances } = useFiltering(allItems);
 const loading = computed(() => objectStoreInstancesStore.loading);
 objectStoreInstancesStore.fetchInstances();
 </script>
 
 <template>
     <div>
-        <p>
-            {{ message || "" }}
-        </p>
-        <b-row class="mb-3">
-            <b-col>
-                <b-button
-                    id="object-store-create"
-                    class="m-1 float-right"
-                    @click="router.push('/object_store_instances/create')">
-                    <FontAwesomeIcon icon="plus" />
-                    {{ _l("Create") }}
-                </b-button>
-            </b-col>
-        </b-row>
-        <b-table
+        <ManageIndexHeader
+            :message="message"
+            create-button-id="object-store-create"
+            create-route="/object_store_instances/create">
+        </ManageIndexHeader>
+        <BTable
+            id="user-object-stores-index"
             no-sort-reset
             :fields="fields"
-            :items="items"
+            :items="activeInstances"
             :hover="true"
             :striped="true"
             :caption-top="true"
@@ -101,6 +76,6 @@ objectStoreInstancesStore.fetchInstances();
                     :template-version="row.item.template_version ?? 0"
                     :template-id="row.item.template_id" />
             </template>
-        </b-table>
+        </BTable>
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts b/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
index e15a005edb4..4d6c01f6627 100644
--- a/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
+++ b/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
@@ -15,7 +15,7 @@ const localVue = getLocalVue(true);
 const router = injectTestRouter(localVue);
 
 const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
@@ -46,7 +46,7 @@ const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
 };
 
 const INSTANCE: UserConcreteObjectStore = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: undefined,
     template_id: "moo",
@@ -61,6 +61,9 @@ const INSTANCE: UserConcreteObjectStore = {
     private: false,
     id: 4,
     uuid: "112f889f-72d7-4619-a8e8-510a8c685aa7",
+    active: true,
+    hidden: false,
+    purged: false,
 };
 
 describe("UpgradeForm", () => {
diff --git a/client/src/components/ObjectStore/Instances/UpgradeForm.vue b/client/src/components/ObjectStore/Instances/UpgradeForm.vue
index 3b405cc3660..c3285eda662 100644
--- a/client/src/components/ObjectStore/Instances/UpgradeForm.vue
+++ b/client/src/components/ObjectStore/Instances/UpgradeForm.vue
@@ -1,15 +1,16 @@
 <script setup lang="ts">
+import { BAlert } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
+import { upgradeForm, upgradeFormDataToPayload } from "@/components/ConfigTemplates/formUtil";
 import { errorMessageAsString } from "@/utils/simple-error";
 
 import type { ObjectStoreTemplateSummary } from "../Templates/types";
 import { useInstanceRouting } from "./routing";
 import { update } from "./services";
-import type { UserConcreteObjectStore, VariableData } from "./types";
-import { templateSecretFormEntry, templateVariableFormEntry } from "./util";
+import type { UserConcreteObjectStore } from "./types";
 
-import InstanceForm from "./InstanceForm.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface Props {
     instance: UserConcreteObjectStore;
@@ -20,45 +21,17 @@ const error = ref<string | null>(null);
 const props = defineProps<Props>();
 
 const inputs = computed<Array<any> | null>(() => {
-    const form = [];
     const realizedInstance: UserConcreteObjectStore = props.instance;
     const realizedLatestTemplate = props.latestTemplate;
-    const variables = realizedLatestTemplate.variables ?? [];
-    const secrets = realizedLatestTemplate.secrets ?? [];
-    const variableValues: VariableData = realizedInstance.variables || {};
-    const secretsSet = realizedInstance.secrets || [];
-    for (const variable of variables) {
-        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
-    }
-    for (const secret of secrets) {
-        const secretName = secret.name;
-        if (secretsSet.indexOf(secretName) >= 0) {
-            console.log("skipping...");
-        } else {
-            form.push(templateSecretFormEntry(secret));
-        }
-    }
+    const form = upgradeForm(realizedLatestTemplate, realizedInstance);
     return form;
 });
 const title = computed(() => `Upgrade Object Store ${props.instance.name}`);
 const submitTitle = "Update Settings";
+const loadingMessage = "Loading storage location template and instance information";
 
 async function onSubmit(formData: any) {
-    const variables = props.latestTemplate.variables ?? [];
-    const variableData: VariableData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
-    }
-    const secrets = {};
-    // ideally we would be able to force a template version here,
-    // maybe rework backend types to force this in the API response
-    // even if we don't need it in the config files
-    const templateVersion: number = props.latestTemplate.version || 0;
-    const payload = {
-        template_version: templateVersion,
-        variables: variableData,
-        secrets: secrets,
-    };
+    const payload = upgradeFormDataToPayload(props.latestTemplate, formData);
     const args = { user_object_store_id: String(props.instance.id) };
     try {
         const { data: objectStore } = await update({ ...args, ...payload });
@@ -78,9 +51,14 @@ async function onUpgrade(objectStore: UserConcreteObjectStore) {
 </script>
 <template>
     <div>
-        <b-alert v-if="error" variant="danger" class="object-store-instance-upgrade-error" show>
+        <BAlert v-if="error" variant="danger" class="object-store-instance-upgrade-error" show>
             {{ error }}
-        </b-alert>
-        <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/services.ts b/client/src/components/ObjectStore/Instances/services.ts
index c61effa0e79..16a14add79d 100644
--- a/client/src/components/ObjectStore/Instances/services.ts
+++ b/client/src/components/ObjectStore/Instances/services.ts
@@ -1,4 +1,13 @@
 import { fetcher } from "@/api/schema/fetcher";
 
+import type { UserConcreteObjectStore } from "./types";
+
 export const create = fetcher.path("/api/object_store_instances").method("post").create();
 export const update = fetcher.path("/api/object_store_instances/{user_object_store_id}").method("put").create();
+
+export async function hide(instance: UserConcreteObjectStore) {
+    const payload = { hidden: true };
+    const args = { user_object_store_id: String(instance?.id) };
+    const { data: objectStore } = await update({ ...args, ...payload });
+    return objectStore;
+}
diff --git a/client/src/components/ObjectStore/Instances/types.ts b/client/src/components/ObjectStore/Instances/types.ts
index bd956468c7b..0176eaec757 100644
--- a/client/src/components/ObjectStore/Instances/types.ts
+++ b/client/src/components/ObjectStore/Instances/types.ts
@@ -2,8 +2,3 @@ import type { components } from "@/api/schema/schema";
 
 export type UserConcreteObjectStore = components["schemas"]["UserConcreteObjectStoreModel"];
 export type CreateInstancePayload = components["schemas"]["CreateInstancePayload"];
-export type ObjectStoreTemplateVariable = components["schemas"]["ObjectStoreTemplateVariable"];
-export type ObjectStoreTemplateSecret = components["schemas"]["ObjectStoreTemplateSecret"];
-export type VariableValueType = (string | boolean | number) | undefined;
-export type VariableData = { [key: string]: VariableValueType };
-export type SecretData = { [key: string]: string };
diff --git a/client/src/components/ObjectStore/Instances/util.ts b/client/src/components/ObjectStore/Instances/util.ts
deleted file mode 100644
index 77b99b11d73..00000000000
--- a/client/src/components/ObjectStore/Instances/util.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { markup } from "@/components/ObjectStore/configurationMarkdown";
-
-import type { ObjectStoreTemplateSecret, ObjectStoreTemplateVariable, VariableValueType } from "./types";
-
-export function metadataFormEntryName() {
-    return {
-        name: "_meta_name",
-        label: "Name",
-        type: "text",
-        optional: false,
-        help: "Label this new object store a name.",
-    };
-}
-
-export function metadataFormEntryDescription() {
-    return {
-        name: "_meta_description",
-        label: "Description",
-        optional: true,
-        type: "textarea",
-        help: "Provide some notes to yourself about this object store - perhaps to remind you how it is configured, where it stores the data, etc..",
-    };
-}
-
-export function templateVariableFormEntry(variable: ObjectStoreTemplateVariable, variableValue: VariableValueType) {
-    return {
-        name: variable.name,
-        type: "text",
-        help: markup(variable.help || "", true),
-        value: variableValue,
-    };
-}
-
-export function templateSecretFormEntry(secret: ObjectStoreTemplateSecret) {
-    return {
-        name: secret.name,
-        type: "password",
-        help: markup(secret.help || "", true),
-        value: "",
-    };
-}
diff --git a/client/src/components/ObjectStore/ObjectStoreTypeSpan.vue b/client/src/components/ObjectStore/ObjectStoreTypeSpan.vue
index 6672e6a4523..c17682b0cbb 100644
--- a/client/src/components/ObjectStore/ObjectStoreTypeSpan.vue
+++ b/client/src/components/ObjectStore/ObjectStoreTypeSpan.vue
@@ -1,17 +1,20 @@
 <script setup lang="ts">
 import { computed } from "vue";
 
+import { ObjectStoreTemplateType } from "@/api/objectStores";
+
 const MESSAGES = {
-    s3: "This is an object store based on the Amazon Simple Storage Service (S3). Data here is hosted by Amazon.",
+    aws_s3: "This is an object store based on the Amazon Simple Storage Service (S3). Data here is hosted by Amazon.",
     azure_blob:
         "This is a Microsoft Azure Blob based object store. More information on Microsoft's Azure Blob Storage can be found at https://azure.microsoft.com/en-us/products/storage/blobs/.",
     disk: "This is a simple path based object store that assumes the all the relevant paths are already mounted on the Galaxy server and target worker nodes.",
+    boto3: "This is an object store based on the Amazon Simple Storage Service (S3) interface, but likely not stored by Amazon. The AWS interface has become an industry standard and many storage vendors support it and use it to expose object based storage.",
     generic_s3:
         "This is an object store based on the Amazon Simple Storage Service (S3) interface, but likely not stored by Amazon. The AWS interface has become an industry standard and many storage vendors support it and use it to expose object based storage.",
 };
 
 interface Props {
-    type: "s3" | "azure_blob" | "generic_s3" | "disk";
+    type: ObjectStoreTemplateType;
 }
 
 const props = defineProps<Props>();
diff --git a/client/src/components/ObjectStore/SelectObjectStore.vue b/client/src/components/ObjectStore/SelectObjectStore.vue
index 1aa6287a6a0..807806326bd 100644
--- a/client/src/components/ObjectStore/SelectObjectStore.vue
+++ b/client/src/components/ObjectStore/SelectObjectStore.vue
@@ -28,6 +28,17 @@ const store = useObjectStoreStore();
 const { isLoading, loadErrorMessage, selectableObjectStores } = storeToRefs(store);
 const { isOnlyPreference } = useStorageLocationConfiguration();
 
+const selectableAndVisibleObjectStores = computed(() => {
+    const allSelectableObjectStores = selectableObjectStores.value;
+    if (allSelectableObjectStores != null) {
+        return allSelectableObjectStores.filter((item) => {
+            return "hidden" in item ? !item.hidden : true;
+        });
+    } else {
+        return [];
+    }
+});
+
 const loadingObjectStoreInfoMessage = ref("Loading storage location information");
 const whyIsSelectionPreferredText = ref(`
 Select a preferred storage location for new datasets. Depending on the job and workflow execution configuration of
@@ -78,7 +89,7 @@ async function handleSubmit(preferredObjectStore: ConcreteObjectStoreModel | nul
                             ><i>{{ defaultOptionTitle | localize }}</i></b-button
                         >
                         <ObjectStoreSelectButton
-                            v-for="objectStore in selectableObjectStores"
+                            v-for="objectStore in selectableAndVisibleObjectStores"
                             :key="objectStore.object_store_id"
                             id-prefix="preferred"
                             :object-store="objectStore"
@@ -97,7 +108,7 @@ async function handleSubmit(preferredObjectStore: ConcreteObjectStoreModel | nul
                 <span v-localize>{{ defaultOptionDescription }}</span>
             </ObjectStoreSelectButtonPopover>
             <ObjectStoreSelectButtonDescribePopover
-                v-for="objectStore in selectableObjectStores"
+                v-for="objectStore in selectableAndVisibleObjectStores"
                 :key="objectStore.object_store_id"
                 id-prefix="preferred"
                 :what="forWhat"
diff --git a/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue b/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
index 7ed555be53d..f783b34b4f8 100644
--- a/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
+++ b/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
@@ -1,11 +1,11 @@
 <script lang="ts" setup>
-import { computed, ref } from "vue";
+import { computed } from "vue";
 import { useRouter } from "vue-router/composables";
 
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 
 import SelectTemplate from "./SelectTemplate.vue";
-import LoadingSpan from "@/components/LoadingSpan.vue";
+import CreateInstance from "@/components/ConfigTemplates/CreateInstance.vue";
 
 const loadingTemplatesInfoMessage = "Loading storage location templates";
 
@@ -17,8 +17,6 @@ const loading = computed(() => objectStoreTemplatesStore.loading);
 
 const router = useRouter();
 
-const error = ref<string | null>(null);
-
 async function chooseTemplate(selectTemplateId: string) {
     router.push({
         path: `/object_store_templates/${selectTemplateId}/new`,
@@ -26,14 +24,7 @@ async function chooseTemplate(selectTemplateId: string) {
 }
 </script>
 <template>
-    <b-container fluid class="p-0">
-        <LoadingSpan v-if="loading" :message="loadingTemplatesInfoMessage" />
-        <div v-else>
-            <b-alert v-if="error" variant="danger" class="object-store-selection-error" show>
-                {{ error }}
-            </b-alert>
-
-            <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
-        </div>
-    </b-container>
+    <CreateInstance :loading-message="loadingTemplatesInfoMessage" :loading="loading" prefix="object-store">
+        <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
+    </CreateInstance>
 </template>
diff --git a/client/src/components/ObjectStore/Templates/SelectTemplate.vue b/client/src/components/ObjectStore/Templates/SelectTemplate.vue
index 5e99fbb0807..a8e8362eb83 100644
--- a/client/src/components/ObjectStore/Templates/SelectTemplate.vue
+++ b/client/src/components/ObjectStore/Templates/SelectTemplate.vue
@@ -2,6 +2,7 @@
 import type { ObjectStoreTemplateSummaries } from "./types";
 
 import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+import SelectTemplate from "@/components/ConfigTemplates/SelectTemplate.vue";
 
 interface SelectTemplateProps {
     templates: ObjectStoreTemplateSummaries;
@@ -23,26 +24,12 @@ async function handleSubmit(templateId: string) {
 
 <template>
     <div>
-        <b-row>
-            <b-col cols="7">
-                <b-button-group vertical size="lg" style="width: 100%">
-                    <b-button
-                        v-for="template in templates"
-                        :id="`object-store-template-button-${template.id}`"
-                        :key="template.id"
-                        class="object-store-template-select-button"
-                        :data-template-id="template.id"
-                        @click="handleSubmit(template.id)"
-                        >{{ template.name }}
-                    </b-button>
-                </b-button-group>
-            </b-col>
-            <b-col cols="5">
-                <p v-localize style="float: right">
-                    {{ selectText }}
-                </p>
-            </b-col>
-        </b-row>
+        <SelectTemplate
+            :templates="templates"
+            :select-text="selectText"
+            id-prefix="object-store"
+            @onSubmit="handleSubmit">
+        </SelectTemplate>
         <TemplateSummaryPopover
             v-for="template in templates"
             :key="template.id"
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummary.vue b/client/src/components/ObjectStore/Templates/TemplateSummary.vue
index c970cb707ac..ddb84e9527f 100644
--- a/client/src/components/ObjectStore/Templates/TemplateSummary.vue
+++ b/client/src/components/ObjectStore/Templates/TemplateSummary.vue
@@ -22,7 +22,7 @@ const objectStoreType = computed(() => props.template.type);
 <template>
     <div>
         <ObjectStoreBadges :badges="badges" size="lg" />
-        <div>This template produces object stores of type <ObjectStoreTypeSpan :type="objectStoreType" />.</div>
+        <div>This template produces storage locations of type <ObjectStoreTypeSpan :type="objectStoreType" />.</div>
         <ConfigurationMarkdown :markdown="template.description || ''" :admin="true" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts
new file mode 100644
index 00000000000..42dc2058487
--- /dev/null
+++ b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts
@@ -0,0 +1,22 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_OBJECT_STORE_TEMPLATE } from "@/components/ConfigTemplates/test_fixtures";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const localVue = getLocalVue(true);
+
+describe("TemplateSummaryPopover", () => {
+    it("should render a popover", async () => {
+        const wrapper = shallowMount(TemplateSummaryPopover, {
+            propsData: {
+                target: "test-target-1",
+                template: STANDARD_OBJECT_STORE_TEMPLATE,
+            },
+            localVue,
+        });
+        const configPopover = wrapper.find("[target='test-target-1']");
+        expect(configPopover.exists()).toBeTruthy();
+    });
+});
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
index 868dca4ff83..df9f9b5f05f 100644
--- a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
+++ b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
@@ -2,20 +2,18 @@
 import type { ObjectStoreTemplateSummary } from "./types";
 
 import TemplateSummary from "./TemplateSummary.vue";
+import TemplateSummaryPopover from "@/components/ConfigTemplates/TemplateSummaryPopover.vue";
 
 interface Props {
     target: String;
     template: ObjectStoreTemplateSummary;
 }
 
-const props = defineProps<Props>();
-
-const popoverPlacement = "rightbottom";
+defineProps<Props>();
 </script>
 
 <template>
-    <b-popover :target="target" triggers="hover" boundary="window" :placement="popoverPlacement">
-        <template v-slot:title>{{ props.template.name }}</template>
-        <TemplateSummary :template="props.template" />
-    </b-popover>
+    <TemplateSummaryPopover :target="target" :template="template">
+        <TemplateSummary :template="template" />
+    </TemplateSummaryPopover>
 </template>
diff --git a/client/src/components/User/UserPreferences.vue b/client/src/components/User/UserPreferences.vue
index 6807bda7f47..47197e0ad92 100644
--- a/client/src/components/User/UserPreferences.vue
+++ b/client/src/components/User/UserPreferences.vue
@@ -93,13 +93,21 @@
             :user-id="userId">
         </UserPreferredObjectStore>
         <UserPreferencesElement
-            v-if="hasTemplates"
+            v-if="hasObjectStoreTemplates"
             id="manage-object-stores"
             class="manage-object-stores"
             icon="fa-hdd"
             title="Manage Your Storage Locations"
             description="Add, remove, or update your personally configured storage locations."
             to="/object_store_instances/index" />
+        <UserPreferencesElement
+            v-if="hasFileSourceTemplates"
+            id="manage-file-sources"
+            class="manage-file-sources"
+            icon="fa-file"
+            title="Manage Your Remote File Sources"
+            description="Add, remove, or update your personally configured location to find files from and write files to."
+            to="/file_source_instances/index" />
         <UserDeletion
             v-if="isConfigLoaded && !config.single_user && config.enable_account_interface"
             :email="email"
@@ -144,6 +152,7 @@ import { withPrefix } from "utils/redirect";
 import Vue from "vue";
 
 import { useConfig } from "@/composables/config";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 import { useUserStore } from "@/stores/userStore";
 
@@ -192,7 +201,12 @@ export default {
     },
     computed: {
         ...mapState(useUserStore, ["currentUser"]),
-        ...mapState(useObjectStoreTemplatesStore, ["hasTemplates"]),
+        ...mapState(useObjectStoreTemplatesStore, {
+            hasObjectStoreTemplates: "hasTemplates",
+        }),
+        ...mapState(useFileSourceTemplatesStore, {
+            hasFileSourceTemplates: "hasTemplates",
+        }),
         activePreferences() {
             const userPreferencesEntries = Object.entries(getUserPreferencesModel());
             // Object.entries returns an array of arrays, where the first element
@@ -232,10 +246,16 @@ export default {
             this.diskUsage = response.data.nice_total_disk_usage;
             this.diskQuota = response.data.quota;
         });
-        this.ensureTemplates();
+        this.ensureObjectStoreTemplates();
+        this.ensureFileSourceTemplates();
     },
     methods: {
-        ...mapActions(useObjectStoreTemplatesStore, ["ensureTemplates"]),
+        ...mapActions(useObjectStoreTemplatesStore, {
+            ensureObjectStoreTemplates: "ensureTemplates",
+        }),
+        ...mapActions(useFileSourceTemplatesStore, {
+            ensureFileSourceTemplates: "ensureTemplates",
+        }),
         toggleNotifications() {
             if (window.Notification) {
                 Notification.requestPermission().then(function (permission) {
diff --git a/client/src/entry/analysis/router.js b/client/src/entry/analysis/router.js
index 76403e407ab..89f7d058a7a 100644
--- a/client/src/entry/analysis/router.js
+++ b/client/src/entry/analysis/router.js
@@ -55,22 +55,27 @@ import Vue from "vue";
 import VueRouter from "vue-router";
 
 import AvailableDatatypes from "@/components/AvailableDatatypes/AvailableDatatypes";
+import CreateFileSourceInstance from "@/components/FileSources/Instances/CreateInstance";
 import GridHistory from "@/components/Grid/GridHistory";
 import GridPage from "@/components/Grid/GridPage";
-import CreateInstance from "@/components/ObjectStore/Instances/CreateInstance";
+import CreateObjectStoreInstance from "@/components/ObjectStore/Instances/CreateInstance";
 import { parseBool } from "@/utils/utils";
 
 import { patchRouterPush } from "./router-push";
 
 import AboutGalaxy from "@/components/AboutGalaxy.vue";
+import EditFileSourceInstance from "@/components/FileSources/Instances/EditInstance.vue";
+import ManageFileSourceIndex from "@/components/FileSources/Instances/ManageIndex.vue";
+import UpgradeFileSourceInstance from "@/components/FileSources/Instances/UpgradeInstance.vue";
+import CreateUserFileSource from "@/components/FileSources/Templates/CreateUserFileSource.vue";
 import GridInvocation from "@/components/Grid/GridInvocation.vue";
 import GridVisualization from "@/components/Grid/GridVisualization.vue";
 import HistoryArchiveWizard from "@/components/History/Archiving/HistoryArchiveWizard.vue";
 import HistoryDatasetPermissions from "@/components/History/HistoryDatasetPermissions.vue";
 import NotificationsList from "@/components/Notifications/NotificationsList.vue";
-import EditInstance from "@/components/ObjectStore/Instances/EditInstance.vue";
-import ManageIndex from "@/components/ObjectStore/Instances/ManageIndex.vue";
-import UpgradeInstance from "@/components/ObjectStore/Instances/UpgradeInstance.vue";
+import EditObjectStoreInstance from "@/components/ObjectStore/Instances/EditInstance.vue";
+import ManageObjectStoreIndex from "@/components/ObjectStore/Instances/ManageIndex.vue";
+import UpgradeObjectStoreInstance from "@/components/ObjectStore/Instances/UpgradeInstance.vue";
 import CreateUserObjectStore from "@/components/ObjectStore/Templates/CreateUserObjectStore.vue";
 import Sharing from "@/components/Sharing/SharingPage.vue";
 import HistoryStorageOverview from "@/components/User/DiskUsage/Visualizations/HistoryStorageOverview.vue";
@@ -356,24 +361,50 @@ export function getRouter(Galaxy) {
                     },
                     {
                         path: "object_store_instances/index",
-                        component: ManageIndex,
+                        component: ManageObjectStoreIndex,
                         props: (route) => {
                             return { message: route.query["message"] };
                         },
                     },
                     {
                         path: "object_store_instances/:instanceId/edit",
-                        component: EditInstance,
+                        component: EditObjectStoreInstance,
                         props: true,
                     },
                     {
                         path: "object_store_instances/:instanceId/upgrade",
-                        component: UpgradeInstance,
+                        component: UpgradeObjectStoreInstance,
                         props: true,
                     },
                     {
                         path: "object_store_templates/:templateId/new",
-                        component: CreateInstance,
+                        component: CreateObjectStoreInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_instances/create",
+                        component: CreateUserFileSource,
+                    },
+                    {
+                        path: "file_source_instances/index",
+                        component: ManageFileSourceIndex,
+                        props: (route) => {
+                            return { message: route.query["message"] };
+                        },
+                    },
+                    {
+                        path: "file_source_instances/:instanceId/edit",
+                        component: EditFileSourceInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_instances/:instanceId/upgrade",
+                        component: UpgradeFileSourceInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_templates/:templateId/new",
+                        component: CreateFileSourceInstance,
                         props: true,
                     },
                     {
diff --git a/client/src/stores/configTemplatesUtil.ts b/client/src/stores/configTemplatesUtil.ts
new file mode 100644
index 00000000000..2baeab3acb5
--- /dev/null
+++ b/client/src/stores/configTemplatesUtil.ts
@@ -0,0 +1,56 @@
+import type { TemplateSummary } from "@/api/configTemplates";
+
+export function findTemplate<T extends TemplateSummary>(
+    templates: T[],
+    templateId: string,
+    templateVersion: number
+): T | null {
+    for (const template of templates) {
+        if (template.id == templateId && template.version == templateVersion) {
+            return template;
+        }
+    }
+    return null;
+}
+
+export function getLatestVersionMap<T extends TemplateSummary>(templates: T[]): { [key: string]: number } {
+    const latestVersions: { [key: string]: number } = {};
+    templates.forEach((i: T) => {
+        const templateId = i.id;
+        const templateVersion = i.version || 0;
+        if ((latestVersions[templateId] ?? -1) < templateVersion) {
+            latestVersions[templateId] = templateVersion;
+        }
+    });
+    return latestVersions;
+}
+
+export function canUpgrade<T extends TemplateSummary>(
+    templates: T[],
+    templateId: string,
+    templateVersion: number
+): boolean {
+    let can = false;
+    templates.forEach((i: T) => {
+        if (i.id == templateId && i.version && i.version > templateVersion) {
+            can = true;
+        }
+    });
+    return can;
+}
+
+export function getLatestVersion<T extends TemplateSummary>(templates: T[], id: string): T | null {
+    let latestVersion = -1;
+    let latestTemplate = null as T | null;
+    templates.forEach((i: T) => {
+        const templateId = i.id;
+        if (templateId == id) {
+            const templateVersion = i.version || 0;
+            if (templateVersion > latestVersion) {
+                latestTemplate = i;
+                latestVersion = templateVersion;
+            }
+        }
+    });
+    return latestTemplate;
+}
diff --git a/client/src/stores/fileSourceInstancesStore.ts b/client/src/stores/fileSourceInstancesStore.ts
new file mode 100644
index 00000000000..5b2bcf97b82
--- /dev/null
+++ b/client/src/stores/fileSourceInstancesStore.ts
@@ -0,0 +1,51 @@
+import { defineStore } from "pinia";
+
+import { fetcher } from "@/api/schema/fetcher";
+import type { components } from "@/api/schema/schema";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+const getFileSourceInstances = fetcher.path("/api/file_source_instances").method("get").create();
+
+type UserFileSourceModel = components["schemas"]["UserFileSourceModel"];
+
+export const useFileSourceInstancesStore = defineStore("fileSourceInstances", {
+    state: () => ({
+        instances: [] as UserFileSourceModel[],
+        fetched: false,
+        error: null as string | null,
+    }),
+    getters: {
+        getInstances: (state) => {
+            return state.instances;
+        },
+        loading: (state) => {
+            return !state.fetched;
+        },
+        getInstance: (state) => {
+            return (id: number | string) => state.instances.find((i) => i.id.toString() == id.toString());
+        },
+    },
+    actions: {
+        async handleInit(instances: UserFileSourceModel[]) {
+            this.instances = instances;
+            this.fetched = true;
+            this.error = null;
+        },
+        async handleError(err: unknown) {
+            this.error = errorMessageAsString(err);
+        },
+        async fetchInstances() {
+            try {
+                const { data: instances } = await getFileSourceInstances({});
+                this.handleInit(instances);
+            } catch (err) {
+                this.handleError(err);
+            }
+        },
+        async ensureTemplates() {
+            if (!this.fetched || this.error != null) {
+                await this.fetchInstances();
+            }
+        },
+    },
+});
diff --git a/client/src/stores/fileSourceTemplatesStore.ts b/client/src/stores/fileSourceTemplatesStore.ts
new file mode 100644
index 00000000000..1efd7e67bfe
--- /dev/null
+++ b/client/src/stores/fileSourceTemplatesStore.ts
@@ -0,0 +1,70 @@
+import { defineStore } from "pinia";
+
+import { fetcher } from "@/api/schema/fetcher";
+import type { components } from "@/api/schema/schema";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { canUpgrade, findTemplate, getLatestVersion, getLatestVersionMap } from "./configTemplatesUtil";
+
+const getFileSourceTemplates = fetcher.path("/api/file_source_templates").method("get").create();
+
+type FileSourceTemplateSummary = components["schemas"]["FileSourceTemplateSummary"];
+type FileSourceTemplateSummaries = FileSourceTemplateSummary[];
+
+export const useFileSourceTemplatesStore = defineStore("fileSourceTemplatesStore", {
+    state: () => ({
+        templates: [] as FileSourceTemplateSummaries,
+        fetched: false,
+        error: null as string | null,
+    }),
+    getters: {
+        latestTemplates: (state) => {
+            // only expose latest instance by template_version for each template_id
+            const latestVersions = getLatestVersionMap(state.templates);
+            return state.templates.filter((i: FileSourceTemplateSummary) => latestVersions[i.id] == (i.version || 0));
+        },
+        canUpgrade: (state) => {
+            return (templateId: string, templateVersion: number) =>
+                canUpgrade(state.templates, templateId, templateVersion);
+        },
+        getTemplates: (state) => {
+            return state.templates;
+        },
+        getTemplate: (state) => {
+            return (templateId: string, templateVersion: number) =>
+                findTemplate(state.templates, templateId, templateVersion);
+        },
+        getLatestTemplate: (state) => {
+            return (templateId: string) => getLatestVersion(state.templates, templateId);
+        },
+        hasTemplates: (state) => {
+            return state.templates.length > 0;
+        },
+        loading: (state) => {
+            return !state.fetched;
+        },
+    },
+    actions: {
+        async handleInit(templates: FileSourceTemplateSummaries) {
+            this.templates = templates;
+            this.fetched = true;
+        },
+        async handleError(err: unknown) {
+            this.fetched = true;
+            this.error = errorMessageAsString(err);
+        },
+        async fetchTemplates() {
+            try {
+                const { data: templates } = await getFileSourceTemplates({});
+                this.handleInit(templates);
+            } catch (err) {
+                this.handleError(err);
+            }
+        },
+        async ensureTemplates() {
+            if (!this.fetched || this.error != null) {
+                await this.fetchTemplates();
+            }
+        },
+    },
+});
diff --git a/client/src/stores/objectStoreInstancesStore.test.ts b/client/src/stores/objectStoreInstancesStore.test.ts
index a99670369ac..c70f09a9306 100644
--- a/client/src/stores/objectStoreInstancesStore.test.ts
+++ b/client/src/stores/objectStoreInstancesStore.test.ts
@@ -1,8 +1,9 @@
+import { type ObjectStoreTemplateType } from "@/api/objectStores";
 import { useObjectStoreInstancesStore } from "@/stores/objectStoreInstancesStore";
 
 import { setupTestPinia } from "./testUtils";
 
-const type = "s3" as "s3" | "azure_blob" | "disk" | "generic_s3";
+const type = "aws_s3" as ObjectStoreTemplateType;
 const TEST_INSTANCE = {
     type: type,
     name: "moo",
@@ -16,6 +17,9 @@ const TEST_INSTANCE = {
     private: false,
     id: 4,
     uuid: "112f889f-72d7-4619-a8e8-510a8c685aa7",
+    active: true,
+    hidden: false,
+    purged: false,
 };
 
 describe("Object Store Instances Store", () => {
diff --git a/client/src/stores/objectStoreTemplatesStore.test.ts b/client/src/stores/objectStoreTemplatesStore.test.ts
index 2206712b212..214e83fd6b7 100644
--- a/client/src/stores/objectStoreTemplatesStore.test.ts
+++ b/client/src/stores/objectStoreTemplatesStore.test.ts
@@ -1,8 +1,9 @@
+import { type ObjectStoreTemplateType } from "@/api/objectStores";
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 
 import { setupTestPinia } from "./testUtils";
 
-const s3 = "s3" as "s3" | "azure_blob" | "disk" | "generic_s3";
+const s3 = "aws_s3" as ObjectStoreTemplateType;
 const TEMPLATES_BASIC = [
     {
         type: s3,
diff --git a/client/src/stores/objectStoreTemplatesStore.ts b/client/src/stores/objectStoreTemplatesStore.ts
index c7c340a50f0..4b9c852d494 100644
--- a/client/src/stores/objectStoreTemplatesStore.ts
+++ b/client/src/stores/objectStoreTemplatesStore.ts
@@ -4,58 +4,13 @@ import { fetcher } from "@/api/schema/fetcher";
 import type { components } from "@/api/schema/schema";
 import { errorMessageAsString } from "@/utils/simple-error";
 
+import { canUpgrade, findTemplate, getLatestVersion, getLatestVersionMap } from "./configTemplatesUtil";
+
 const getObjectStoreTemplates = fetcher.path("/api/object_store_templates").method("get").create();
 
 type ObjectStoreTemplateSummary = components["schemas"]["ObjectStoreTemplateSummary"];
 type ObjectStoreTemplateSummaries = ObjectStoreTemplateSummary[];
 
-function findTemplate(templates: ObjectStoreTemplateSummaries, templateId: string, templateVersion: number) {
-    for (const template of templates) {
-        if (template.id == templateId && template.version == templateVersion) {
-            return template;
-        }
-    }
-    return null;
-}
-
-function getLatestVersionMap(templates: ObjectStoreTemplateSummaries): { [key: string]: number } {
-    const latestVersions: { [key: string]: number } = {};
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        const templateId = i.id;
-        const templateVersion = i.version || 0;
-        if ((latestVersions[templateId] ?? -1) < templateVersion) {
-            latestVersions[templateId] = templateVersion;
-        }
-    });
-    return latestVersions;
-}
-
-function canUpgrade(templates: ObjectStoreTemplateSummaries, templateId: string, templateVersion: number): boolean {
-    let can = false;
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        if (i.id == templateId && i.version && i.version > templateVersion) {
-            can = true;
-        }
-    });
-    return can;
-}
-
-function getLatestVersion(templates: ObjectStoreTemplateSummaries, id: string): ObjectStoreTemplateSummary | null {
-    let latestVersion = -1;
-    let latestTemplate = null as ObjectStoreTemplateSummary | null;
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        const templateId = i.id;
-        if (templateId == id) {
-            const templateVersion = i.version || 0;
-            if (templateVersion > latestVersion) {
-                latestTemplate = i;
-                latestVersion = templateVersion;
-            }
-        }
-    });
-    return latestTemplate;
-}
-
 export const useObjectStoreTemplatesStore = defineStore("objectStoreTemplatesStore", {
     state: () => ({
         templates: [] as ObjectStoreTemplateSummaries,
diff --git a/client/src/utils/navigation/navigation.yml b/client/src/utils/navigation/navigation.yml
index 8455efe6cc7..7ff2b7b344e 100644
--- a/client/src/utils/navigation/navigation.yml
+++ b/client/src/utils/navigation/navigation.yml
@@ -94,7 +94,8 @@ preferences:
     email_input: "input[id='email']"
     username_input: "input[id='username']"
     preferred_storage: '.preferred-storage'
-    manage_object_stores: '.manage-object-stores'
+    manage_object_stores: '#manage-object-stores'
+    manage_file_sources: '#manage-file-sources'
 
   object_store_selection:
     selectors:
@@ -104,8 +105,26 @@ preferences:
 object_store_instances:
   index:
     selectors:
-      create_button: object-store-create
+      create_button: '#object-store-create'
+      _: '#user-object-stores-index'
 
+  create: 
+    selectors:
+      select: '.object-store-template-select-button[data-template-id="${template_id}"]'
+      _: '#create-object-store-landing'      
+      submit: '#submit'
+
+file_source_instances:
+  index:
+    selectors:
+      create_button: '#file-source-create'
+      _: '#user-file-sources-index'
+
+  create: 
+    selectors:
+      select: '.file-source-template-select-button[data-template-id="${template_id}"]'
+      _: '#create-file-source-landing'      
+      submit: '#submit'
 
 toolbox_filters:
   selectors:
diff --git a/client/src/utils/upload-payload.js b/client/src/utils/upload-payload.js
index 2ff3395828e..2fbca26c06d 100644
--- a/client/src/utils/upload-payload.js
+++ b/client/src/utils/upload-payload.js
@@ -7,6 +7,7 @@ export const URI_PREFIXES = [
     "gxfiles://",
     "gximport://",
     "gxuserimport://",
+    "gxuserfiles://",
     "gxftp://",
     "drs://",
     "invenio://",
diff --git a/doc/source/admin/config-template-secrets-create.png b/doc/source/admin/config-template-secrets-create.png
new file mode 100644
index 00000000000..7be174aec00
Binary files /dev/null and b/doc/source/admin/config-template-secrets-create.png differ
diff --git a/doc/source/admin/config-template-secrets-edit.png b/doc/source/admin/config-template-secrets-edit.png
new file mode 100644
index 00000000000..47237231c36
Binary files /dev/null and b/doc/source/admin/config-template-secrets-edit.png differ
diff --git a/doc/source/admin/data.md b/doc/source/admin/data.md
new file mode 100644
index 00000000000..d4d518a40ec
--- /dev/null
+++ b/doc/source/admin/data.md
@@ -0,0 +1,595 @@
+# Connecting Users and Data
+
+Galaxy has countless ways for users to connect with things that might be considered their "data" - file sources (aka "remote files"), object stores (aka "storage locations"), data libraries, the upload API, visualizations, display applications, custom tools, etc...
+
+This document is going to discuss two of these (file sources and object stores) that are most important Galaxy administrators and how to build Galaxy configuration that allow administrators to let users tie into various pieces of infrastructure.
+
+```{contents} Table of Contents
+:depth: 4
+```
+
+## Datasets vs Files
+
+File sources in Galaxy are a sprawling concept but essentially they provide users access to simple files (stored hierarchically into folders) that can be navigated and imported into Galaxy. Importing a "file" into Galaxy generally creates a copy of that file into a Galaxy "object store". Once these files are stored in Galaxy,
+they become "datasets". A Galaxy dataset is much more than a simple file - Galaxy datasets include various generic metadata a datatype, datatype specific metadata, and ownership and sharing rules managed by Galaxy.
+
+Galaxy object stores (called "storage locations" in the UI) store datasets and global (accessible to all users) object stores are configured with the ``galaxy.yml`` property ``object_store_config_file`` (or  ``object_store_config`` for a configuration embedded right in ``galaxy.yml``) that defaults to ``object_store_conf.xml`` or ``object_store_conf.yml`` if either is present in Galaxy's configuration directory. Galaxy file sources provide users access to raw files and global files sources are configured with the ``galaxy.yml`` property ``file_sources_config_file`` (or ``file_sources`` for embedded configurations) that defaults to ``file_sources_conf.yml`` if that file is present in Galaxy's configuration directory.
+
+Some of Galaxy's most updated and complete administrator documentation can be found in configuration sample files - this is definitely the case for object stores and file sources. The relevant sample configuration files include  [file_sources_conf.yml.sample](https://github.com/galaxyproject/galaxy/blob/dev/lib/galaxy/config/sample/file_sources_conf.yml.sample) and [object_store_conf.sample.yml](https://github.com/galaxyproject/galaxy/blob/dev/lib/galaxy/config/sample/object_store_conf.sample.yml).
+
+File sources and object stores configured with the above files essentially are available to all users of your Galaxy instance - hence this document describes them as "global" file sources and object  stores. File source configurations do allow some templating that does allow the a global file source to be materialized differently for different users. For instance, you as an admin may setup a Dropbox file source and may explicitly add custom user properties that allow that single Dropbox file source to read from a user's preferences. Since there is just one Dropbox service and most people only have a single Dropbox account, this use case can be somewhat adequately addressed by the global file source and the global user preferences file. For a use case like Amazon S3 buckets though for instance, a single bucket file source that is parameterized one way is probably more clearly inadequate. For instance, users would very likely want to attach different buckets for different projects.  Additionally, the Galaxy user interface doesn't tie the user preferences to the particular file source and so this method introduces a huge education burden on your Galaxy instance. Finally, the templating available to file sources are not available for object stores - and allowing users to describe how they would like datasets stored and to pay for their own dataset storage are important use cases.
+
+This document is going to describe Galaxy configuration template libraries that allow the 
+administrator to setup templates for file sources and object stores that your users may instantiate
+as they see fit. User's can instantiate multiple instances of any template, the template concept
+can apply to both file source and object store plugins, and the user interface is unified from the
+template configuration file (you as the admin do not need to explicitly declare user preferences and
+your users do not need to navigate seemingly unrelated preferences to get plugins to work).
+
+## Object Store Templates
+
+Galaxy's object store templates are configured as a YAML list of template objects. This list
+can be placed ``object_store_templates.yml`` in Galaxy configuration directory (or any path
+pointed to by the configuration option ``object_store_templates_config_file`` in ``galaxy.yml``).
+Alternatively, the  configuration can be placed directly into ``galaxy.yml`` using the
+``object_store_templates`` configuration option.
+
+A minimal object store template might look something like:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### Object Store Types
+
+#### ``disk``
+
+This is the most basic sort of object store template that just makes disk paths available to users
+for storing data. Paths can be built up from the user supplied variables, user details, supplied
+environment variables, etc.. The simple example used to demonstrate these concepts just uses
+a user supplied project name and the user's username to produce a unique path for each user
+defined object store.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+These sorts of object stores have no quota so be careful.
+
+The syntax for the ``configuration`` section of ``disk`` templates looks like this.
+
+![](object_store_disk_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_disk_configuration.png)
+
+#### ``boto3``
+
+Object stores of the type ``boto3`` can be used to access a wide variety of S3
+compatible storage services including AWS S3. How you template them can result in widely
+different experiences for your users and can result in addressing a wide variety of use cases.
+
+Here is an example that is tailored for a specific storage service (e.g. CloudFlare R2)
+and exposes just the pieces of data CloudFlare users would need.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/cloudflare.yml
+:language: yaml
+```
+
+Templates can be much more generic or much less generic than this.
+
+In one direction, all the bells and whistles could be exposed to your Galaxy users to allow
+them to connect to any S3 compatible storage. This requires a lot more sophistication from
+your users but also allows them to connect to many more services. This template is available
+here:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
+:language: yaml
+```
+
+On the other hand, you might run a small lab with a dedicate MinIO storage service and just trust
+your user's to define individual buckets by name:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
+:language: yaml
+```
+
+If you want to just target AWS S3 and let your users utilize that as quickly
+and easily as possible that templates might look like this:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_aws_bucket.yml
+:language: yaml
+```
+
+The syntax for the ``configuration`` section of ``boto3`` templates looks like this.
+
+![](object_store_boto3_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_boto3_configuration.png)
+
+#### ``azure_blob``
+
+Here is a "production grade" Azure template that can be essentially used to connect to any
+Azure storage container.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
+:language: yaml
+```
+
+This template might be adapted to hide connection details from say users of a individual lab
+and just expose what container they should use. That might look something like:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/azure_just_container.yml
+:language: yaml
+```
+
+This example is a little contrived though, if a small lab or institution has just a few containers
+it would likely be a much easier user experience to just wrap them all in a Galaxy hierarchical
+object store, document them there, and make them available to your whole Galaxy instance.
+
+The syntax for the ``configuration`` section of ``azure_blob`` templates looks like this.
+
+![](object_store_azure_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_azure_configuration.png)
+
+#### ``aws_s3`` (Legacy)
+
+Object stores of the type ``aws_s3`` are be used to treat AWS Simple Storage Service (S3) buckets
+as Galaxy object stores. See Amazon documentation for information on [S3](https://aws.amazon.com/s3/)
+and [how to create buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html)
+and [how to create access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
+
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_aws_s3_legacy.yml
+:language: yaml
+```
+
+The ``aws_s3`` object store is older and more well tested than the ``boto3`` object store, but
+the ``boto3`` object store is built using a newer, more robust, and more feature-rich client
+library so it should probably be the object store you use instead of this.
+
+The syntax for the ``configuration`` section of ``aws_s3`` templates looks like this.
+
+![](object_store_aws_s3_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_aws_s3_configuration.png)
+
+#### ``generic_s3`` (Legacy)
+
+Object stores of the type ``generic_s3`` can be used to access a wide variety of S3
+compatible storage services. How you template them can result in widely different
+experiences for your users and can result in addressing a wide variety of use cases.
+
+Here is an example that is tailored for a specific storage service (e.g. CloudFlare R2)
+and exposes just the pieces of data CloudFlare users would need.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/cloudflare_legacy.yml
+:language: yaml
+```
+
+Templates can be much more generic or much less generic than this.
+
+In one direction, all the bells and whistles could be exposed to your Galaxy users to allow
+them to connect to any S3 compatible storage. This requires a lot more sophistication from
+your users but also allows them to connect to many more services. This template is available
+here:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_generic_s3_legacy.yml
+:language: yaml
+```
+
+On the other hand, you might run a small lab with a dedicate MinIO storage service and just trust
+your user's to define individual buckets by name:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/minio_just_buckets_legacy.yml
+:language: yaml
+```
+
+The syntax for the ``configuration`` section of ``generic_s3`` templates looks like this.
+
+![](object_store_generic_s3_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_generic_s3_configuration.png)
+
+### YAML Syntax
+
+![galaxy.objectstore.templates.models](object_store_templates.png)
+
+### Ready To Use Production Object Store Templates
+
+The templates have been tested by a Galaxy developer and are sufficiently generic that
+they may make sense for a variety of Galaxy instances, address a variety of potential use
+cases, and do not have need any additional tailoring, parameterization, or other
+customization. These assume your Galaxy instance has a Vault configured and you're
+comfortable with it storing your user's secrets.
+
+#### Allow Users to Define Azure Blob Storage as Object Stores
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
+:language: yaml
+```
+
+![Screenshot](user_object_store_form_full_azure.png)
+
+#### Allow Users to Define Generic S3 Compatible Storage Services as Object Stores
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
+:language: yaml
+```
+
+#### Allow Users to Define AWS S3 Buckets as Object Stores
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_aws_s3.yml
+:language: yaml
+```
+
+![Screenshot](user_object_store_form_full_aws_s3.png)
+
+
+#### Allow Users to Define Google Cloud Provider S3 Interop Storage Buckets as Object Stores
+
+This template includes descriptions of how to generate HMAC keys used by this interoperability
+layer provided by Google and lots of links to relevant Google Cloud Storage documentation.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_gcp_s3.yml
+:language: yaml
+```
+
+![Screenshot](user_object_store_form_full_gcp_s3_interop.png)
+
+## File Source Templates
+
+Galaxy's file source templates are configured as a YAML list of template objects. This list
+can be placed ``file_source_templates.yml`` in Galaxy configuration directory (or any path
+pointed to by the configuration option ``file_source_templates_config_file`` in ``galaxy.yml``).
+Alternatively, the  configuration can be placed directly into ``galaxy.yml`` using the
+``file_source_templates`` configuration option.
+
+
+### File Source Types
+
+#### ``posix``
+
+The syntax for the ``configuration`` section of ``posix`` templates looks like this.
+
+![](file_source_posix_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_posix_configuration.png)
+
+#### ``s3fs``
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_s3fs.yml
+:language: yaml
+```
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
+:language: yaml
+```
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
+:language: yaml
+```
+
+![](file_source_s3fs_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_s3fs_configuration.png)
+
+#### ``ftp``
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_ftp.yml
+:language: yaml
+```
+
+The syntax for the ``configuration`` section of ``ftp`` templates looks like this.
+
+![](file_source_ftp_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_ftp_configuration.png)
+
+#### ``azure``
+
+The syntax for the ``configuration`` section of ``azure`` templates looks like this.
+
+![](file_source_azure_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_azure_configuration.png)
+
+### YAML Syntax
+
+![galaxy.files.templates.models](file_source_templates.png)
+
+### Ready To Use Production File Source Templates
+
+The templates have been tested by a Galaxy developer and are sufficiently generic that
+they may make sense for a variety of Galaxy instances, address a variety of potential use
+cases, and do not have need any additional tailoring, parameterization, or other
+customization. These assume your Galaxy instance has a Vault configured and you're
+comfortable with it storing your user's secrets.
+
+#### Allow Users to Define Generic FTP Servers as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_ftp.yml
+:language: yaml
+```
+
+![Screenshot](user_file_source_form_full_ftp.png)
+
+#### Allow Users to Define Azure Blob Storage as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_azure.yml
+:language: yaml
+```
+
+![Screenshot](user_file_source_form_full_azure.png)
+
+#### Allow Users to Define Generic S3 Compatible Storage as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_s3fs.yml
+:language: yaml
+```
+
+#### Allow Users to Define Publicly Accessible AWS S3 Buckets as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
+:language: yaml
+```
+
+![Screenshot](user_file_source_form_full_aws_public.png)
+
+#### Allow Users to Define Private AWS S3 Buckets as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
+:language: yaml
+```
+
+## Playing Nicer with Ansible
+
+Many large instances of Galaxy are configured with Ansible and much of the existing administrator
+documentation leverages Ansible. The configuration template files using Jinja templating and so
+does Ansible by default. This might result in a lack of clarity of when templates (strings 
+starting with ``{{`` and ending with ``}}``) are being evaluated. Ansible templates are evaluated
+at deploy time and the configuration objects describing plugins are evaluated at Galaxy runtime.
+
+The easiest way to fix this is probably to store these templates files in your Ansible as plain files
+and not templates. If you'd like to use Ansible templating to build up these files you'll very
+likely need to tell either Galaxy or Ansible to use something other than ``{{`` and ``}}`` for 
+templating variables. This can be done by placing a directive at the top of your template that
+is consumed by Ansible. For instance, to have ``[%`` and ``%]`` used instead of ``{{`` and ``}}``
+by Ansible at deploy time, the file could start with:
+
+```
+#jinja2:variable_start_string:'[%' , variable_end_string:'%]'
+```
+
+In this case, variables wrapped by ``[%`` and ``%]`` are expanded by Ansible and use the Ansible
+environment and ``{`` and ``}`` are reserved for Galaxy templating.
+
+Alternatively, Galaxy can be configured to use a custom template on a per-configuration
+object basis by setting the ``template_start`` and/or ``template_end`` variables.
+
+The following template chunk shows how to override the templating Galaxy does for a
+particular object store configuration. Similar templating overrides work for file source
+plugin templates.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/templating_override.yml
+:language: yaml
+```
+
+- https://github.com/ansible/ansible/pull/75306
+- https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+
+## Jinja Template Reference
+
+Galaxy configuration file templating uses [Jinja](https://jinja.palletsprojects.com/en/3.0.x/templates/) to template values and connect inputs, configuration, and the runtime environment
+into concrete configuration YAML blocks.
+
+Jinja is fairly straight forward to learn but this document provides tons of examples and
+one can probably adapt them to whatever you're interested in building without really needing
+to dig deeply into Jinja. However, this section does outline what Galaxy does inject into the
+Jinja environment to serve as a reference.
+
+Even the most exotic configurations will likely only scratch the surface of what Jinja
+allows and implements. The only relevant Jinja documentation you'll need in these cases
+is probably just those documents on [variables](https://jinja.palletsprojects.com/en/3.0.x/templates/#variables), [filters](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters),
+and the [list of builtin filters](https://jinja.palletsprojects.com/en/3.0.x/templates/#list-of-builtin-filters).
+
+### ``variables``
+
+This is a typed dictionary object is populated with user supplied values defined via the the ``variables`` section of the configuration template and filled in by the user when they
+created a new object store or file source.
+
+### ``secrets``
+
+This is a dictionary of strings populated with user supplied secrets defined via the the ``secrets`` section of the configuration template and filled in by the user when they
+created a new object store or file source.
+
+A deep dive into these can be found in the [User Secrets](#user-secrets) section of this document.
+
+### ``environment``
+
+This dictionary object is populated with admin-supplied values defined via the the ``environment``
+section of the configuration template.
+
+A deep dive into these can be found in the [Admin Secrets](#admin-secrets) section of this document.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
+:language: yaml
+```
+
+### ``user``
+
+This dictionary object exposes information about user configuring and using a target template
+configuration. These values are populated from the ``galaxy_user`` table of the Galaxy database.
+The current properties exposed include:
+
+| Key          | Description                                               | 
+|--------------|-----------------------------------------------------------|
+| ``username`` | string corresponding the username of the Galaxy user      |
+| ``email``    | string corresponding the email of the Galaxy user         |
+| ``id``       | integer primary key of user object in the Galaxy database |
+
+
+The simple example of project scratch storage used to describe these concepts made
+use the Galaxy user's username to generate unique paths.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### ``ensure_path_component``
+
+This [Jinja filter](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters)
+will fail template evaluation if the value it is applies to is not
+a simple directory name. If it contain ``..`` or ``/`` or in some other way might
+be used to attempt path exploitation of cause odd path-related bugs. This is
+useful when producing paths for ``disk`` object stores or ``posix`` file sources.
+
+When taking inputs from users, setting the type of ``path_component`` instead of
+``string`` allows the client to validate potential issues way before this point,
+but many path components might be built from environment variables or usernames
+or sources like this that are not explicitly user inputs.
+
+An example of an object store template that uses this is the simple scratch example
+that was used to introduce concepts at the start of the object store template
+documentation above.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### ``asbool``
+
+This [Jinja filter](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters)
+will use Galaxy configuration style logic to convert string values into boolean ones.
+
+When taking inputs from users, setting the type of ``boolean`` is sufficient to ensure
+a variable is boolean, but "secrets" and environment variables and many other things
+are likely to be of type string but should be used in a template that expects boolean
+values.
+
+An example of an object store template that uses this is ``secure`` environment parameter
+on the simple minio example.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/minio_example.yml
+:language: yaml
+```
+
+
+## Connecting Configuration Templates to Secrets
+
+(user-secrets)=
+### User Secrets
+
+Most of the examples in this document use secrets of one kind or another. For instance, in the FTP
+example - the password field is a secret.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_ftp.yml
+:language: yaml
+```
+
+Instead of being saved in the database in plain text, Galaxy will use a configured Vault to store
+this data. Check out Galaxy admin documentation on [Storing secrets in the vault](https://docs.galaxyproject.org/en/master/admin/special_topics/vault.html) for descriptions of how to configure
+a vault. Most interesting user defined file sources and/or object stores will require a Galaxy Vault.
+
+In this FTP example, a new Vault key will be created for each FTP instance the user creates.
+The user file source APIs and management user interface will be responsible for orchestration of
+storing and updating secrets. The Vault key for this password will be something like:
+
+```
+/galaxy/user/<user_id>/file_source_config/<file_source_instance_uuid>/password
+```
+
+Here ``user_id`` is the primary key of the User object in the database and 
+``file_source_instance_uuid`` is the ``uuid`` value corresponding to the ``user_file_source``
+table in the database.
+
+User defined object stores are stored in a similar fashion but at:
+
+```
+/galaxy/user/<user_id>/object_store_config/<object_store_instance_uuid>/<secret_name>
+```
+
+During the creation of an object store or file source, the secrets will be appended to the generated
+form as password fields.
+
+![](config-template-secrets-create.png)
+
+After an object store has been created, a user has the option to edit the settings in the UI.
+Most of the settings appear in a simple form - but the secrets are managed and updated
+individually in the "Secrets" tab.
+
+![](config-template-secrets-edit.png)
+
+
+(admin-secrets)=
+### Admin Secrets
+
+Administrators may define secrets that are available to all users and aren't parameterized
+on a per-instance basis. These secrets can be injected into template instances through Vault
+keys or through environment variables.
+
+Each template may optionally define an ``environment`` key where these can be defined. The
+following template entry describes a file source that injects the environment variable
+``GALAXY_SECRET_HOME_VAR`` into the template as ``environment.var`` and injects the Vault
+key ``secret_directory_file_source/my_secret`` into the template as ``environment.var``.
+This template uses these variables to construct a root path for a ``posix`` file source
+but the same secrets could just as easily store cloud keys and configure an S3 object store.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets.yml
+:language: yaml
+```
+
+If you'd like to make the target secrets optional, default values can also be setup.
+The following block demonstrates the same configuration but with default values of
+``default_var`` for the default ``var`` value and ``default_sec`` for the default ``sec``
+value. These will be used in the target Vault keys are absent or the target environment
+variable is not defined at runtime.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
+:language: yaml
+```
diff --git a/doc/source/admin/file_source_azure_configuration.png b/doc/source/admin/file_source_azure_configuration.png
new file mode 100644
index 00000000000..99aa460e639
Binary files /dev/null and b/doc/source/admin/file_source_azure_configuration.png differ
diff --git a/doc/source/admin/file_source_azure_configuration_template.png b/doc/source/admin/file_source_azure_configuration_template.png
new file mode 100644
index 00000000000..dbc8844ac19
Binary files /dev/null and b/doc/source/admin/file_source_azure_configuration_template.png differ
diff --git a/doc/source/admin/file_source_ftp_configuration.png b/doc/source/admin/file_source_ftp_configuration.png
new file mode 100644
index 00000000000..72f93e280fd
Binary files /dev/null and b/doc/source/admin/file_source_ftp_configuration.png differ
diff --git a/doc/source/admin/file_source_ftp_configuration_template.png b/doc/source/admin/file_source_ftp_configuration_template.png
new file mode 100644
index 00000000000..ad8bc555346
Binary files /dev/null and b/doc/source/admin/file_source_ftp_configuration_template.png differ
diff --git a/doc/source/admin/file_source_posix_configuration.png b/doc/source/admin/file_source_posix_configuration.png
new file mode 100644
index 00000000000..4fcd0a0e7f5
Binary files /dev/null and b/doc/source/admin/file_source_posix_configuration.png differ
diff --git a/doc/source/admin/file_source_posix_configuration_template.png b/doc/source/admin/file_source_posix_configuration_template.png
new file mode 100644
index 00000000000..6559a0f8ac1
Binary files /dev/null and b/doc/source/admin/file_source_posix_configuration_template.png differ
diff --git a/doc/source/admin/file_source_s3fs_configuration.png b/doc/source/admin/file_source_s3fs_configuration.png
new file mode 100644
index 00000000000..bc3df24731c
Binary files /dev/null and b/doc/source/admin/file_source_s3fs_configuration.png differ
diff --git a/doc/source/admin/file_source_s3fs_configuration_template.png b/doc/source/admin/file_source_s3fs_configuration_template.png
new file mode 100644
index 00000000000..f940d5485e9
Binary files /dev/null and b/doc/source/admin/file_source_s3fs_configuration_template.png differ
diff --git a/doc/source/admin/file_source_templates.png b/doc/source/admin/file_source_templates.png
new file mode 100644
index 00000000000..5d1556b6926
Binary files /dev/null and b/doc/source/admin/file_source_templates.png differ
diff --git a/doc/source/admin/gen_diagrams.py b/doc/source/admin/gen_diagrams.py
new file mode 100644
index 00000000000..2627420177e
--- /dev/null
+++ b/doc/source/admin/gen_diagrams.py
@@ -0,0 +1,59 @@
+import os
+import sys
+
+import erdantic as erd
+
+sys.path.insert(1, os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir, os.pardir, os.pardir, "lib")))
+
+from galaxy.files.templates.models import (
+    AzureFileSourceConfiguration,
+    AzureFileSourceTemplateConfiguration,
+    FileSourceTemplate,
+    FtpFileSourceConfiguration,
+    FtpFileSourceTemplateConfiguration,
+    PosixFileSourceConfiguration,
+    PosixFileSourceTemplateConfiguration,
+    S3FSFileSourceConfiguration,
+    S3FSFileSourceTemplateConfiguration,
+)
+from galaxy.objectstore.templates.models import (
+    AwsS3ObjectStoreConfiguration,
+    AwsS3ObjectStoreTemplateConfiguration,
+    AzureObjectStoreConfiguration,
+    AzureObjectStoreTemplateConfiguration,
+    Boto3ObjectStoreConfiguration,
+    Boto3ObjectStoreTemplateConfiguration,
+    DiskObjectStoreConfiguration,
+    DiskObjectStoreTemplateConfiguration,
+    GenericS3ObjectStoreConfiguration,
+    GenericS3ObjectStoreTemplateConfiguration,
+    ObjectStoreTemplate,
+)
+
+DOC_SOURCE_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__)))
+
+class_to_diagram = {
+    ObjectStoreTemplate: "object_store_templates",
+    AzureObjectStoreConfiguration: "object_store_azure_configuration",
+    AzureObjectStoreTemplateConfiguration: "object_store_azure_configuration_template",
+    Boto3ObjectStoreConfiguration: "object_store_boto3_configuration",
+    Boto3ObjectStoreTemplateConfiguration: "object_store_boto3_configuration_template",
+    DiskObjectStoreConfiguration: "object_store_disk_configuration",
+    DiskObjectStoreTemplateConfiguration: "object_store_disk_configuration_template",
+    AwsS3ObjectStoreTemplateConfiguration: "object_store_aws_s3_configuration_template",
+    AwsS3ObjectStoreConfiguration: "object_store_aws_s3_configuration",
+    GenericS3ObjectStoreTemplateConfiguration: "object_store_generic_s3_configuration_template",
+    GenericS3ObjectStoreConfiguration: "object_store_generic_s3_configuration",
+    FileSourceTemplate: "file_source_templates",
+    AzureFileSourceTemplateConfiguration: "file_source_azure_configuration_template",
+    AzureFileSourceConfiguration: "file_source_azure_configuration",
+    PosixFileSourceTemplateConfiguration: "file_source_posix_configuration_template",
+    PosixFileSourceConfiguration: "file_source_posix_configuration",
+    S3FSFileSourceTemplateConfiguration: "file_source_s3fs_configuration_template",
+    S3FSFileSourceConfiguration: "file_source_s3fs_configuration",
+    FtpFileSourceTemplateConfiguration: "file_source_ftp_configuration_template",
+    FtpFileSourceConfiguration: "file_source_ftp_configuration",
+}
+
+for clazz, diagram_name in class_to_diagram.items():
+    erd.draw(clazz, out=f"{DOC_SOURCE_DIR}/{diagram_name}.png")
diff --git a/doc/source/admin/index.rst b/doc/source/admin/index.rst
index 61ed7db63ba..f7853a895a0 100644
--- a/doc/source/admin/index.rst
+++ b/doc/source/admin/index.rst
@@ -11,6 +11,7 @@ This documentation is in the midst of being ported and unified based on resource
    config
    config_logging
    production
+   data
    security
    nginx
    apache
diff --git a/doc/source/admin/object_store_aws_s3_configuration.png b/doc/source/admin/object_store_aws_s3_configuration.png
new file mode 100644
index 00000000000..a9ae47e10ba
Binary files /dev/null and b/doc/source/admin/object_store_aws_s3_configuration.png differ
diff --git a/doc/source/admin/object_store_aws_s3_configuration_template.png b/doc/source/admin/object_store_aws_s3_configuration_template.png
new file mode 100644
index 00000000000..f93317fcad2
Binary files /dev/null and b/doc/source/admin/object_store_aws_s3_configuration_template.png differ
diff --git a/doc/source/admin/object_store_azure_configuration.png b/doc/source/admin/object_store_azure_configuration.png
new file mode 100644
index 00000000000..bbf2528f772
Binary files /dev/null and b/doc/source/admin/object_store_azure_configuration.png differ
diff --git a/doc/source/admin/object_store_azure_configuration_template.png b/doc/source/admin/object_store_azure_configuration_template.png
new file mode 100644
index 00000000000..be8638df56d
Binary files /dev/null and b/doc/source/admin/object_store_azure_configuration_template.png differ
diff --git a/doc/source/admin/object_store_boto3_configuration.png b/doc/source/admin/object_store_boto3_configuration.png
new file mode 100644
index 00000000000..cd8d8ef4ef0
Binary files /dev/null and b/doc/source/admin/object_store_boto3_configuration.png differ
diff --git a/doc/source/admin/object_store_boto3_configuration_template.png b/doc/source/admin/object_store_boto3_configuration_template.png
new file mode 100644
index 00000000000..f7895868958
Binary files /dev/null and b/doc/source/admin/object_store_boto3_configuration_template.png differ
diff --git a/doc/source/admin/object_store_disk_configuration.png b/doc/source/admin/object_store_disk_configuration.png
new file mode 100644
index 00000000000..836e13d6f59
Binary files /dev/null and b/doc/source/admin/object_store_disk_configuration.png differ
diff --git a/doc/source/admin/object_store_disk_configuration_template.png b/doc/source/admin/object_store_disk_configuration_template.png
new file mode 100644
index 00000000000..d851772ed42
Binary files /dev/null and b/doc/source/admin/object_store_disk_configuration_template.png differ
diff --git a/doc/source/admin/object_store_generic_s3_configuration.png b/doc/source/admin/object_store_generic_s3_configuration.png
new file mode 100644
index 00000000000..7e545feda79
Binary files /dev/null and b/doc/source/admin/object_store_generic_s3_configuration.png differ
diff --git a/doc/source/admin/object_store_generic_s3_configuration_template.png b/doc/source/admin/object_store_generic_s3_configuration_template.png
new file mode 100644
index 00000000000..04b50dd5049
Binary files /dev/null and b/doc/source/admin/object_store_generic_s3_configuration_template.png differ
diff --git a/doc/source/admin/object_store_templates.png b/doc/source/admin/object_store_templates.png
new file mode 100644
index 00000000000..a43b5acf260
Binary files /dev/null and b/doc/source/admin/object_store_templates.png differ
diff --git a/doc/source/admin/s3_configuration.png b/doc/source/admin/s3_configuration.png
new file mode 100644
index 00000000000..cead1584ddb
Binary files /dev/null and b/doc/source/admin/s3_configuration.png differ
diff --git a/doc/source/admin/s3_configuration_template.png b/doc/source/admin/s3_configuration_template.png
new file mode 100644
index 00000000000..9a104c85df5
Binary files /dev/null and b/doc/source/admin/s3_configuration_template.png differ
diff --git a/doc/source/admin/search_for_new_screenshots.py b/doc/source/admin/search_for_new_screenshots.py
new file mode 100644
index 00000000000..95f0ac2cbc6
--- /dev/null
+++ b/doc/source/admin/search_for_new_screenshots.py
@@ -0,0 +1,39 @@
+import argparse
+import os
+import shutil
+import sys
+
+THIS_DIRECTORY = os.path.dirname(__file__)
+
+parser = argparse.ArgumentParser(
+    prog="search_for_new_screenshots",
+    description="Searches a Selenium screenshot directory for screenshots used in the admin docs and grabs new ones if available",
+)
+
+SEARCH_FOR = [
+    "user_object_store_form_empty_azure.png",
+    "user_object_store_form_full_azure.png",
+    "user_object_store_form_empty_generic_s3.png",
+    "user_object_store_form_full_generic_s3.png",
+    "user_object_store_form_empty_aws_s3.png",
+    "user_object_store_form_full_aws_s3.png",
+    "user_object_store_form_empty_gcp_s3_interop.png",
+    "user_object_store_form_full_gcp_s3_interop.png",
+    "user_file_source_form_full_aws_public.png",
+    "user_file_source_form_full_azure.png",
+    "user_file_source_form_full_ftp.png",
+]
+
+
+def main(argv):
+    parser.add_argument("screenshot_directory")
+    args = parser.parse_args(argv[1:])
+    screenshot_directory = args.screenshot_directory
+    for filename in os.listdir(screenshot_directory):
+        if filename in SEARCH_FOR:
+            print(f"Found useful screenshot {filename}, copying to {THIS_DIRECTORY}")
+            shutil.copy(os.path.join(screenshot_directory, filename), os.path.join(THIS_DIRECTORY, filename))
+
+
+if __name__ == "__main__":
+    main(sys.argv)
diff --git a/doc/source/admin/user_file_source_form_full_aws_public.png b/doc/source/admin/user_file_source_form_full_aws_public.png
new file mode 100644
index 00000000000..84d76621f74
Binary files /dev/null and b/doc/source/admin/user_file_source_form_full_aws_public.png differ
diff --git a/doc/source/admin/user_file_source_form_full_azure.png b/doc/source/admin/user_file_source_form_full_azure.png
new file mode 100644
index 00000000000..7c49fdb471f
Binary files /dev/null and b/doc/source/admin/user_file_source_form_full_azure.png differ
diff --git a/doc/source/admin/user_file_source_form_full_ftp.png b/doc/source/admin/user_file_source_form_full_ftp.png
new file mode 100644
index 00000000000..8aa42401f06
Binary files /dev/null and b/doc/source/admin/user_file_source_form_full_ftp.png differ
diff --git a/doc/source/admin/user_object_store_form_full_aws_s3.png b/doc/source/admin/user_object_store_form_full_aws_s3.png
new file mode 100644
index 00000000000..9e4faab7a82
Binary files /dev/null and b/doc/source/admin/user_object_store_form_full_aws_s3.png differ
diff --git a/doc/source/admin/user_object_store_form_full_azure.png b/doc/source/admin/user_object_store_form_full_azure.png
new file mode 100644
index 00000000000..623fc68a25a
Binary files /dev/null and b/doc/source/admin/user_object_store_form_full_azure.png differ
diff --git a/doc/source/admin/user_object_store_form_full_gcp_s3_interop.png b/doc/source/admin/user_object_store_form_full_gcp_s3_interop.png
new file mode 100644
index 00000000000..0a915be46b6
Binary files /dev/null and b/doc/source/admin/user_object_store_form_full_gcp_s3_interop.png differ
diff --git a/lib/galaxy/app.py b/lib/galaxy/app.py
index e976c25d342..eec2318de4e 100644
--- a/lib/galaxy/app.py
+++ b/lib/galaxy/app.py
@@ -35,13 +35,27 @@ from galaxy.celery.base_task import (
 )
 from galaxy.config_watchers import ConfigWatchers
 from galaxy.datatypes.registry import Registry
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+    UserDefinedFileSources,
+)
+from galaxy.files.plugins import (
+    FileSourcePluginLoader,
+    FileSourcePluginsConfig,
+)
+from galaxy.files.templates import ConfiguredFileSourceTemplates
 from galaxy.job_metrics import JobMetrics
 from galaxy.jobs.manager import JobManager
 from galaxy.managers.api_keys import ApiKeyManager
 from galaxy.managers.citations import CitationsManager
 from galaxy.managers.collections import DatasetCollectionManager
 from galaxy.managers.dbkeys import GenomeBuilds
+from galaxy.managers.file_source_instances import (
+    FileSourceInstancesManager,
+    UserDefinedFileSourcesConfig,
+    UserDefinedFileSourcesImpl,
+)
 from galaxy.managers.folders import FolderManager
 from galaxy.managers.hdas import HDAManager
 from galaxy.managers.histories import HistoryManager
@@ -418,18 +432,19 @@ class MinimalGalaxyApplication(BasicSharedApp, HaltableContainer, SentryClientMi
             jobs_directory=self.config.jobs_directory,
             new_file_path=self.config.new_file_path,
             umask=self.config.umask,
+            gid=self.config.gid,
             object_store_cache_size=self.config.object_store_cache_size,
             object_store_cache_path=self.config.object_store_cache_path,
-            user_object_store_index_by=self.config.user_object_store_index_by,
+            user_config_templates_index_by=self.config.user_config_templates_index_by,
+            user_config_templates_use_saved_configuration=self.config.user_config_templates_use_saved_configuration,
         )
         self._register_singleton(UserObjectStoresAppConfig, app_config)
-        user_object_store_resolver = self._register_abstract_singleton(
-            UserObjectStoreResolver, UserObjectStoreResolverImpl  # type: ignore[type-abstract]
-        )  # Ignored because of https://github.com/python/mypy/issues/4717
         vault_configured = is_vault_configured(self.vault)
         templates = ConfiguredObjectStoreTemplates.from_app_config(self.config, vault_configured=vault_configured)
         self.object_store_templates = self._register_singleton(ConfiguredObjectStoreTemplates, templates)
-        # kwds["object_store_templates"] = self.object_store_templates
+        user_object_store_resolver = self._register_abstract_singleton(
+            UserObjectStoreResolver, UserObjectStoreResolverImpl  # type: ignore[type-abstract]
+        )  # Ignored because of https://github.com/python/mypy/issues/4717
         kwds["user_object_store_resolver"] = user_object_store_resolver
         self.object_store = build_object_store_from_config(self.config, **kwds)
 
@@ -587,9 +602,29 @@ class GalaxyManagerApplication(MinimalManagerApp, MinimalGalaxyApplication, Inst
         )
 
         # ConfiguredFileSources
-        self.file_sources = self._register_singleton(
-            ConfiguredFileSources, ConfiguredFileSources.from_app_config(self.config)
+        vault_configured = is_vault_configured(self.vault)
+        templates = ConfiguredFileSourceTemplates.from_app_config(self.config, vault_configured=vault_configured)
+        file_sources_config: FileSourcePluginsConfig = FileSourcePluginsConfig.from_app_config(self.config)
+        self._register_singleton(FileSourcePluginsConfig, file_sources_config)
+        file_source_plugin_loader = FileSourcePluginLoader()
+        self._register_singleton(FileSourcePluginLoader, file_source_plugin_loader)
+        self.file_source_templates = self._register_singleton(ConfiguredFileSourceTemplates, templates)
+        self._register_singleton(
+            UserDefinedFileSourcesConfig, UserDefinedFileSourcesConfig.from_app_config(self.config)
         )
+        user_defined_file_sources = self._register_abstract_singleton(
+            UserDefinedFileSources, UserDefinedFileSourcesImpl  # type: ignore[type-abstract]  # https://github.com/python/mypy/issues/4717
+        )
+        configured_file_source_conf: ConfiguredFileSourcesConf = ConfiguredFileSourcesConf.from_app_config(self.config)
+        file_sources = ConfiguredFileSources(
+            file_sources_config,
+            configured_file_source_conf,
+            load_stock_plugins=True,
+            plugin_loader=file_source_plugin_loader,
+            user_defined_file_sources=user_defined_file_sources,
+        )
+        self.file_sources = self._register_singleton(ConfiguredFileSources, file_sources)
+        self._register_singleton(FileSourceInstancesManager)
 
         # Load security policy.
         self.security_agent = self.model.security_agent
diff --git a/lib/galaxy/app_unittest_utils/galaxy_mock.py b/lib/galaxy/app_unittest_utils/galaxy_mock.py
index d5084215802..95715c04254 100644
--- a/lib/galaxy/app_unittest_utils/galaxy_mock.py
+++ b/lib/galaxy/app_unittest_utils/galaxy_mock.py
@@ -29,7 +29,10 @@ from galaxy.managers.histories import HistoryManager
 from galaxy.managers.jobs import JobSearch
 from galaxy.managers.users import UserManager
 from galaxy.managers.workflows import WorkflowsManager
-from galaxy.model import tags
+from galaxy.model import (
+    tags,
+    User,
+)
 from galaxy.model.base import (
     ModelMapping,
     SharedModelMapping,
@@ -42,6 +45,11 @@ from galaxy.model.unittest_utils import (
     GalaxyDataTestConfig,
 )
 from galaxy.security import idencoding
+from galaxy.security.vault import (
+    UserVaultWrapper,
+    Vault,
+    VaultFactory,
+)
 from galaxy.short_term_storage import (
     ShortTermStorageAllocator,
     ShortTermStorageConfiguration,
@@ -171,6 +179,19 @@ class MockApp(di.Container, GalaxyDataTestApp):
     def reindex_tool_search(self) -> None:
         raise NotImplementedError
 
+    def setup_test_vault(self):
+        config = {
+            "encryption_keys": [
+                "5RrT94ji178vQwha7TAmEix7DojtsLlxVz8Ef17KWgg=",
+                "iNdXd7tRjLnSqRHxuhqQ98GTLU8HUbd5_Xx38iF8nZ0=",
+                "IK83IXhE4_7W7xCFEtD9op0BAs11pJqYN236Spppp7g=",
+            ],
+        }
+        vault = VaultFactory.from_vault_type(self, "database", config)
+        # Ignored because of https://github.com/python/mypy/issues/4717
+        self[Vault] = vault  # type: ignore[type-abstract]
+        self.vault = vault
+
 
 class MockLock:
     def __enter__(self):
@@ -352,6 +373,26 @@ class MockTrans:
         kwargs.update(h=MockTemplateHelpers())
         return template.render(**kwargs)
 
+    @property
+    def username(self):
+        return "testuser"
+
+    @property
+    def email(self):
+        return "testuser@example.com"
+
+    def init_user_in_database(self):
+        u = User(email=self.email, password="password", username=self.username)
+        session = self.model.session
+        session.add(u)
+        session.commit()
+        self.set_user(u)
+
+    @property
+    def user_vault(self):
+        """Provide access to a user's personal vault."""
+        return UserVaultWrapper(self.app.vault, self.user)
+
 
 class MockVisualizationsRegistry:
     BUILT_IN_VISUALIZATIONS = ["trackster"]
diff --git a/lib/galaxy/config/schemas/config_schema.yml b/lib/galaxy/config/schemas/config_schema.yml
index fc830ab5130..1fb105a2265 100644
--- a/lib/galaxy/config/schemas/config_schema.yml
+++ b/lib/galaxy/config/schemas/config_schema.yml
@@ -566,7 +566,22 @@ mapping:
         desc: |
           Configured Object Store templates embedded into Galaxy's config.
 
-      user_object_store_index_by:
+      file_source_templates_config_file:
+        type: str
+        default: file_source_templates.yml
+        path_resolves_to: config_dir
+        required: false
+        desc: |
+          Configured user file source templates configuration file.
+
+      file_source_templates:
+        type: seq
+        sequence:
+          - type: any
+        desc: |
+          Configured user file source templates embedded into Galaxy's config.
+
+      user_config_templates_index_by:
         type: str
         default: 'uuid'
         required: false
@@ -579,6 +594,31 @@ mapping:
           UUID feels a little more like a typical way to do this within Galaxy though.
           Do not change this value once user object stores have been created.
 
+      user_config_templates_use_saved_configuration:
+        type: str
+        default: 'fallback'
+        required: false
+        enum: ['fallback', 'preferred', 'never']
+        desc: |
+          User defined object stores and file sources are saved in the database with
+          their last valid configuration. It may be the case that the admin changes
+          file source and object store templates over time such that the variables
+          and secrets an instance is saved with no longer match the configuration's
+          expected values. For this reason, admins should always add new versions of
+          templates instead of just changing them - however people take shortcuts and
+          divergences might happen. If a template is changed in such a way it breaks
+          or if a template disappears from the library of templates this parameter controls
+          how and if the database version will be used.
+
+          By default, it will simply be used as a 'fallback' if a configuration cannot
+          be resolved against the template version in the configuration file. Using 'preferred'
+          instead will mean the stored database version is always used. This ensures a greater
+          degree of reproducibility without effort on the part of the admin but also means
+          that small issues are not easy to fix. Using 'never' instead will ensure the
+          config templates are always only loaded from the template library files - this
+          might make sense for admins who want to disable templates without worrying about
+          the contents of the database.
+
       enable_mulled_containers:
         type: bool
         default: true
diff --git a/lib/galaxy/files/__init__.py b/lib/galaxy/files/__init__.py
index 6ddf924f408..58aea54181b 100644
--- a/lib/galaxy/files/__init__.py
+++ b/lib/galaxy/files/__init__.py
@@ -23,6 +23,7 @@ from galaxy.util.plugin_config import (
     plugin_source_from_dict,
     plugin_source_from_path,
     PluginConfigSource,
+    PluginConfigsT,
 )
 from .plugins import (
     FileSourcePluginLoader,
@@ -46,29 +47,111 @@ class NoMatchingFileSource(Exception):
     pass
 
 
+class UserDefinedFileSources(Protocol):
+    """Entry-point for Galaxy to inject user-defined object stores.
+
+    Supplied object of this class is used to write out concrete
+    description of file sources when serializing all file sources
+    available to a user.
+    """
+
+    def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext") -> None:
+        pass
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        pass
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: "FileSourcesUserContext",
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        """Write out user file sources as list of config dictionaries."""
+        # config_dicts: List[FilesSourceProperties] = []
+        # for file_source in self.user_file_sources():
+        #     as_dict = file_source.to_dict(for_serialization=for_serialization, user_context=user_context)
+        #     config_dicts.append(as_dict)
+        # return config_dicts
+
+
+class NullUserDefinedFileSources(UserDefinedFileSources):
+
+    def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext") -> None:
+        return None
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        return None
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: "FileSourcesUserContext",
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        return []
+
+
+def _ensure_user_defined_file_sources(
+    user_defined_file_sources: Optional[UserDefinedFileSources] = None,
+) -> UserDefinedFileSources:
+    if user_defined_file_sources is not None:
+        return user_defined_file_sources
+    else:
+        return NullUserDefinedFileSources()
+
+
+class ConfiguredFileSourcesConf:
+    conf_dict: Optional[PluginConfigsT]
+    conf_file: Optional[str]
+
+    def __init__(self, conf_dict: Optional[PluginConfigsT] = None, conf_file: Optional[str] = None):
+        self.conf_dict = conf_dict
+        self.conf_file = conf_file
+
+    @staticmethod
+    def from_app_config(config):
+        config_file = config.file_sources_config_file
+        config_dict = None
+        if not config_file or not os.path.exists(config_file):
+            config_file = None
+            config_dict = config.file_sources
+        return ConfiguredFileSourcesConf(config_dict, config_file)
+
+
 class ConfiguredFileSources:
     """Load plugins and resolve Galaxy URIs to FileSource objects."""
 
     _file_sources: List[BaseFilesSource]
+    _plugin_loader: FileSourcePluginLoader
+    _user_defined_file_sources: UserDefinedFileSources
 
     def __init__(
         self,
         file_sources_config: FileSourcePluginsConfig,
-        conf_file=None,
-        conf_dict=None,
-        load_stock_plugins=False,
+        configured_file_source_conf: Optional[ConfiguredFileSourcesConf] = None,
+        load_stock_plugins: bool = False,
+        plugin_loader: Optional[FileSourcePluginLoader] = None,
+        user_defined_file_sources: Optional[UserDefinedFileSources] = None,
     ):
         self._file_sources_config = file_sources_config
-        self._plugin_loader = FileSourcePluginLoader()
+        self._plugin_loader = plugin_loader or FileSourcePluginLoader()
+        self._user_defined_file_sources = _ensure_user_defined_file_sources(user_defined_file_sources)
         file_sources: List[BaseFilesSource] = []
-        if conf_file is not None:
-            file_sources = self._load_plugins_from_file(conf_file)
-        elif conf_dict is not None:
-            plugin_source = plugin_source_from_dict(conf_dict)
+        if configured_file_source_conf is None:
+            configured_file_source_conf = ConfiguredFileSourcesConf(conf_dict=[])
+        if configured_file_source_conf.conf_file is not None:
+            file_sources = self._load_plugins_from_file(configured_file_source_conf.conf_file)
+        elif configured_file_source_conf.conf_dict is not None:
+            plugin_source = plugin_source_from_dict(configured_file_source_conf.conf_dict)
             file_sources = self._parse_plugin_source(plugin_source)
         else:
             file_sources = []
-        custom_sources_configured = len(file_sources) > 0
+        custom_sources_configured = len(file_sources) > 0 or (user_defined_file_sources is not None)
         if load_stock_plugins:
             stock_file_source_conf_dict = []
 
@@ -110,6 +193,9 @@ class ConfiguredFileSources:
         """Returns the best matching file source for handling a particular url. Each filesource scores its own
         ability to match a particular url, and the highest scorer with a score > 0 is selected."""
         scores = [FileSourceScore(file_source, file_source.score_url_match(url)) for file_source in self._file_sources]
+        user_best_score = self._user_defined_file_sources.find_best_match(url)
+        if user_best_score is not None:
+            scores.append(user_best_score)
         scores.sort(key=lambda f: f.score, reverse=True)
         return next((fsscore.file_source for fsscore in scores if fsscore.score > 0), None)
 
@@ -134,6 +220,8 @@ class ConfiguredFileSources:
                 raise exceptions.ConfigDoesNotAllowException(
                     "The configuration of this Galaxy instance does not allow upload from user directories."
                 )
+            if user_login is None:
+                raise exceptions.AuthenticationRequired("Must be logged in to use this feature.")
             full_import_dir = os.path.join(user_base_dir, user_login)
             if not os.path.exists(full_import_dir):
                 raise exceptions.ObjectNotFound("Your user import directory does not exist.")
@@ -154,6 +242,7 @@ class ConfiguredFileSources:
                 raise exceptions.ObjectNotFound(
                     "Your FTP directory does not exist, attempting to upload files to it may cause it to be created."
                 )
+        self._user_defined_file_sources.validate_uri_root(uri, user_context)
 
     def looks_like_uri(self, path_or_uri):
         # is this string a URI this object understands how to realize
@@ -183,6 +272,16 @@ class ConfiguredFileSources:
                 continue
             el = file_source.to_dict(for_serialization=for_serialization, user_context=user_context)
             rval.append(el)
+        if user_context:
+            rval.extend(
+                self._user_defined_file_sources.user_file_sources_to_dicts(
+                    for_serialization,
+                    user_context,
+                    browsable_only=browsable_only,
+                    include_kind=include_kind,
+                    exclude_kind=exclude_kind,
+                )
+            )
         return rval
 
     def to_dict(self, for_serialization: bool = False, user_context: "OptionalUserContext" = None) -> Dict[str, Any]:
@@ -191,18 +290,6 @@ class ConfiguredFileSources:
             "config": self._file_sources_config.to_dict(),
         }
 
-    @staticmethod
-    def from_app_config(config):
-        config_file = config.file_sources_config_file
-        config_dict = None
-        if not config_file or not os.path.exists(config_file):
-            config_file = None
-            config_dict = config.file_sources
-        file_sources_config = FileSourcePluginsConfig.from_app_config(config)
-        return ConfiguredFileSources(
-            file_sources_config, conf_file=config_file, conf_dict=config_dict, load_stock_plugins=True
-        )
-
     @staticmethod
     def from_dict(as_dict, load_stock_plugins=False):
         if as_dict is not None:
@@ -212,8 +299,9 @@ class ConfiguredFileSources:
         else:
             sources_as_dict = []
             file_sources_config = FileSourcePluginsConfig()
+        configured_file_sources_conf = ConfiguredFileSourcesConf(conf_dict=sources_as_dict)
         return ConfiguredFileSources(
-            file_sources_config, conf_dict=sources_as_dict, load_stock_plugins=load_stock_plugins
+            file_sources_config, configured_file_sources_conf, load_stock_plugins=load_stock_plugins
         )
 
 
@@ -221,7 +309,7 @@ class NullConfiguredFileSources(ConfiguredFileSources):
     def __init__(
         self,
     ):
-        super().__init__(FileSourcePluginsConfig())
+        super().__init__(FileSourcePluginsConfig(), ConfiguredFileSourcesConf(conf_dict=[]))
 
 
 class DictifiableFilesSourceContext(Protocol):
@@ -252,13 +340,13 @@ class FileSourceDictifiable(Dictifiable, DictifiableFilesSourceContext):
 class FileSourcesUserContext(DictifiableFilesSourceContext, Protocol):
 
     @property
-    def email(self) -> str: ...
+    def email(self) -> Optional[str]: ...
 
     @property
-    def username(self) -> str: ...
+    def username(self) -> Optional[str]: ...
 
     @property
-    def ftp_dir(self) -> str: ...
+    def ftp_dir(self) -> Optional[str]: ...
 
     @property
     def preferences(self) -> Dict[str, Any]: ...
@@ -283,12 +371,12 @@ class ProvidesFileSourcesUserContext(FileSourcesUserContext, FileSourceDictifiab
         self.trans = trans
 
     @property
-    def email(self):
+    def email(self) -> Optional[str]:
         user = self.trans.user
         return user and user.email
 
     @property
-    def username(self):
+    def username(self) -> Optional[str]:
         user = self.trans.user
         return user and user.username
 
@@ -344,7 +432,7 @@ class DictFileSourcesUserContext(FileSourcesUserContext, FileSourceDictifiable):
         return self._kwd.get("email")
 
     @property
-    def username(self):
+    def username(self) -> Optional[str]:
         return self._kwd.get("username")
 
     @property
diff --git a/lib/galaxy/files/plugins.py b/lib/galaxy/files/plugins.py
index 27f5f2de96d..4f9c182f846 100644
--- a/lib/galaxy/files/plugins.py
+++ b/lib/galaxy/files/plugins.py
@@ -1,6 +1,8 @@
 from typing import (
+    cast,
     List,
     Optional,
+    Type,
     TYPE_CHECKING,
 )
 
@@ -86,6 +88,9 @@ class FileSourcePluginLoader:
 
         return plugins_dict(galaxy.files.sources, "plugin_type")
 
+    def get_plugin_type_class(self, plugin_type: str) -> Type["BaseFilesSource"]:
+        return cast(Type["BaseFilesSource"], self._plugin_classes[plugin_type])
+
     def load_plugins(
         self, plugin_source: PluginConfigSource, file_source_plugin_config: FileSourcePluginsConfig
     ) -> List["BaseFilesSource"]:
diff --git a/lib/galaxy/files/sources/__init__.py b/lib/galaxy/files/sources/__init__.py
index 2633df91e6b..09e869a082b 100644
--- a/lib/galaxy/files/sources/__init__.py
+++ b/lib/galaxy/files/sources/__init__.py
@@ -12,6 +12,7 @@ from typing import (
     List,
     Optional,
     Set,
+    Type,
     TYPE_CHECKING,
     Union,
 )
@@ -92,6 +93,7 @@ class FilesSourceProperties(TypedDict):
     writable: NotRequired[bool]
     requires_roles: NotRequired[Optional[str]]
     requires_groups: NotRequired[Optional[str]]
+    disable_templating: NotRequired[Optional[bool]]
     # API helper values
     uri_root: NotRequired[str]
     type: NotRequired[str]
@@ -298,18 +300,22 @@ class FilesSource(SingleFileSource, SupportsBrowsing):
         """Return true if the filesource implements the SupportsBrowsing interface."""
 
 
+def file_source_type_is_browsable(target_type: Type["BaseFilesSource"]) -> bool:
+    # Check whether the list method has been overridden
+    return target_type.list != BaseFilesSource.list or target_type._list != BaseFilesSource._list
+
+
 class BaseFilesSource(FilesSource):
     plugin_kind: ClassVar[PluginKind] = PluginKind.rfs  # Remote File Source by default, override in subclasses
 
     def get_browsable(self) -> bool:
-        # Check whether the list method has been overridden
-        return type(self).list != BaseFilesSource.list or type(self)._list != BaseFilesSource._list
+        return file_source_type_is_browsable(type(self))
 
     def get_prefix(self) -> Optional[str]:
         return self.id
 
     def get_scheme(self) -> str:
-        return "gxfiles"
+        return self.scheme or "gxfiles"
 
     def get_writable(self) -> bool:
         return self.writable
@@ -359,6 +365,7 @@ class BaseFilesSource(FilesSource):
         self.writable = kwd.pop("writable", DEFAULT_WRITABLE)
         self.requires_roles = kwd.pop("requires_roles", None)
         self.requires_groups = kwd.pop("requires_groups", None)
+        self.disable_templating = kwd.pop("disable_templating", False)
         self._validate_security_rules()
         # If coming from to_dict, strip API helper values
         kwd.pop("uri_root", None)
@@ -376,6 +383,8 @@ class BaseFilesSource(FilesSource):
             "browsable": self.get_browsable(),
             "requires_roles": self.requires_roles,
             "requires_groups": self.requires_groups,
+            "disable_templating": self.disable_templating,
+            "scheme": self.get_scheme(),
         }
         if self.get_browsable():
             rval["uri_root"] = self.get_uri_root()
@@ -497,6 +506,11 @@ class BaseFilesSource(FilesSource):
 
     def _evaluate_prop(self, prop_val: Any, user_context: "OptionalUserContext"):
         rval = prop_val
+
+        # just return if we've disabled templating for this plugin
+        if self.disable_templating:
+            return rval
+
         if isinstance(prop_val, str) and "$" in prop_val:
             template_context = dict(
                 user=user_context,
diff --git a/lib/galaxy/files/sources/azure.py b/lib/galaxy/files/sources/azure.py
index 519c3354ed5..125bbc29191 100644
--- a/lib/galaxy/files/sources/azure.py
+++ b/lib/galaxy/files/sources/azure.py
@@ -32,6 +32,7 @@ class AzureFileSource(PyFilesystem2FilesSource):
         account_name = all_props["account_name"]
         account_key = all_props["account_key"]
         container = all_props["container_name"]
+        handle: Union[BlobFSV2, BlobFS]
         if namespace_type == "flat":
             handle = BlobFS(account_name, container, account_key)
         else:
diff --git a/lib/galaxy/files/templates/__init__.py b/lib/galaxy/files/templates/__init__.py
new file mode 100644
index 00000000000..aa8faf85fd3
--- /dev/null
+++ b/lib/galaxy/files/templates/__init__.py
@@ -0,0 +1,17 @@
+from .manager import ConfiguredFileSourceTemplates
+from .models import (
+    FileSourceConfiguration,
+    FileSourceTemplate,
+    FileSourceTemplateSummaries,
+    FileSourceTemplateType,
+    template_to_configuration,
+)
+
+__all__ = (
+    "ConfiguredFileSourceTemplates",
+    "FileSourceConfiguration",
+    "FileSourceTemplate",
+    "FileSourceTemplateSummaries",
+    "FileSourceTemplateType",
+    "template_to_configuration",
+)
diff --git a/lib/galaxy/files/templates/examples/__init__.py b/lib/galaxy/files/templates/examples/__init__.py
new file mode 100644
index 00000000000..3220cb7423f
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/__init__.py
@@ -0,0 +1,5 @@
+from galaxy.util.resources import resource_string
+
+
+def get_example(filename) -> str:
+    return resource_string("galaxy.files.templates.examples", filename)
diff --git a/lib/galaxy/files/templates/examples/admin_secrets.yml b/lib/galaxy/files/templates/examples/admin_secrets.yml
new file mode 100644
index 00000000000..5c421b2278e
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/admin_secrets.yml
@@ -0,0 +1,13 @@
+- id: admin_secret_directory
+  name: Secret Directory
+  description: An directory constructed from admin secrets.
+  configuration:
+    type: posix
+    root: /path/to/data/{{ environment.var }}/{{ environment.sec }}
+  environment:
+    var:
+      type: variable
+      variable: GALAXY_SECRET_HOME_VAR
+    sec:
+      type: secret
+      vault_key: "secret_directory_file_source/my_secret"
diff --git a/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml b/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
new file mode 100644
index 00000000000..2cbec347ce8
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
@@ -0,0 +1,15 @@
+- id: admin_secret_directory
+  name: Secret Directory with Defaults
+  description: An directory constructed from admin secrets or defaults.
+  configuration:
+    type: posix
+    root: /path/to/data/{{ environment.var }}/{{ environment.sec }}
+  environment:
+    var:
+      type: variable
+      variable: GALAXY_SECRET_HOME_VAR
+      default: default_var
+    sec:
+      type: secret
+      vault_key: "secret_directory_file_source/my_secret"
+      default: default_sec
diff --git a/lib/galaxy/files/templates/examples/play.yml b/lib/galaxy/files/templates/examples/play.yml
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
new file mode 100644
index 00000000000..81e62afa16a
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
@@ -0,0 +1,30 @@
+- id: aws_private
+  name: Amazon Web Services Private Bucket
+  description: Setup access to a private AWS bucket using a secret access key. 
+  configuration:
+    type: s3fs
+    bucket: "{{ bucket }}"
+    writable: "{{ writable }}"
+    secret: "{{ secret_key }}"
+    key: "{{ access_key }}"
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The "access key ID" as defined in the [Amazon Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [Amazon Web Services Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        access. This should be a bucket the user described by the Access Key ID has access to.
+    writable:
+      label: Writable?
+      type: boolean
+      help: Is this a bucket you have permission to write to?
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |        
+        The "secret access key" as defined in the [Amazon Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
diff --git a/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml b/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
new file mode 100644
index 00000000000..fd1493e726f
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
@@ -0,0 +1,15 @@
+- id: aws_public
+  name: Amazon Web Services Public Bucket
+  description: Setup anonymous access to a public AWS bucket. 
+  configuration:
+    type: s3fs
+    bucket: "{{ variables.bucket }}"
+    writable: false
+    anon: true
+  variables:
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [Amazon Web Services Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        anonymously access.
diff --git a/lib/galaxy/files/templates/examples/production_azure.yml b/lib/galaxy/files/templates/examples/production_azure.yml
new file mode 100644
index 00000000000..0f0090f3711
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_azure.yml
@@ -0,0 +1,44 @@
+- id: azure
+  version: 0
+  name: Azure Blob Storage
+  description: |
+    This template allows connecting to [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure
+    container_name: "{{ variables.container_name }}"
+    account_name: "{{ variables.account_name }}"
+    account_key: "{{ secrets.account_key }}"
+    namespace_type: "{{ 'hierarchical' if variables.hierarchical else 'flat' }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container. More information on containers can be found
+        in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction#containers).
+    account_name:
+      label: Storage Account Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage account. More information on containers can be found in the
+        [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview).
+    hierarchical:
+      label: Hierarchical?
+      type: boolean
+      default: true
+      help: |
+        Is this storage hierarchical (e.g. does it use a Azure Data Lake Storage Gen2 hierarchical namespace)?
+        More information on Data Lake Storage namespaces can be found in the
+        [Azure Blob Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-namespace).
+    writable:
+      label: Writable?
+      type: boolean
+      default: true
+      help: Allow Galaxy to write data to this Azure Blob Storage container.
+  secrets:
+    account_key:
+      label: Account Key
+      help: |
+        The Azure Blob Storage account key to use to access your Azure Blob Storage data. More information
+        on account keys can be found in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage).
diff --git a/lib/galaxy/files/templates/examples/production_ftp.yml b/lib/galaxy/files/templates/examples/production_ftp.yml
new file mode 100644
index 00000000000..2f3d44d7c52
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_ftp.yml
@@ -0,0 +1,39 @@
+- id: ftp
+  version: 0
+  name: An FTP Server
+  description: |
+    This template allows connecting to FTP servers. This file source plugin should
+    support FTP and FTPS servers.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      label: FTP Host
+      type: string
+      help: Host of FTP Server to connect to.
+    user:
+      label: FTP User
+      type: string
+      help: |
+        Username to connect with. Leave this blank to connect to the server
+        anonymously (if allowed by target server).
+    writable:
+      label: Writable?
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+    port:
+      label: FTP Port
+      type: integer
+      help: Port used to connect to the FTP server.
+      default: 21
+  secrets:
+    password:
+      label: FTP Password
+      help: |
+        Password to connect to FTP server with. Leave this blank to connect
+        to the server anonymously (if allowed by target server).
diff --git a/lib/galaxy/files/templates/examples/production_s3fs.yml b/lib/galaxy/files/templates/examples/production_s3fs.yml
new file mode 100644
index 00000000000..19cea3e41dc
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_s3fs.yml
@@ -0,0 +1,57 @@
+- id: s3fs
+  name: S3 Compatible Storage with Credentials
+  description: |
+    The APIs used to connect to Amazon's S3 (Simple Storage Service) have become something
+    of an unofficial standard for cloud storage across a variety of vendors and services.
+    Many vendors offer storage APIs compatible with S3. This template configuration allows
+    using such service as a Galaxy storage location as long as you are able to find the
+    connection details and have the relevant credentials.
+
+    Given the amount of information needed to connect to such a service, this is a bit of an
+    advanced template and probably should not be used to connect to a service if a more
+    specific template is available.
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The less secure part of your access tokens or access keys that describe the user
+        that is accessing the data. The [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html)
+        calls these an "access key ID", the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_access_key_id``.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. How to setup buckets for your storage will vary from service to service
+        but all S3 compatible storage services should have the concept of a bucket to namespace
+        a grouping of your data together with.
+    endpoint_url:
+      label: S3-Compatible API Endpoint
+      type: string
+      help: |
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        For instance, the CloudFlare documentation describes its endpoints as ``https://<accountid>.r2.cloudflarestorage.com``. Here
+        you would substitute your CloudFlare account ID into the endpoint url and use that value.
+        So if your account ID was ``galactian``, you would enter ``galactian.r2.cloudflarestorage.com``.
+        The [MinIO](https://min.io/docs/minio/linux/integrations/aws-cli-with-minio.html)
+        documentation describes the endpoint URL for its Play service as ``https://play.min.io:9000``,
+        this value would be entered here.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        The secret key used to connect to the S3 compatible storage with for the given access key.
+
+        The [Amazon documentation] calls these an "secret access key" and
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_secret_access_key``. Internally to Galaxy, we often just call
+        this the ``secret_key``.
+  configuration:
+    type: s3fs
+    endpoint_url: '{{ variables.endpoint_url }}'
+    key: '{{ variables.access_key }}'
+    secret: '{{ secrets.secret_key }}'
+    bucket: '{{ variables.bucket }}'
diff --git a/lib/galaxy/files/templates/examples/s3fs_by_host_and_port.yml b/lib/galaxy/files/templates/examples/s3fs_by_host_and_port.yml
new file mode 100644
index 00000000000..3381d2357a6
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/s3fs_by_host_and_port.yml
@@ -0,0 +1,91 @@
+- id: s3fs
+  name: S3 Compatible Storage with Credentials
+  description: |
+    The APIs used to connect to Amazon's S3 (Simple Storage Service) have become something
+    of an unofficial standard for cloud storage across a variety of vendors and services.
+    Many vendors offer storage APIs compatible with S3. This template configuration allows
+    using such service as a Galaxy storage location as long as you are able to find the
+    connection details and have the relevant credentials.
+
+    Given the amount of information needed to connect to such a service, this is a bit of an
+    advanced template and probably should not be used to connect to a service if a more
+    specific template is available.
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The less secure part of your access tokens or access keys that describe the user
+        that is accessing the data. The [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html)
+        calls these an "access key ID", the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_access_key_id``.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. How to setup buckets for your storage will vary from service to service
+        but all S3 compatible storage services should have the concept of a bucket to namespace
+        a grouping of your data together with.
+    host:
+      label: Connection Host
+      type: string
+      help: |
+        The [hostname](https://en.wikipedia.org/wiki/Hostname) used to connect to the target
+        S3 compatible service.
+        
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. For instance, the CloudFlare documentation
+        describes its endpoints as ``https://<accountid>.r2.cloudflarestorage.com``. Here
+        you would substitute your CloudFlare account ID into the endpoint and shave off the ``https://``,
+        so if your account ID was ``galactian``, you would enter ``galactian.r2.cloudflarestorage.com``.
+
+    port:
+      label: Connection Port
+      type: integer
+      default: 443
+      help: |
+        The [port](https://en.wikipedia.org/wiki/Port_(computer_networking)) used to connect
+        to the target S3 compatible service. This might be ``443`` if you cannot find a relevant
+        port - this is the default for secure HTTP connections.
+
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. The [MinIO](https://min.io/docs/minio/linux/integrations/aws-cli-with-minio.html)
+        documentation describes the endpoint URL for its Play service as ``https://play.min.io:9000``.
+        The ``:9000`` here indicates this port should be specified as ``9000``. Alternatively, the
+        CloudFlare documentation describes its endpoints ``https://<accountid>.r2.cloudflarestorage.com``.
+        Here there is no number at the end of the URL so the port is ``443`` as long the URL starts
+        with ``https``.
+    connection_path:
+      label: Connection Path
+      type: string
+      default: ""
+      help: |
+        This is an advanced configuration option and it is very likely best to just keep this empty
+        for most storage services. If specified, it will be the prefix in the URL for the S3 compatible
+        API after the host and port to reach the target API.
+    secure:
+      label: Use HTTPS?
+      type: boolean
+      default: true
+      help: |
+        This is an advanced configuration option and if this option is not checked, you should not assume
+        your data is secure at all. This should only ever be unchecked during testing new or experimental
+        services with data and keys you do not care about.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        The secret key used to connect to the S3 compatible storage with for the given access key.
+
+        The [Amazon documentation] calls these an "secret access key" and
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_secret_access_key``. Internally to Galaxy, we often just call
+        this the ``secret_key``.
+  configuration:
+    type: s3fs
+    endpoint_url: '{{ "https" if variables.secure else "http" }}://{{ variables.host }}:{{ variables.port }}/{{ variables.connection_path }}'
+    key: '{{ variables.access_key }}'
+    secret: '{{ secrets.secret_key }}'
+    bucket: '{{ variables.bucket }}'
diff --git a/lib/galaxy/files/templates/examples/templating_override.yml b/lib/galaxy/files/templates/examples/templating_override.yml
new file mode 100644
index 00000000000..ad11b3265eb
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/templating_override.yml
@@ -0,0 +1,13 @@
+- id: project_disk
+  name: Project Disk
+  description: |
+    Disk in our institutional ``/data`` directory for you user's project.""
+  configuration:
+    type: posix
+    root: '/data/projects/@= user.username | ensure_path_component =@/@= variables.project_name | ensure_path_component =@'
+    template_start: '@='
+    template_end: '=@'
+  variables:
+    project_name:
+      type: path_component
+      help: Project name used in path.
diff --git a/lib/galaxy/files/templates/manager.py b/lib/galaxy/files/templates/manager.py
new file mode 100644
index 00000000000..79a64909399
--- /dev/null
+++ b/lib/galaxy/files/templates/manager.py
@@ -0,0 +1,86 @@
+import os
+from typing import (
+    List,
+    Optional,
+    Protocol,
+)
+
+from yaml import safe_load
+
+from galaxy.util.config_templates import (
+    apply_syntactic_sugar,
+    find_template,
+    find_template_by,
+    InstanceDefinition,
+    RawTemplateConfig,
+    TemplateReference,
+    validate_secrets_and_variables,
+    verify_vault_configured_if_uses_secrets,
+)
+from .models import (
+    FileSourceTemplate,
+    FileSourceTemplateCatalog,
+    FileSourceTemplateSummaries,
+)
+
+SECRETS_NEED_VAULT_MESSAGE = "The file source templates configuration can not be used - a Galaxy vault must be configured for templates that use secrets - please set the vault_config_file configuration option to point at a valid vault configuration."
+
+
+class AppConfigProtocol(Protocol):
+    file_source_templates: Optional[List[RawTemplateConfig]]
+    file_source_templates_config_file: Optional[str]
+
+
+class ConfiguredFileSourceTemplates:
+    catalog: FileSourceTemplateCatalog
+
+    def __init__(self, catalog: FileSourceTemplateCatalog):
+        self.catalog = catalog
+
+    @staticmethod
+    def from_app_config(config: AppConfigProtocol, vault_configured=None) -> "ConfiguredFileSourceTemplates":
+        raw_config = config.file_source_templates
+        if raw_config is None:
+            config_file = config.file_source_templates_config_file
+            if config_file and os.path.exists(config_file):
+                with open(config_file) as f:
+                    raw_config = safe_load(f)
+        if raw_config is None:
+            raw_config = []
+        catalog = raw_config_to_catalog(raw_config)
+        verify_vault_configured_if_uses_secrets(
+            catalog,
+            vault_configured,
+            SECRETS_NEED_VAULT_MESSAGE,
+        )
+        templates = ConfiguredFileSourceTemplates(catalog)
+        return templates
+
+    @property
+    def summaries(self) -> FileSourceTemplateSummaries:
+        templates = self.catalog.root
+        summaries = []
+        for template in templates:
+            template_dict = template.model_dump()
+            configuration = template_dict.pop("configuration")
+            template_dict.pop("environment")
+            object_store_type = configuration["type"]
+            template_dict["type"] = object_store_type
+            summaries.append(template_dict)
+        return FileSourceTemplateSummaries.model_validate(summaries)
+
+    def find_template(self, instance_reference: TemplateReference) -> FileSourceTemplate:
+        """Find the corresponding template and throw ObjectNotFound if not available."""
+        return find_template(self.catalog.root, instance_reference, "file source")
+
+    def find_template_by(self, template_id: str, template_version: int) -> FileSourceTemplate:
+        return find_template_by(self.catalog.root, template_id, template_version, "file source")
+
+    def validate(self, instance: InstanceDefinition):
+        template = self.find_template(instance)
+        validate_secrets_and_variables(instance, template)
+
+
+def raw_config_to_catalog(raw_config: List[RawTemplateConfig]) -> FileSourceTemplateCatalog:
+    effective_root = apply_syntactic_sugar(raw_config)
+    return FileSourceTemplateCatalog.model_validate(effective_root)
diff --git a/lib/galaxy/files/templates/models.py b/lib/galaxy/files/templates/models.py
new file mode 100644
index 00000000000..2e22cc904c3
--- /dev/null
+++ b/lib/galaxy/files/templates/models.py
@@ -0,0 +1,187 @@
+from typing import (
+    Any,
+    Dict,
+    List,
+    Literal,
+    Optional,
+    Type,
+    Union,
+)
+
+from pydantic import RootModel
+
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    expand_raw_config,
+    MarkdownContent,
+    populate_default_variables,
+    SecretsDict,
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateExpansion,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableValueType,
+    UserDetailsDict,
+)
+
+FileSourceTemplateType = Literal["ftp", "posix", "s3fs", "azure"]
+
+
+class PosixFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["posix"]
+    root: Union[str, TemplateExpansion]
+    writable: Union[bool, TemplateExpansion] = False
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class PosixFileSourceConfiguration(StrictModel):
+    type: Literal["posix"]
+    root: str
+    writable: bool = False
+
+
+class S3FSFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["s3fs"]
+    endpoint_url: Optional[Union[str, TemplateExpansion]] = None
+    anon: Optional[Union[bool, TemplateExpansion]] = False
+    secret: Optional[Union[str, TemplateExpansion]] = None
+    key: Optional[Union[str, TemplateExpansion]] = None
+    bucket: Optional[Union[str, TemplateExpansion]] = None
+    writable: Union[bool, TemplateExpansion] = False
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class S3FSFileSourceConfiguration(StrictModel):
+    type: Literal["s3fs"]
+    endpoint_url: Optional[str] = None
+    anon: Optional[bool] = False
+    secret: Optional[str] = None
+    key: Optional[str] = None
+    bucket: Optional[str] = None
+    writable: bool = False
+
+
+class FtpFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["ftp"]
+    host: Union[str, TemplateExpansion]
+    port: Union[int, TemplateExpansion] = 21
+    user: Optional[Union[str, TemplateExpansion]] = None
+    passwd: Optional[Union[str, TemplateExpansion]] = None
+    writable: Union[bool, TemplateExpansion] = False
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class FtpFileSourceConfiguration(StrictModel):
+    type: Literal["ftp"]
+    host: str
+    port: int = 21
+    user: Optional[str] = None
+    passwd: Optional[str] = None
+    writable: bool = False
+
+
+class AzureFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["azure"]
+    account_name: Union[str, TemplateExpansion]
+    container_name: Union[str, TemplateExpansion]
+    account_key: Union[str, TemplateExpansion]
+    writable: Union[bool, TemplateExpansion] = False
+    namespace_type: Union[str, TemplateExpansion] = "hierarchical"
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class AzureFileSourceConfiguration(StrictModel):
+    type: Literal["azure"]
+    account_name: str
+    container_name: str
+    account_key: str
+    namespace_type: str = "hierarchical"
+    writable: bool = False
+
+
+FileSourceTemplateConfiguration = Union[
+    PosixFileSourceTemplateConfiguration,
+    S3FSFileSourceTemplateConfiguration,
+    FtpFileSourceTemplateConfiguration,
+    AzureFileSourceTemplateConfiguration,
+]
+FileSourceConfiguration = Union[
+    PosixFileSourceConfiguration,
+    S3FSFileSourceConfiguration,
+    FtpFileSourceConfiguration,
+    AzureFileSourceConfiguration,
+]
+
+
+class FileSourceTemplateBase(StrictModel):
+    """Version of FileSourceTemplate we can send to the UI/API.
+
+    The configuration key in the child type may have secretes
+    and shouldn't be exposed over the API - at least to non-admins.
+    """
+
+    id: str
+    name: Optional[str]
+    description: Optional[MarkdownContent]
+    # The UI should just show the most recent version but allow
+    # admins to define newer versions with new parameterizations
+    # and keep old versions in template catalog for backward compatibility
+    # for users with existing stores of that template.
+    version: int = 0
+    # Like with multiple versions, allow admins to deprecate a
+    # template by hiding but keep it in the catalog for backward
+    # compatibility for users with existing stores of that template.
+    hidden: bool = False
+    variables: Optional[List[TemplateVariable]] = None
+    secrets: Optional[List[TemplateSecret]] = None
+
+
+class FileSourceTemplateSummary(FileSourceTemplateBase):
+    type: FileSourceTemplateType
+
+
+class FileSourceTemplate(FileSourceTemplateBase):
+    configuration: FileSourceTemplateConfiguration
+    environment: Optional[List[TemplateEnvironmentEntry]] = None
+
+
+FileSourceTemplateCatalog = RootModel[List[FileSourceTemplate]]
+
+
+class FileSourceTemplateSummaries(RootModel):
+    root: List[FileSourceTemplateSummary]
+
+
+def template_to_configuration(
+    template: FileSourceTemplate,
+    variables: Dict[str, TemplateVariableValueType],
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
+) -> FileSourceConfiguration:
+    configuration_template = template.configuration
+    populate_default_variables(template.variables, variables)
+    raw_config = expand_raw_config(configuration_template, variables, secrets, user_details, environment)
+    return to_configuration_object(raw_config)
+
+
+TypesToConfigurationClasses: Dict[FileSourceTemplateType, Type[FileSourceConfiguration]] = {
+    "ftp": FtpFileSourceConfiguration,
+    "posix": PosixFileSourceConfiguration,
+    "s3fs": S3FSFileSourceConfiguration,
+    "azure": AzureFileSourceConfiguration,
+}
+
+
+def to_configuration_object(configuration_dict: Dict[str, Any]) -> FileSourceConfiguration:
+    if "type" not in configuration_dict:
+        raise KeyError("Configuration objects require a file source 'type' key, none found.")
+    object_store_type = configuration_dict["type"]
+    if object_store_type not in TypesToConfigurationClasses:
+        raise ValueError(f"Unknown file source type found in raw configuration dictionary ({object_store_type}).")
+    return TypesToConfigurationClasses[object_store_type](**configuration_dict)
diff --git a/lib/galaxy/files/unittest_utils/__init__.py b/lib/galaxy/files/unittest_utils/__init__.py
index c8ebbc13a5b..e04da53aabd 100644
--- a/lib/galaxy/files/unittest_utils/__init__.py
+++ b/lib/galaxy/files/unittest_utils/__init__.py
@@ -2,13 +2,16 @@ import os
 import tempfile
 from typing import Tuple
 
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+)
 from galaxy.files.plugins import FileSourcePluginsConfig
 
 
 class TestConfiguredFileSources(ConfiguredFileSources):
     def __init__(self, file_sources_config: FileSourcePluginsConfig, conf_dict: dict, test_root: str):
-        super().__init__(file_sources_config, conf_dict=conf_dict)
+        super().__init__(file_sources_config, ConfiguredFileSourcesConf(conf_dict=conf_dict))
         self.test_root = test_root
 
 
diff --git a/lib/galaxy/managers/_config_templates.py b/lib/galaxy/managers/_config_templates.py
new file mode 100644
index 00000000000..7d072f3a59f
--- /dev/null
+++ b/lib/galaxy/managers/_config_templates.py
@@ -0,0 +1,274 @@
+import logging
+import os
+from typing import (
+    cast,
+    Dict,
+    List,
+    Optional,
+    TypeVar,
+    Union,
+)
+
+from pydantic import BaseModel
+
+from galaxy.exceptions import (
+    ObjectNotFound,
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.managers.context import ProvidesUserContext
+from galaxy.model import (
+    CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE,
+    HasConfigEnvironment,
+    HasConfigSecrets,
+    HasConfigTemplate,
+    User,
+    UsesTemplatesAppConfig,
+)
+from galaxy.model.scoped_session import galaxy_scoped_session
+from galaxy.security.vault import (
+    UserVaultWrapper,
+    Vault,
+)
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    find_template_by,
+    secrets_as_dict,
+    SecretsDict,
+    Template,
+    TemplateEnvironmentSecret,
+    TemplateEnvironmentVariable,
+    TemplateVariableValueType,
+    validate_no_extra_variables_defined,
+    validate_specified_datatypes_variables,
+)
+
+log = logging.getLogger(__name__)
+
+SuppliedVariables = Dict[str, TemplateVariableValueType]
+SuppliedSecrets = Dict[str, str]
+
+
+class CreateInstancePayload(BaseModel):
+    name: str
+    description: Optional[str] = None
+    template_id: str
+    template_version: int
+    variables: SuppliedVariables
+    secrets: SuppliedSecrets
+
+
+class UpdateInstancePayload(BaseModel):
+    name: Optional[str] = None
+    description: Optional[str] = None
+    variables: Optional[SuppliedVariables] = None
+    hidden: Optional[bool] = None
+    active: Optional[bool] = None
+
+
+class UpdateInstanceSecretPayload(BaseModel):
+    secret_name: str
+    secret_value: str
+
+
+class UpgradeInstancePayload(BaseModel):
+    template_version: int
+    variables: SuppliedVariables
+    secrets: SuppliedSecrets
+
+
+ModifyInstancePayload = Union[UpdateInstanceSecretPayload, UpgradeInstancePayload, UpdateInstancePayload]
+
+
+def recover_secrets(
+    user_object_store: HasConfigSecrets, vault: Vault, app_config: UsesTemplatesAppConfig
+) -> SecretsDict:
+    user: User = user_object_store.user
+    user_vault = UserVaultWrapper(vault, user)
+    secrets: SecretsDict = {}
+    # now we could recover the list of secrets to fetch from...
+    # ones recorded as written in the persisted object, the ones
+    # expected in the catalog, or the ones expected in the definition
+    # persisted.
+    persisted_secret_names = user_object_store.template_secrets or []
+    for secret in persisted_secret_names:
+        vault_key = user_object_store.vault_key(secret, app_config)
+        secret_value = user_vault.read_secret(vault_key)
+        if secret_value is not None:
+            secrets[secret] = secret_value
+    return secrets
+
+
+def prepare_environment(
+    configuration_template: HasConfigEnvironment, vault: Vault, app_config: UsesTemplatesAppConfig
+) -> EnvironmentDict:
+    environment: EnvironmentDict = {}
+    for environment_entry in configuration_template.template_environment.root:
+        e_type = environment_entry.type
+        e_name = environment_entry.name
+        if e_type == "secret":
+            template_secret = cast(TemplateEnvironmentSecret, environment_entry)
+            secret_value = vault.read_secret(template_secret.vault_key) or template_secret.default
+            if secret_value:
+                environment[e_name] = secret_value
+        elif e_type == "variable":
+            template_variable = cast(TemplateEnvironmentVariable, environment_entry)
+            variable_value = os.environ.get(template_variable.variable)
+            if variable_value is None:
+                variable_value = template_variable.default
+            if variable_value:
+                environment[e_name] = variable_value
+        else:
+            raise Exception(f"Unknown environment entry type detected [{e_type}]")
+
+    return environment
+
+
+def update_template_instance(
+    sa_session: galaxy_scoped_session,
+    template_instance: HasConfigTemplate,
+    payload: UpdateInstancePayload,
+    template: Template,
+):
+    validate_specified_datatypes_variables(payload.variables or {}, template)
+    validate_no_extra_variables_defined(payload.variables or {}, template)
+    if payload.name is not None:
+        template_instance.name = payload.name
+    if payload.description is not None:
+        template_instance.description = payload.description
+    if payload.variables is not None:
+        actual_variables = updated_template_variables(payload.variables, template_instance, template)
+        template_instance.template_variables = actual_variables
+    if payload.hidden is not None:
+        template_instance.hidden = payload.hidden
+    if payload.active is not None:
+        if payload.active:
+            # unhide and activate
+            template_instance.active = True
+            template_instance.hidden = False
+        else:
+            # deactivate and hide
+            template_instance.active = False
+            template_instance.hidden = True
+    save_template_instance(sa_session, template_instance)
+    return template_instance
+
+
+def updated_template_variables(
+    supplied_variables: SuppliedVariables, template_instance: HasConfigTemplate, template: Template
+):
+    old_variables = template_instance.template_variables or {}
+    updated_variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = {}
+    for variable in template.variables or []:
+        variable_name = variable.name
+        old_value = old_variables.get(variable_name)
+        updated_value = supplied_variables.get(variable_name, old_value)
+        if updated_value:
+            updated_variables[variable_name] = updated_value
+    return updated_variables
+
+
+def purge_template_instance(
+    trans: ProvidesUserContext, template_instance: HasConfigTemplate, app_config: UsesTemplatesAppConfig
+):
+    user_vault = trans.user_vault
+    user_vault_key_prefix = template_instance.vault_id_prefix(app_config)
+    # it would be nice to just list the secrets but none of them do that... so catch NotImplemented
+    # and try with the secrets as we have record in the database of recording them.
+    try:
+        for secret in user_vault.list_secrets(user_vault_key_prefix):
+            user_vault.delete_secret(secret)
+    except NotImplementedError:
+        for secret in template_instance.template_secrets or []:
+            user_vault.delete_secret(f"{user_vault_key_prefix}/{secret}")
+    template_instance.active = False
+    template_instance.purged = True
+    save_template_instance(trans.sa_session, template_instance)
+
+
+def update_instance_secret(
+    trans: ProvidesUserContext,
+    template_instance: HasConfigTemplate,
+    template: Template,
+    payload: UpdateInstanceSecretPayload,
+    app_config: UsesTemplatesAppConfig,
+):
+    template_secrets = secrets_as_dict(template.secrets or [])
+    secret_name = payload.secret_name
+    if secret_name not in template_secrets:
+        raise RequestParameterInvalidException(f"Configuration template does not specify a secret named {secret_name}")
+
+    user_vault = trans.user_vault
+    key = template_instance.vault_key(payload.secret_name, app_config)
+    user_vault.write_secret(key, payload.secret_value)
+
+
+def upgrade_secrets(
+    trans: ProvidesUserContext,
+    template_instance: HasConfigTemplate,
+    target_template: Template,
+    payload: UpgradeInstancePayload,
+    app_config: UsesTemplatesAppConfig,
+):
+    recorded_secrets = template_instance.template_secrets or []
+
+    old_secrets = template_instance.template_secrets or []
+    new_secrets = payload.secrets
+
+    user_vault = trans.user_vault
+    upgraded_template_secrets = []
+    for secret in target_template.secrets or []:
+        secret_name = secret.name
+        upgraded_template_secrets.append(secret_name)
+        if secret_name not in new_secrets and secret_name not in old_secrets:
+            raise RequestParameterMissingException(f"secret {secret_name} not set in supplied request")
+        if secret_name not in new_secrets:
+            # keep old value
+            continue
+
+        secret_value = new_secrets[secret_name]
+        key = template_instance.vault_key(secret_name, app_config)
+        user_vault.write_secret(key, secret_value)
+        if secret_name not in recorded_secrets:
+            recorded_secrets.append(secret_name)
+
+    secrets_to_delete: List[str] = []
+    for recorded_secret in recorded_secrets:
+        if recorded_secret not in upgraded_template_secrets:
+            key = template_instance.vault_key(recorded_secret, app_config)
+            log.info(f"deleting {key} from user vault")
+            user_vault.delete_secret(key)
+            secrets_to_delete.append(recorded_secret)
+
+    for secret_to_delete in secrets_to_delete:
+        recorded_secrets.remove(secret_to_delete)
+
+    template_instance.template_secrets = recorded_secrets
+
+
+def save_template_instance(sa_session: galaxy_scoped_session, template_instance: HasConfigTemplate):
+    sa_session.add(template_instance)
+    sa_session.flush([template_instance])
+    sa_session.commit()
+
+
+T = TypeVar("T", bound=Template, covariant=True)
+
+
+def sort_templates(config, catalog: List[T], instance: HasConfigTemplate) -> List[T]:
+    configured_template: Optional[T] = None
+    try:
+        configured_template = find_template_by(
+            catalog, instance.template_id, instance.template_version, "config template"
+        )
+    except ObjectNotFound:
+        if config.user_config_templates_use_saved_configuration == "never":
+            raise
+    stored_template: T = instance.template
+    if config.user_config_templates_use_saved_configuration == "preferred" and configured_template:
+        templates = [stored_template, configured_template]
+    elif configured_template:
+        templates = [configured_template, stored_template]
+    else:
+        templates = [stored_template]
+    return templates
diff --git a/lib/galaxy/managers/file_source_instances.py b/lib/galaxy/managers/file_source_instances.py
new file mode 100644
index 00000000000..490a156ee57
--- /dev/null
+++ b/lib/galaxy/managers/file_source_instances.py
@@ -0,0 +1,438 @@
+import logging
+from typing import (
+    Any,
+    cast,
+    Dict,
+    List,
+    Literal,
+    Optional,
+    Set,
+    Union,
+)
+from uuid import uuid4
+
+from pydantic import (
+    BaseModel,
+    ValidationError,
+)
+
+from galaxy.exceptions import (
+    ItemOwnershipException,
+    RequestParameterInvalidException,
+)
+from galaxy.files import (
+    FileSourceScore,
+    FileSourcesUserContext,
+    UserDefinedFileSources,
+)
+from galaxy.files.plugins import (
+    FileSourcePluginLoader,
+    FileSourcePluginsConfig,
+)
+from galaxy.files.sources import (
+    BaseFilesSource,
+    file_source_type_is_browsable,
+    FilesSourceProperties,
+    PluginKind,
+)
+from galaxy.files.templates import (
+    ConfiguredFileSourceTemplates,
+    FileSourceConfiguration,
+    FileSourceTemplate,
+    FileSourceTemplateSummaries,
+    FileSourceTemplateType,
+)
+from galaxy.managers.context import ProvidesUserContext
+from galaxy.model import (
+    User,
+    UserFileSource,
+)
+from galaxy.model.scoped_session import galaxy_scoped_session
+from galaxy.security.vault import Vault
+from galaxy.util.config_templates import (
+    TemplateVariableValueType,
+    validate_no_extra_secrets_defined,
+    validate_no_extra_variables_defined,
+)
+from galaxy.util.plugin_config import plugin_source_from_dict
+from ._config_templates import (
+    CreateInstancePayload,
+    ModifyInstancePayload,
+    prepare_environment,
+    purge_template_instance,
+    recover_secrets,
+    save_template_instance,
+    sort_templates,
+    update_instance_secret,
+    update_template_instance,
+    updated_template_variables,
+    UpdateInstancePayload,
+    UpdateInstanceSecretPayload,
+    upgrade_secrets,
+    UpgradeInstancePayload,
+)
+
+log = logging.getLogger(__name__)
+
+USER_FILE_SOURCES_SCHEME = "gxuserfiles"
+
+
+class UserFileSourceModel(BaseModel):
+    id: Union[str, int]
+    uuid: str
+    uri_root: str
+    name: str
+    description: Optional[str]
+    hidden: bool
+    active: bool
+    purged: bool
+    type: FileSourceTemplateType
+    template_id: str
+    template_version: int
+    variables: Optional[Dict[str, TemplateVariableValueType]]
+    secrets: List[str]
+
+
+class UserDefinedFileSourcesConfig(BaseModel):
+    user_config_templates_index_by: Literal["uuid", "id"]
+    user_config_templates_use_saved_configuration: Literal["fallback", "preferred", "never"]
+
+    @staticmethod
+    def from_app_config(config) -> "UserDefinedFileSourcesConfig":
+        user_config_templates_index_by = config.user_config_templates_index_by
+        assert user_config_templates_index_by in ["uuid", "id"]
+        user_config_templates_use_saved_configuration = config.user_config_templates_use_saved_configuration
+        assert user_config_templates_use_saved_configuration in ["fallback", "preferred", "never"]
+        return UserDefinedFileSourcesConfig(
+            user_config_templates_index_by=user_config_templates_index_by,
+            user_config_templates_use_saved_configuration=user_config_templates_use_saved_configuration,
+        )
+
+
+class FileSourceInstancesManager:
+    _catalog: ConfiguredFileSourceTemplates
+    _sa_session: galaxy_scoped_session
+    _app_vault: Vault
+    _app_config: UserDefinedFileSourcesConfig
+
+    def __init__(
+        self,
+        catalog: ConfiguredFileSourceTemplates,
+        sa_session: galaxy_scoped_session,
+        vault: Vault,
+        app_config: UserDefinedFileSourcesConfig,
+    ):
+        self._catalog = catalog
+        self._sa_session = sa_session
+        self._app_vault = vault
+        self._app_config = app_config
+
+    @property
+    def summaries(self) -> FileSourceTemplateSummaries:
+        return self._catalog.summaries
+
+    def index(self, trans: ProvidesUserContext) -> List[UserFileSourceModel]:
+        stores = self._sa_session.query(UserFileSource).filter(UserFileSource.user_id == trans.user.id).all()
+        return [self._to_model(trans, s) for s in stores]
+
+    def show(self, trans: ProvidesUserContext, id: Union[str, int]) -> UserFileSourceModel:
+        user_file_source = self._get(trans, id)
+        return self._to_model(trans, user_file_source)
+
+    def purge_instance(self, trans: ProvidesUserContext, id: Union[str, int]) -> None:
+        persisted_file_source = self._get(trans, id)
+        purge_template_instance(trans, persisted_file_source, self._app_config)
+
+    def modify_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: ModifyInstancePayload
+    ) -> UserFileSourceModel:
+        if isinstance(payload, UpgradeInstancePayload):
+            return self._upgrade_instance(trans, id, payload)
+        elif isinstance(payload, UpdateInstanceSecretPayload):
+            return self._update_instance_secret(trans, id, payload)
+        else:
+            assert isinstance(payload, UpdateInstancePayload)
+            return self._update_instance(trans, id, payload)
+
+    def _upgrade_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpgradeInstancePayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        template = self._get_template(persisted_file_source, payload.template_version)
+        validate_no_extra_variables_defined(payload.variables, template)
+        validate_no_extra_secrets_defined(payload.secrets, template)
+        persisted_file_source.template_version = template.version
+        persisted_file_source.template_definition = template.model_dump()
+        actual_variables = updated_template_variables(
+            payload.variables,
+            persisted_file_source,
+            template,
+        )
+        persisted_file_source.template_variables = actual_variables
+        upgrade_secrets(trans, persisted_file_source, template, payload, self._app_config)
+        self._save(persisted_file_source)
+        return self._to_model(trans, persisted_file_source)
+
+    def _update_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstancePayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        template = self._get_template(persisted_file_source)
+        update_template_instance(self._sa_session, persisted_file_source, payload, template)
+        return self._to_model(trans, persisted_file_source)
+
+    def _update_instance_secret(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstanceSecretPayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        template = self._get_template(persisted_file_source)
+        update_instance_secret(trans, persisted_file_source, template, payload, self._app_config)
+        return self._to_model(trans, persisted_file_source)
+
+    def create_instance(self, trans: ProvidesUserContext, payload: CreateInstancePayload) -> UserFileSourceModel:
+        catalog = self._catalog
+        catalog.validate(payload)
+        template = catalog.find_template(payload)
+        assert template
+        user_vault = trans.user_vault
+        persisted_file_source = UserFileSource()
+        persisted_file_source.user_id = trans.user.id
+        assert persisted_file_source.user_id
+        persisted_file_source.uuid = uuid4().hex
+        persisted_file_source.template_definition = template.model_dump()
+        persisted_file_source.template_id = template.id
+        persisted_file_source.template_version = template.version
+        persisted_file_source.template_variables = payload.variables
+        persisted_file_source.name = payload.name
+        persisted_file_source.description = payload.description
+        self._save(persisted_file_source)
+
+        # see big comment in object_store_instances around same block for some
+        # notes about state handling here
+        recorded_secrets = []
+        try:
+            for secret, value in payload.secrets.items():
+                key = persisted_file_source.vault_key(secret, self._app_config)
+                user_vault.write_secret(key, value)
+                recorded_secrets.append(secret)
+        except Exception:
+            self._sa_session.delete(persisted_file_source)
+            raise
+        persisted_file_source.template_secrets = recorded_secrets
+        self._save(persisted_file_source)
+        return self._to_model(trans, persisted_file_source)
+
+    def _index_filter(self, id: Union[str, int]):
+        index_by = self._app_config.user_config_templates_index_by
+        index_filter: Any
+        if index_by == "id":
+            id_as_int = int(id)
+            index_filter = UserFileSource.__table__.c.id == id_as_int
+        else:
+            id_as_str = str(id)
+            index_filter = UserFileSource.__table__.c.uuid == id_as_str
+        return index_filter
+
+    def _get(self, trans: ProvidesUserContext, id: Union[str, int]) -> UserFileSource:
+        filter = self._index_filter(id)
+        user_file_source = self._sa_session.query(UserFileSource).filter(filter).one_or_none()
+        if user_file_source is None:
+            raise RequestParameterInvalidException(f"Failed to fetch object store for id {id}")
+        if user_file_source.user != trans.user:
+            raise ItemOwnershipException()
+        return user_file_source
+
+    def _get_template(
+        self, persisted_object_store: UserFileSource, template_version: Optional[int] = None
+    ) -> FileSourceTemplate:
+        catalog = self._catalog
+        target_template_version = template_version or persisted_object_store.template_version
+        template = catalog.find_template_by(persisted_object_store.template_id, target_template_version)
+        return template
+
+    def _save(self, user_file_source: UserFileSource) -> None:
+        save_template_instance(self._sa_session, user_file_source)
+
+    def _to_model(self, trans, persisted_file_source: UserFileSource) -> UserFileSourceModel:
+        file_source_type = persisted_file_source.template.configuration.type
+        secrets = persisted_file_source.template_secrets or []
+        index_by = self._app_config.user_config_templates_index_by
+        response_id: Union[str, int]
+        if index_by == "id":
+            ufs_id = str(persisted_file_source.id)
+            response_id = persisted_file_source.id
+        else:
+            ufs_id = str(persisted_file_source.uuid)
+            response_id = ufs_id
+        uri_root = f"{USER_FILE_SOURCES_SCHEME}://{ufs_id}"
+        return UserFileSourceModel(
+            id=response_id,
+            uuid=str(persisted_file_source.uuid),
+            uri_root=uri_root,
+            type=file_source_type,
+            template_id=persisted_file_source.template_id,
+            template_version=persisted_file_source.template_version,
+            variables=persisted_file_source.template_variables,
+            secrets=secrets,
+            name=persisted_file_source.name,
+            description=persisted_file_source.description,
+            hidden=persisted_file_source.hidden,
+            active=persisted_file_source.active,
+            purged=persisted_file_source.purged,
+        )
+
+
+class UserDefinedFileSourcesImpl(UserDefinedFileSources):
+    _sa_session: galaxy_scoped_session
+    _app_config: UserDefinedFileSourcesConfig
+    _file_sources_config: FileSourcePluginsConfig
+    _plugin_loader: FileSourcePluginLoader
+    _app_vault: Vault
+
+    def __init__(
+        self,
+        sa_session: galaxy_scoped_session,
+        app_config: UserDefinedFileSourcesConfig,
+        file_sources_config: FileSourcePluginsConfig,
+        plugin_loader: FileSourcePluginLoader,
+        vault: Vault,
+        catalog: ConfiguredFileSourceTemplates,
+    ):
+        self._sa_session = sa_session
+        self._app_config = app_config
+        self._plugin_loader = plugin_loader
+        self._file_sources_config = file_sources_config
+        self._app_vault = vault
+        self._catalog = catalog
+
+    def _user_file_source(self, uri: str) -> Optional[UserFileSource]:
+        if "://" not in uri:
+            return None
+        uri_scheme, uri_rest = uri.split("://", 1)
+        if uri_scheme != USER_FILE_SOURCES_SCHEME:
+            return None
+        if "/" in uri_rest:
+            uri_root, _ = uri_rest.split("/", 1)
+        else:
+            uri_root = uri_rest
+        index_by = self._app_config.user_config_templates_index_by
+        index_filter: Any
+        if index_by == "id":
+            index_filter = UserFileSource.__table__.c.id == uri_root
+        else:
+            index_filter = UserFileSource.__table__.c.uuid == uri_root
+
+        user_object_store: UserFileSource = self._sa_session.query(UserFileSource).filter(index_filter).one()
+        return user_object_store
+
+    def _file_source_properties_from_uri(self, uri: str) -> Optional[FilesSourceProperties]:
+        user_file_source = self._user_file_source(uri)
+        if not user_file_source:
+            return None
+        if not user_file_source.active:
+            return None
+        return self._file_source_properties(user_file_source)
+
+    def _file_source_properties(self, user_file_source: UserFileSource) -> FilesSourceProperties:
+        secrets = recover_secrets(user_file_source, self._app_vault, self._app_config)
+        environment = prepare_environment(user_file_source, self._app_vault, self._app_config)
+        templates = sort_templates(
+            self._app_config,
+            self._catalog.catalog.root,
+            user_file_source,
+        )
+        file_source_configuration: FileSourceConfiguration = user_file_source.file_source_configuration(
+            secrets=secrets, environment=environment, templates=templates
+        )
+        file_source_properties = cast(FilesSourceProperties, file_source_configuration.model_dump())
+        file_source_properties["label"] = user_file_source.name
+        file_source_properties["doc"] = user_file_source.description
+        file_source_properties["id"] = f"{user_file_source.uuid}"
+        file_source_properties["scheme"] = USER_FILE_SOURCES_SCHEME
+        # Moved this into templates - plugins should just define this and decide what
+        # that looks like. aws public buckets are clearly not writable, private buckets
+        # maybe should give users the option, etc..
+        # file_source_properties["writable"] = True
+
+        # We did templating with Jinja - disable Galaxy's Cheetah templating for
+        # these plugins. I can't imagine a use case for that and I would hate to templating
+        # languages having odd interactions.
+        file_source_properties["disable_templating"] = True
+        return file_source_properties
+
+    def validate_uri_root(self, uri: str, user_context: FileSourcesUserContext) -> None:
+        user_object_store = self._user_file_source(uri)
+        if not user_object_store:
+            return
+        if user_object_store.user.username != user_context.username:
+            raise ItemOwnershipException("Your Galaxy user does not have access to the requested resource.")
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        files_source_properties = self._file_source_properties_from_uri(url)
+        if files_source_properties is None:
+            return None
+        file_source = self._file_source(files_source_properties)
+        return FileSourceScore(file_source, len(url))
+
+    def _file_source(self, files_source_properties: FilesSourceProperties) -> BaseFilesSource:
+        plugin_source = plugin_source_from_dict([cast(Dict[str, Any], files_source_properties)])
+        file_source = self._plugin_loader.load_plugins(
+            plugin_source,
+            self._file_sources_config,
+        )[0]
+        return file_source
+
+    def _all_user_file_source_properties(self, user_context: FileSourcesUserContext) -> List[FilesSourceProperties]:
+        username_filter = User.__table__.c.username == user_context.username
+        user: Optional[User] = self._sa_session.query(User).filter(username_filter).one_or_none()
+        if user is None:
+            return []
+        all_file_source_properties: List[FilesSourceProperties] = []
+        for user_file_source in user.file_sources:
+            if user_file_source.hidden:
+                continue
+            try:
+                files_source_properties = self._file_source_properties(user_file_source)
+            except ValidationError:
+                log.warning(f"Problem validating user_file_source {user_file_source.uuid}, skipping load.")
+                continue
+            all_file_source_properties.append(files_source_properties)
+        return all_file_source_properties
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: FileSourcesUserContext,
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        """Write out user file sources as list of config dictionaries."""
+        as_dicts = []
+        for files_source_properties in self._all_user_file_source_properties(user_context):
+            plugin_kind = PluginKind.rfs
+            if include_kind and plugin_kind not in include_kind:
+                continue
+            if exclude_kind and plugin_kind in exclude_kind:
+                continue
+            files_source_type = files_source_properties["type"]
+            is_browsable = file_source_type_is_browsable(self._plugin_loader.get_plugin_type_class(files_source_type))
+            if browsable_only and not is_browsable:
+                continue
+            file_source = self._file_source(files_source_properties)
+            as_dicts.append(file_source.to_dict(for_serialization=for_serialization, user_context=user_context))
+        return as_dicts
+
+
+__all__ = (
+    "CreateInstancePayload",
+    "FileSourceInstancesManager",
+    "ModifyInstancePayload",
+    "UpdateInstancePayload",
+    "UpdateInstanceSecretPayload",
+    "UpgradeInstancePayload",
+    "UserDefinedFileSourcesImpl",
+    "UserFileSourceModel",
+    "FileSourceInstancesManager",
+    "UserDefinedFileSourcesConfig",
+)
diff --git a/lib/galaxy/managers/object_store_instances.py b/lib/galaxy/managers/object_store_instances.py
index ae1565e462a..9d408f05bc5 100644
--- a/lib/galaxy/managers/object_store_instances.py
+++ b/lib/galaxy/managers/object_store_instances.py
@@ -17,19 +17,12 @@ from typing import (
 )
 from uuid import uuid4
 
-from pydantic import BaseModel
-
 from galaxy.exceptions import (
     ItemOwnershipException,
     RequestParameterInvalidException,
-    RequestParameterMissingException,
 )
 from galaxy.managers.context import ProvidesUserContext
-from galaxy.model import (
-    OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE,
-    User,
-    UserObjectStore,
-)
+from galaxy.model import UserObjectStore
 from galaxy.model.scoped_session import galaxy_scoped_session
 from galaxy.objectstore import (
     BaseUserObjectStoreResolver,
@@ -41,55 +34,47 @@ from galaxy.objectstore.badges import serialize_badges
 from galaxy.objectstore.templates import (
     ConfiguredObjectStoreTemplates,
     ObjectStoreConfiguration,
+    ObjectStoreTemplate,
     ObjectStoreTemplateSummaries,
     ObjectStoreTemplateType,
 )
-from galaxy.objectstore.templates.models import ObjectStoreTemplateVariableValueType
-from galaxy.security.vault import (
-    UserVaultWrapper,
-    Vault,
+from galaxy.security.vault import Vault
+from galaxy.util.config_templates import (
+    TemplateVariableValueType,
+    validate_no_extra_secrets_defined,
+    validate_no_extra_variables_defined,
+)
+from ._config_templates import (
+    CreateInstancePayload,
+    ModifyInstancePayload,
+    prepare_environment,
+    purge_template_instance,
+    recover_secrets,
+    save_template_instance,
+    sort_templates,
+    update_instance_secret,
+    update_template_instance,
+    updated_template_variables,
+    UpdateInstancePayload,
+    UpdateInstanceSecretPayload,
+    upgrade_secrets,
+    UpgradeInstancePayload,
 )
 
 log = logging.getLogger(__name__)
 
 
-class CreateInstancePayload(BaseModel):
-    name: str
-    description: Optional[str] = None
-    template_id: str
-    template_version: int
-    variables: Dict[str, ObjectStoreTemplateVariableValueType]
-    secrets: Dict[str, str]
-
-
-class UpdateInstancePayload(BaseModel):
-    name: Optional[str] = None
-    description: Optional[str] = None
-    variables: Optional[Dict[str, ObjectStoreTemplateVariableValueType]] = None
-
-
-class UpdateInstanceSecretPayload(BaseModel):
-    secret_name: str
-    secret_value: str
-
-
-class UpgradeInstancePayload(BaseModel):
-    template_version: int
-    variables: Dict[str, ObjectStoreTemplateVariableValueType]
-    secrets: Dict[str, str]
-
-
 class UserConcreteObjectStoreModel(ConcreteObjectStoreModel):
     id: Union[int, str]
     uuid: str
     type: ObjectStoreTemplateType
     template_id: str
     template_version: int
-    variables: Optional[Dict[str, ObjectStoreTemplateVariableValueType]]
+    variables: Optional[Dict[str, TemplateVariableValueType]]
     secrets: List[str]
-
-
-ModifyInstancePayload = Union[UpdateInstanceSecretPayload, UpgradeInstancePayload, UpdateInstancePayload]
+    hidden: bool
+    active: bool
+    purged: bool
 
 
 class ObjectStoreInstancesManager:
@@ -124,87 +109,43 @@ class ObjectStoreInstancesManager:
             assert isinstance(payload, UpdateInstancePayload)
             return self._update_instance(trans, id, payload)
 
+    def purge_instance(self, trans: ProvidesUserContext, id: Union[str, int]) -> None:
+        persisted_object_store = self._get(trans, id)
+        purge_template_instance(trans, persisted_object_store, self._app_config)
+
     def _upgrade_instance(
         self, trans: ProvidesUserContext, id: Union[str, int], payload: UpgradeInstancePayload
     ) -> UserConcreteObjectStoreModel:
         persisted_object_store = self._get(trans, id)
-        catalog = self._catalog
-        template = catalog.find_template_by(persisted_object_store.template_id, payload.template_version)
+        template = self._get_template(persisted_object_store, payload.template_version)
         persisted_object_store.template_version = template.version
         persisted_object_store.template_definition = template.model_dump()
-        old_variables = persisted_object_store.template_variables or {}
-        updated_variables = payload.variables
-        actual_variables: OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = {}
-        for variable in template.variables or []:
-            variable_name = variable.name
-            old_value = old_variables.get(variable_name)
-            updated_value = updated_variables.get(variable_name, old_value)
-            if updated_value:
-                actual_variables[variable_name] = updated_value
-
+        validate_no_extra_variables_defined(payload.variables, template)
+        validate_no_extra_secrets_defined(payload.secrets, template)
+        actual_variables = updated_template_variables(
+            payload.variables,
+            persisted_object_store,
+            template,
+        )
         persisted_object_store.template_variables = actual_variables
-        old_secrets = persisted_object_store.template_secrets or []
-        new_secrets = payload.secrets
-
-        recorded_secrets = persisted_object_store.template_secrets or []
-
-        user_vault = trans.user_vault
-        upgraded_template_secrets = []
-        for secret in template.secrets or []:
-            secret_name = secret.name
-            upgraded_template_secrets.append(secret_name)
-            if secret_name not in new_secrets and secret_name not in old_secrets:
-                raise RequestParameterMissingException(f"secret {secret_name} not set in supplied request")
-            if secret_name not in new_secrets:
-                # keep old value
-                continue
-
-            secret_value = new_secrets[secret_name]
-            key = user_vault_key(persisted_object_store, secret_name, self._app_config)
-            user_vault.write_secret(key, secret_value)
-            if secret_name not in recorded_secrets:
-                recorded_secrets.append(secret_name)
-
-        secrets_to_delete: List[str] = []
-        for recorded_secret in recorded_secrets:
-            if recorded_secret not in upgraded_template_secrets:
-                key = user_vault_key(persisted_object_store, recorded_secret, self._app_config)
-                log.info(f"deleting {key} from user vault")
-                user_vault.delete_secret(key)
-                secrets_to_delete.append(recorded_secret)
-
-        for secret_to_delete in secrets_to_delete:
-            recorded_secrets.remove(secret_to_delete)
-
-        persisted_object_store.template_secrets = recorded_secrets
+        upgrade_secrets(trans, persisted_object_store, template, payload, self._app_config)
         self._save(persisted_object_store)
-        rval = self._to_model(trans, persisted_object_store)
-        return rval
+        return self._to_model(trans, persisted_object_store)
 
     def _update_instance(
         self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstancePayload
     ) -> UserConcreteObjectStoreModel:
-        # TODO: validate variables
-        # TODO: test case for access control
-        # TODO: test case for nulling update fields...
         persisted_object_store = self._get(trans, id)
-        if payload.name is not None:
-            persisted_object_store.name = payload.name
-        if payload.description is not None:
-            persisted_object_store.description = payload.description
-        if payload.variables is not None:
-            # maybe just record the valid variables according to template like in upgrade
-            persisted_object_store.template_variables = payload.variables
-        self._save(persisted_object_store)
+        template = self._get_template(persisted_object_store)
+        update_template_instance(self._sa_session, persisted_object_store, payload, template)
         return self._to_model(trans, persisted_object_store)
 
     def _update_instance_secret(
         self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstanceSecretPayload
     ) -> UserConcreteObjectStoreModel:
         persisted_object_store = self._get(trans, id)
-        user_vault = trans.user_vault
-        key = user_vault_key(persisted_object_store, payload.secret_name, self._app_config)
-        user_vault.write_secret(key, payload.secret_value)
+        template = self._get_template(persisted_object_store)
+        update_instance_secret(trans, persisted_object_store, template, payload, self._app_config)
         return self._to_model(trans, persisted_object_store)
 
     def create_instance(
@@ -238,7 +179,7 @@ class ObjectStoreInstancesManager:
         recorded_secrets = []
         try:
             for secret, value in payload.secrets.items():
-                key = user_vault_key(persisted_object_store, secret, self._app_config)
+                key = persisted_object_store.vault_key(secret, self._app_config)
                 user_vault.write_secret(key, value)
                 recorded_secrets.append(secret)
         except Exception:
@@ -257,9 +198,7 @@ class ObjectStoreInstancesManager:
         return self._to_model(trans, user_object_store)
 
     def _save(self, persisted_object_store: UserObjectStore) -> None:
-        self._sa_session.add(persisted_object_store)
-        self._sa_session.flush([persisted_object_store])
-        self._sa_session.commit()
+        save_template_instance(self._sa_session, persisted_object_store)
 
     def _get(self, trans: ProvidesUserContext, id: Union[str, int]) -> UserObjectStore:
         filter = self._index_filter(id)
@@ -271,7 +210,7 @@ class ObjectStoreInstancesManager:
         return user_object_store
 
     def _index_filter(self, id: Union[str, int]):
-        index_by = self._app_config.user_object_store_index_by
+        index_by = self._app_config.user_config_templates_index_by
         index_filter: Any
         if index_by == "id":
             id_as_int = int(id)
@@ -281,6 +220,14 @@ class ObjectStoreInstancesManager:
             index_filter = UserObjectStore.__table__.c.uuid == id_as_str
         return index_filter
 
+    def _get_template(
+        self, persisted_object_store: UserObjectStore, template_version: Optional[int] = None
+    ) -> ObjectStoreTemplate:
+        catalog = self._catalog
+        target_template_version = template_version or persisted_object_store.template_version
+        template = catalog.find_template_by(persisted_object_store.template_id, target_template_version)
+        return template
+
     def _to_model(self, trans, persisted_object_store: UserObjectStore) -> UserConcreteObjectStoreModel:
         quota = QuotaModel(source=None, enabled=False)
         object_store_type = persisted_object_store.template.configuration.type
@@ -292,11 +239,10 @@ class ObjectStoreInstancesManager:
             True,
             object_store_type in ["azure_blob", "s3"],
         )
-        # These shouldn't be null but sometimes can be?
         secrets = persisted_object_store.template_secrets or []
         uos_id: str
         response_id: Union[int, str]
-        if self._app_config.user_object_store_index_by == "id":
+        if self._app_config.user_config_templates_index_by == "id":
             uos_id = str(persisted_object_store.id)
             response_id = persisted_object_store.id
         else:
@@ -318,49 +264,28 @@ class ObjectStoreInstancesManager:
             private=True,
             quota=quota,
             badges=badges,
+            hidden=persisted_object_store.hidden,
+            active=persisted_object_store.active,
+            purged=persisted_object_store.purged,
         )
 
 
-def user_vault_key(user_object_store: UserObjectStore, secret: str, app_config: UserObjectStoresAppConfig) -> str:
-    if app_config.user_object_store_index_by == "id":
-        uos_id = str(user_object_store.id)
-    else:
-        uos_id = str(user_object_store.uuid)
-    assert uos_id
-    user_vault_id_prefix = f"object_store_config/{uos_id}"
-    key = f"{user_vault_id_prefix}/{secret}"
-    return key
-
-
-def recover_secrets(
-    user_object_store: UserObjectStore, vault: Vault, app_config: UserObjectStoresAppConfig
-) -> Dict[str, str]:
-    user: User = user_object_store.user
-    user_vault = UserVaultWrapper(vault, user)
-    secrets: Dict[str, str] = {}
-    # now we could recover the list of secrets to fetch from...
-    # ones recorded as written in the persisted object, the ones
-    # expected in the catalog, or the ones expected in the definition
-    # persisted.
-    persisted_secret_names = user_object_store.template_secrets or []
-    for secret in persisted_secret_names:
-        vault_key = user_vault_key(user_object_store, secret, app_config)
-        secret_value = user_vault.read_secret(vault_key)
-        # assert secret_value
-        if secret_value is not None:
-            secrets[secret] = secret_value
-    return secrets
-
-
 class UserObjectStoreResolverImpl(BaseUserObjectStoreResolver):
-    def __init__(self, sa_session: galaxy_scoped_session, vault: Vault, app_config: UserObjectStoresAppConfig):
+    def __init__(
+        self,
+        sa_session: galaxy_scoped_session,
+        vault: Vault,
+        app_config: UserObjectStoresAppConfig,
+        catalog: ConfiguredObjectStoreTemplates,
+    ):
         self._sa_session = sa_session
         self._vault = vault
         self._app_config = app_config
+        self._catalog = catalog
 
     def resolve_object_store_uri_config(self, uri: str) -> ObjectStoreConfiguration:
         user_object_store_id = uri.split("://", 1)[1]
-        index_by = self._app_config.user_object_store_index_by
+        index_by = self._app_config.user_config_templates_index_by
         index_filter: Any
         if index_by == "id":
             index_filter = UserObjectStore.__table__.c.id == user_object_store_id
@@ -368,5 +293,25 @@ class UserObjectStoreResolverImpl(BaseUserObjectStoreResolver):
             index_filter = UserObjectStore.__table__.c.uuid == user_object_store_id
         user_object_store: UserObjectStore = self._sa_session.query(UserObjectStore).filter(index_filter).one()
         secrets = recover_secrets(user_object_store, self._vault, self._app_config)
-        object_store_configuration = user_object_store.object_store_configuration(secrets=secrets)
+        environment = prepare_environment(user_object_store, self._vault, self._app_config)
+        templates = sort_templates(
+            self._app_config,
+            self._catalog.catalog.root,
+            user_object_store,
+        )
+        object_store_configuration = user_object_store.object_store_configuration(
+            secrets=secrets, environment=environment, templates=templates
+        )
         return object_store_configuration
+
+
+__all__ = (
+    "CreateInstancePayload",
+    "ModifyInstancePayload",
+    "UpdateInstancePayload",
+    "UpdateInstanceSecretPayload",
+    "UpgradeInstancePayload",
+    "UserObjectStoreResolverImpl",
+    "UserConcreteObjectStoreModel",
+    "ObjectStoreInstancesManager",
+)
diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py
index cfbc4922e12..3cfb1f89e6f 100644
--- a/lib/galaxy/model/__init__.py
+++ b/lib/galaxy/model/__init__.py
@@ -30,6 +30,7 @@ from typing import (
     Any,
     cast,
     Dict,
+    Generic,
     Iterable,
     List,
     NamedTuple,
@@ -39,6 +40,7 @@ from typing import (
     Tuple,
     Type,
     TYPE_CHECKING,
+    TypeVar,
     Union,
 )
 from uuid import (
@@ -133,6 +135,11 @@ import galaxy.model.metadata
 import galaxy.model.tags
 import galaxy.security.passwords
 import galaxy.util
+from galaxy.files.templates import (
+    FileSourceConfiguration,
+    FileSourceTemplate,
+    template_to_configuration as file_source_template_to_configuration,
+)
 from galaxy.model.base import (
     ensure_object_added_to_session,
     transaction,
@@ -156,7 +163,7 @@ from galaxy.objectstore import ObjectStorePopulator
 from galaxy.objectstore.templates import (
     ObjectStoreConfiguration,
     ObjectStoreTemplate,
-    template_to_configuration,
+    template_to_configuration as object_store_template_to_configuration,
 )
 from galaxy.schema.invocation import (
     InvocationCancellationUserRequest,
@@ -183,6 +190,12 @@ from galaxy.util import (
     unicodify,
     unique_id,
 )
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    SecretsDict,
+    Template as ConfigTemplate,
+    TemplateEnvironment,
+)
 from galaxy.util.dictifiable import (
     dict_for,
     Dictifiable,
@@ -214,10 +227,27 @@ _datatypes_registry = None
 
 STR_TO_STR_DICT = Dict[str, str]
 
-OBJECT_STORE_TEMPLATE_CONFIGURATION_VALUE_TYPE = Union[str, bool, int]
-OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = Dict[str, OBJECT_STORE_TEMPLATE_CONFIGURATION_VALUE_TYPE]
-OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE = List[str]
-OBJECT_STORE_TEMPLATE_DEFINITION_TYPE = Dict[str, Any]
+
+class ConfigurationTemplateEnvironmentSecret(TypedDict):
+    name: str
+    type: Literal["secret"]
+    vault_key: str
+
+
+class ConfigurationTemplateEnvironmentVariable(TypedDict):
+    name: str
+    type: Literal["variable"]
+    variable: str
+
+
+CONFIGURATION_TEMPLATE_ENVIRONMENT_ENTRY = Union[
+    ConfigurationTemplateEnvironmentSecret, ConfigurationTemplateEnvironmentVariable
+]
+CONFIGURATION_TEMPLATE_ENVIRONMENT = List[CONFIGURATION_TEMPLATE_ENVIRONMENT_ENTRY]
+CONFIGURATION_TEMPLATE_CONFIGURATION_VALUE_TYPE = Union[str, bool, int]
+CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = Dict[str, CONFIGURATION_TEMPLATE_CONFIGURATION_VALUE_TYPE]
+CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE = List[str]
+CONFIGURATION_TEMPLATE_DEFINITION_TYPE = Dict[str, Any]
 
 
 class TransformAction(TypedDict):
@@ -230,9 +260,10 @@ mapper_registry = registry(
     type_annotation_map={
         Optional[STR_TO_STR_DICT]: JSONType,
         Optional[TRANSFORM_ACTIONS]: MutableJSONType,
-        Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]: JSONType,
-        Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]: JSONType,
-        Optional[OBJECT_STORE_TEMPLATE_DEFINITION_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_ENVIRONMENT]: JSONType,
     },
 )
 
@@ -778,6 +809,7 @@ class User(Base, Dictifiable, RepresentById):
         back_populates="user", order_by=lambda: desc(GalaxySession.update_time), cascade_backrefs=False
     )
     object_stores: Mapped[List["UserObjectStore"]] = relationship(back_populates="user")
+    file_sources: Mapped[List["UserFileSource"]] = relationship(back_populates="user")
     quotas: Mapped[List["UserQuotaAssociation"]] = relationship(back_populates="user")
     quota_source_usages: Mapped[List["UserQuotaSourceUsage"]] = relationship(back_populates="user")
     social_auth: Mapped[List["UserAuthnzToken"]] = relationship(back_populates="user")
@@ -10925,8 +10957,66 @@ class UserPreference(Base, RepresentById):
         self.value = value
 
 
-class UserObjectStore(Base, RepresentById):
+class UsesTemplatesAppConfig(Protocol):
+    user_config_templates_index_by: Literal["uuid", "id"]
+
+
+class HasConfigSecrets(RepresentById):
+    secret_config_type: str
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]]
+    uuid: Mapped[Union[UUID, str]]
+    user: Mapped["User"]
+
+    def vault_id_prefix(self, app_config: UsesTemplatesAppConfig) -> str:
+        if app_config.user_config_templates_index_by == "id":
+            id_str = str(self.id)
+        else:
+            id_str = str(self.uuid)
+        user_vault_id_prefix = f"{self.secret_config_type}/{id_str}"
+        return user_vault_id_prefix
+
+    def vault_key(self, secret: str, app_config: UsesTemplatesAppConfig) -> str:
+        user_vault_id_prefix = self.vault_id_prefix(app_config)
+        key = f"{user_vault_id_prefix}/{secret}"
+        return key
+
+
+class HasConfigEnvironment(RepresentById):
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]]
+
+    @property
+    def template_environment(self) -> TemplateEnvironment:
+        definition = self.template_definition
+        if not definition:
+            return TemplateEnvironment.model_validate([])
+        environment = definition.get("environment")
+        if not environment:
+            return TemplateEnvironment.model_validate([])
+        else:
+            return TemplateEnvironment.model_validate(environment)
+
+
+T = TypeVar("T", bound=ConfigTemplate, covariant=True)
+
+
+class HasConfigTemplate(HasConfigSecrets, HasConfigEnvironment, RepresentById, Generic[T]):
+    name: Mapped[str]
+    description: Mapped[Optional[str]]
+    template_id: Mapped[str]
+    template_version: Mapped[int]
+    template_variables: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]]
+    hidden: Mapped[bool]
+    active: Mapped[bool]
+    purged: Mapped[bool]
+
+    @property
+    def template(self) -> T:
+        raise NotImplementedError()
+
+
+class UserObjectStore(Base, HasConfigTemplate):
     __tablename__ = "user_object_store"
+    secret_config_type = "object_store_config"
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
     user_id: Mapped[Optional[int]] = mapped_column(Integer, ForeignKey("galaxy_user.id"), index=True)
@@ -10937,6 +11027,12 @@ class UserObjectStore(Base, RepresentById):
     name: Mapped[str] = mapped_column(String(255), index=True)
     # user specified description of the instance they've created
     description: Mapped[Optional[str]] = mapped_column(Text)
+    # active but doesn't appear in user selection
+    hidden: Mapped[bool] = mapped_column(default=False)
+    # set to False to deactive the source
+    active: Mapped[bool] = mapped_column(default=True)
+    # a purged file source cannot be re-activated because secrets have been purged
+    purged: Mapped[bool] = mapped_column(default=False)
     # the template store id
     template_id: Mapped[str] = mapped_column(String(255), index=True)
     # the template store version (0, 1, ...)
@@ -10946,33 +11042,122 @@ class UserObjectStore(Base, RepresentById):
     # the id/version and not record the definition... as the templates change
     # over time this choice has some big consequences despite being easy to swap
     # implementations.
-    template_definition: Mapped[Optional[OBJECT_STORE_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
     # Big JSON blob of the variable name -> value mapping defined for the store's
     # variables by the user.
-    template_variables: Mapped[Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
+    template_variables: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
     # Track a list of secrets that were defined for this object store at creation
-    template_secrets: Mapped[Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
 
-    user = relationship("User", back_populates="object_stores")
+    user: Mapped["User"] = relationship("User", back_populates="object_stores")
 
     @property
     def template(self) -> ObjectStoreTemplate:
         return ObjectStoreTemplate(**self.template_definition or {})
 
-    def object_store_configuration(self, secrets: Dict[str, Any]) -> ObjectStoreConfiguration:
+    def object_store_configuration(
+        self, secrets: SecretsDict, environment: EnvironmentDict, templates: Optional[List[ObjectStoreTemplate]] = None
+    ) -> ObjectStoreConfiguration:
+        if templates is None:
+            templates = [self.template]
         user = self.user
         user_details = {
             "username": user.username,
             "email": user.email,
             "id": user.id,
         }
-        variables: OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
-        return template_to_configuration(
-            self.template,
-            variables=variables,
-            secrets=secrets,
-            user_details=user_details,
-        )
+        variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
+        first_exception = None
+        for template in templates:
+            try:
+                return object_store_template_to_configuration(
+                    template,
+                    variables=variables,
+                    secrets=secrets,
+                    user_details=user_details,
+                    environment=environment,
+                )
+            except Exception as e:
+                if first_exception is None:
+                    first_exception = e
+                continue
+        if first_exception:
+            raise first_exception
+
+        raise ValueError("No template sent to object_store_configuration")
+
+
+class UserFileSource(Base, HasConfigTemplate):
+    __tablename__ = "user_file_source"
+    secret_config_type = "file_source_config"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    user_id: Mapped[Optional[int]] = mapped_column(ForeignKey("galaxy_user.id"), index=True)
+    uuid: Mapped[Union[UUID, str]] = mapped_column(UUIDType(), index=True)
+    create_time: Mapped[datetime] = mapped_column(default=now)
+    update_time: Mapped[datetime] = mapped_column(default=now, onupdate=now, index=True)
+    # user specified name of the instance they've created
+    name: Mapped[str] = mapped_column(String(255), index=True)
+    # user specified description of the instance they've created
+    description: Mapped[Optional[str]] = mapped_column(Text)
+    # active but doesn't appear in user selection
+    hidden: Mapped[bool] = mapped_column(default=False)
+    # set to False to deactive the source
+    active: Mapped[bool] = mapped_column(default=True)
+    # a purged file source cannot be re-activated because secrets have been purged
+    purged: Mapped[bool] = mapped_column(default=False)
+    # the template store id
+    template_id: Mapped[str] = mapped_column(String(255), index=True)
+    # the template store version (0, 1, ...)
+    template_version: Mapped[int] = mapped_column(index=True)
+    # Full template from file_sources_templates.yml catalog.
+    # For tools we just store references, so here we could easily just use
+    # the id/version and not record the definition... as the templates change
+    # over time this choice has some big consequences despite being easy to swap
+    # implementations.
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
+    # Big JSON blob of the variable name -> value mapping defined for the store's
+    # variables by the user.
+    template_variables: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
+    # Track a list of secrets that were defined for this object store at creation
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
+
+    user: Mapped["User"] = relationship("User", back_populates="file_sources")
+
+    @property
+    def template(self) -> FileSourceTemplate:
+        return FileSourceTemplate(**self.template_definition or {})
+
+    def file_source_configuration(
+        self, secrets: SecretsDict, environment: EnvironmentDict, templates: Optional[List[FileSourceTemplate]] = None
+    ) -> FileSourceConfiguration:
+        if templates is None:
+            templates = [self.template]
+        user = self.user
+        user_details = {
+            "username": user.username,
+            "email": user.email,
+            "id": user.id,
+        }
+        variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
+        first_exception = None
+        for template in templates:
+            try:
+                return file_source_template_to_configuration(
+                    template,
+                    variables=variables,
+                    secrets=secrets,
+                    user_details=user_details,
+                    environment=environment,
+                )
+            except Exception as e:
+                if first_exception is None:
+                    first_exception = e
+                continue
+        if first_exception:
+            raise first_exception
+
+        raise ValueError("No template sent to file_source_configuration")
 
 
 class UserAction(Base, RepresentById):
diff --git a/lib/galaxy/objectstore/__init__.py b/lib/galaxy/objectstore/__init__.py
index 81dc6321a24..1de54e8c829 100644
--- a/lib/galaxy/objectstore/__init__.py
+++ b/lib/galaxy/objectstore/__init__.py
@@ -1352,7 +1352,7 @@ class DistributedObjectStore(NestedObjectStore):
             if not user:
                 return "Supplied object store id is not accessible"
             rest_of_uri = object_store_id.split("://", 1)[1]
-            index_by = self.config.user_object_store_index_by
+            index_by = self.config.user_config_templates_index_by
             if index_by == "id":
                 user_object_store_id = int(rest_of_uri)
                 for user_object_store in user.object_stores:
@@ -1631,10 +1631,12 @@ def build_object_store_from_config(
 class UserObjectStoresAppConfig(BaseModel):
     object_store_cache_path: str
     object_store_cache_size: int
-    user_object_store_index_by: Literal["uuid", "id"]
+    user_config_templates_index_by: Literal["uuid", "id"]
+    user_config_templates_use_saved_configuration: Literal["fallback", "preferred", "never"]
     jobs_directory: str
     new_file_path: str
     umask: int
+    gid: int
 
 
 # TODO: this will need app details...
@@ -1656,6 +1658,7 @@ def concrete_object_store(
         jobs_directory = app_config.jobs_directory
         new_file_path = app_config.new_file_path
         umask = app_config.umask
+        gid = app_config.gid
         object_store_cache_size = app_config.object_store_cache_size
         object_store_cache_path = app_config.object_store_cache_path
 
diff --git a/lib/galaxy/objectstore/azure_blob.py b/lib/galaxy/objectstore/azure_blob.py
index 21312c51961..fc739df7fc8 100644
--- a/lib/galaxy/objectstore/azure_blob.py
+++ b/lib/galaxy/objectstore/azure_blob.py
@@ -78,7 +78,7 @@ def parse_config_xml(config_xml):
         if account_url:
             auth["account_url"] = account_url
 
-        return {
+        config_dict = {
             "auth": auth,
             "container": {
                 "name": container_name,
@@ -88,6 +88,12 @@ def parse_config_xml(config_xml):
             "extra_dirs": extra_dirs,
             "private": CachingConcreteObjectStore.parse_private_from_config_xml(config_xml),
         }
+        name = config_xml.attrib.get("name", None)
+        if name is not None:
+            config_dict["name"] = name
+        device = config_xml.attrib.get("device", None)
+        config_dict["device"] = device
+        return config_dict
     except Exception:
         # Toss it back up after logging, we can't continue loading at this point.
         log.exception("Malformed ObjectStore Configuration XML -- unable to continue")
diff --git a/lib/galaxy/objectstore/s3.py b/lib/galaxy/objectstore/s3.py
index 293f6260ef3..73e9a3cfd41 100644
--- a/lib/galaxy/objectstore/s3.py
+++ b/lib/galaxy/objectstore/s3.py
@@ -83,7 +83,7 @@ def parse_config_xml(config_xml):
             raise Exception(msg)
         extra_dirs = [{k: e.get(k) for k in attrs} for e in extra_dirs]
 
-        return {
+        config_dict = {
             "auth": {
                 "access_key": access_key,
                 "secret_key": secret_key,
@@ -105,6 +105,12 @@ def parse_config_xml(config_xml):
             "extra_dirs": extra_dirs,
             "private": CachingConcreteObjectStore.parse_private_from_config_xml(config_xml),
         }
+        name = config_xml.attrib.get("name", None)
+        if name is not None:
+            config_dict["name"] = name
+        device = config_xml.attrib.get("device", None)
+        config_dict["device"] = device
+        return config_dict
     except Exception:
         # Toss it back up after logging, we can't continue loading at this point.
         log.exception("Malformed ObjectStore Configuration XML -- unable to continue")
@@ -241,12 +247,14 @@ class S3ObjectStore(CachingConcreteObjectStore, CloudConfigMixin, UsesAxel):
     def _get_bucket(self, bucket_name):
         """Sometimes a handle to a bucket is not established right away so try
         it a few times. Raise error is connection is not established."""
+        last_error = None
         for i in range(5):
             try:
                 bucket = self.conn.get_bucket(bucket_name)
                 log.debug("Using cloud object store with bucket '%s'", bucket.name)
                 return bucket
-            except S3ResponseError:
+            except S3ResponseError as e:
+                last_error = e
                 try:
                     log.debug("Bucket not found, creating s3 bucket with handle '%s'", bucket_name)
                     self.conn.create_bucket(bucket_name)
@@ -255,7 +263,10 @@ class S3ObjectStore(CachingConcreteObjectStore, CloudConfigMixin, UsesAxel):
                     time.sleep(2)
         # All the attempts have been exhausted and connection was not established,
         # raise error
-        raise S3ResponseError
+        if last_error:
+            raise last_error
+        else:
+            raise Exception("Failed to connect to target object store.")
 
     def _get_transfer_progress(self):
         return self.transfer_progress
diff --git a/lib/galaxy/objectstore/templates/examples/__init__.py b/lib/galaxy/objectstore/templates/examples/__init__.py
new file mode 100644
index 00000000000..2bcbd0645c7
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/__init__.py
@@ -0,0 +1,5 @@
+from galaxy.util.resources import resource_string
+
+
+def get_example(filename) -> str:
+    return resource_string("galaxy.objectstore.templates.examples", filename)
diff --git a/lib/galaxy/objectstore/templates/examples/azure_just_container.yml b/lib/galaxy/objectstore/templates/examples/azure_just_container.yml
new file mode 100644
index 00000000000..a47bd3e0747
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/azure_just_container.yml
@@ -0,0 +1,22 @@
+- id: lab_azure_storage
+  version: 0
+  name: Azure Blob Storage for our Lab
+  description: |
+    This template allows storing dataset in [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure_blob
+    auth:
+      account_name: 'XXXXXXXXfillinaccount'
+      account_key: 'XXXXXXXXXfillinkey'
+
+    container:
+      name: '{{ variables.container_name }}'
+
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container in our lab space. Contact
+        our lab Galaxy admin awesomelabsnate@ourawesomelab.org if you're unsure
+        what container you should store your data in. 
diff --git a/lib/galaxy/objectstore/templates/examples/cloudflare.yml b/lib/galaxy/objectstore/templates/examples/cloudflare.yml
new file mode 100644
index 00000000000..df6732104c1
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/cloudflare.yml
@@ -0,0 +1,46 @@
+# https://developers.cloudflare.com/r2/examples/aws/boto3/
+- id: cloudflare
+  name: CloudFlare R2
+  description: |
+    This template can be used to connect to your [CloudFlare R2](https://developers.cloudflare.com/r2/)
+    storage. To use these templates you will need to generate
+    [CloudFlare R2 access tokens](https://developers.cloudflare.com/r2/api/s3/tokens/).
+    Following that tutorial, you should have an "Account ID", and "Access Key ID", and a
+    "Secret Access Key".
+
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        An Access Key ID generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+    account_id:
+      label: Account ID
+      type: string
+      help: |
+        Your account ID as available in the [CloudFlare dashboard](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/).
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The name of a bucket you've created to store your Galaxy data. Documentation for how to create buckets
+        can be found in [this part of the CloudFlare R2 documentation](https://developers.cloudflare.com/r2/buckets/create-buckets/).
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        A Secret Access Key generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+  configuration:
+    type: boto3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      endpoint_url: 'https://{{ variables.account_id}}.r2.cloudflarestorage.com/'
diff --git a/lib/galaxy/objectstore/templates/examples/cloudflare_legacy.yml b/lib/galaxy/objectstore/templates/examples/cloudflare_legacy.yml
new file mode 100644
index 00000000000..df143e20a1f
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/cloudflare_legacy.yml
@@ -0,0 +1,48 @@
+# https://developers.cloudflare.com/r2/examples/aws/boto3/
+- id: cloudflare_legacy
+  name: CloudFlare R2
+  description: |
+    This template can be used to connect to your [CloudFlare R2](https://developers.cloudflare.com/r2/)
+    storage. To use these templates you will need to generate
+    [CloudFlare R2 access tokens](https://developers.cloudflare.com/r2/api/s3/tokens/).
+    Following that tutorial, you should have an "Account ID", and "Access Key ID", and a
+    "Secret Access Key".
+
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        An Access Key ID generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+    account_id:
+      label: Account ID
+      type: string
+      help: |
+        Your account ID as available in the [CloudFlare dashboard](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/).
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The name of a bucket you've created to store your Galaxy data. Documentation for how to create buckets
+        can be found in [this part of the CloudFlare R2 documentation](https://developers.cloudflare.com/r2/buckets/create-buckets/).
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        A Secret Access Key generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: '{{ variables.account_id}}.r2.cloudflarestorage.com'
+      port: 443
+      is_secure: true
diff --git a/lib/galaxy/objectstore/templates/examples/minio_example.yml b/lib/galaxy/objectstore/templates/examples/minio_example.yml
new file mode 100644
index 00000000000..2694b4f8ed3
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/minio_example.yml
@@ -0,0 +1,47 @@
+- id: minio
+  name: Institutional S3 Storage
+  description: Connect to our institutional MinIO storage service.
+  variables:
+    access_key:
+      type: string
+      help: A description of the user account used to connect to your storage.
+    bucket:
+      type: string
+      help: The bucket to connect to.
+  secrets:
+    secret_key:
+      help: The secret key used to connect to MinIO with for the given access key.
+  environment:
+    host:
+      type: variable
+      variable: GALAXY_MINIO_HOST
+      default: localhost
+    port:
+      type: variable
+      variable: GALAXY_MINIO_PORT
+      default: "9000"
+    secure:
+      type: variable
+      variable: GALAXY_MINIO_IS_SECURE
+      default: "true"
+    connection_path:
+      type: variable
+      variable: GALAXY_MINIO_CONNECTION_PATH
+      default: ""
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+      use_reduced_redundancy: false
+    connection:
+      host: '{{ environment.host }}'
+      port: '{{ environment.port | int  }}'
+      is_secure: '{{ environment.secure | asbool }}'
+      conn_path: '{{ environment.connection_path }}'
+    badges:
+    - type: slower
+    - type: less_secure
+    - type: less_stable
diff --git a/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml b/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
new file mode 100644
index 00000000000..0996e45f7d3
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
@@ -0,0 +1,20 @@
+- id: lab_minio_storage
+  name: Lab Storage
+  description: Connect to our lab's local MinIO storage service.
+  variables:
+    bucket:
+      type: string
+      help: The bucket to connect to.
+  configuration:
+    type: boto3
+    auth:
+      access_key: 'XXXXXXXXfillinaccess'
+      secret_key: 'YYYYYYYYfillinsecret'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      endpoint_url: 'https://storage.ourawesomelab.org:9000'
+    badges:
+    - type: slower
+    - type: less_secure
+    - type: less_stable
diff --git a/lib/galaxy/objectstore/templates/examples/minio_just_buckets_legacy.yml b/lib/galaxy/objectstore/templates/examples/minio_just_buckets_legacy.yml
new file mode 100644
index 00000000000..b91f196e405
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/minio_just_buckets_legacy.yml
@@ -0,0 +1,22 @@
+- id: lab_minio_storage_legacy
+  name: Lab Storage (Legacy)
+  description: Connect to our lab's local MinIO storage service.
+  variables:
+    bucket:
+      type: string
+      help: The bucket to connect to.
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: 'XXXXXXXXfillinaccess'
+      secret_key: 'YYYYYYYYfillinsecret'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: 'storage.ourawesomelab.org'
+      port: 9000
+      is_secure: true
+    badges:
+    - type: slower
+    - type: less_secure
+    - type: less_stable
diff --git a/lib/galaxy/objectstore/templates/examples/production_aws_s3.yml b/lib/galaxy/objectstore/templates/examples/production_aws_s3.yml
new file mode 100644
index 00000000000..77eabc10cc1
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_aws_s3.yml
@@ -0,0 +1,35 @@
+- id: aws_s3
+  name: Amazon Web Services S3 Storage
+  description: |
+    Amazon's Simple Storage Service (S3) is Amazon's primary cloud storage service.
+    More information on S3 can be found in [Amazon's documentation](https://aws.amazon.com/s3/).
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        A security credential for interacting with AWS services can be created from your
+        AWS web console. Creating an "Access Key" creates a pair of keys used to identify
+        and authenticate access to your AWS account - the first part of the pair  is 
+        "Access Key ID" and should be entered here. The second part of your key is the secret
+        part called the "Secret Access Key". Place that in the secure part of this form below.
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [AWS S3 Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. You will need to create a bucket to use in your AWS web console before
+        using this form.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        See the documentation above used "Access Key ID" for information about access key pairs.
+
+  configuration:
+    type: boto3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
diff --git a/lib/galaxy/objectstore/templates/examples/production_aws_s3_legacy.yml b/lib/galaxy/objectstore/templates/examples/production_aws_s3_legacy.yml
new file mode 100644
index 00000000000..1bc8f66cf43
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_aws_s3_legacy.yml
@@ -0,0 +1,35 @@
+- id: aws_s3_legacy
+  name: Amazon Web Services S3 Storage (Legacy)
+  description: |
+    Amazon's Simple Storage Service (S3) is Amazon's primary cloud storage service.
+    More information on S3 can be found in [Amazon's documentation](https://aws.amazon.com/s3/).
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        A security credential for interacting with AWS services can be created from your
+        AWS web console. Creating an "Access Key" creates a pair of keys used to identify
+        and authenticate access to your AWS account - the first part of the pair  is 
+        "Access Key ID" and should be entered here. The second part of your key is the secret
+        part called the "Secret Access Key". Place that in the secure part of this form below.
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [AWS S3 Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. You will need to create a bucket to use in your AWS web console before
+        using this form.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        See the documentation above used "Access Key ID" for information about access key pairs.
+
+  configuration:
+    type: aws_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
diff --git a/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml b/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
new file mode 100644
index 00000000000..f7afbe7ed52
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
@@ -0,0 +1,34 @@
+- id: azure
+  version: 0
+  name: Azure Blob Storage
+  description: |
+    This template allows storing dataset in [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure_blob
+    auth:
+      account_name: '{{ variables.account_name }}'
+      account_key: '{{ secrets.account_key}}'
+
+    container:
+      name: '{{ variables.container_name }}'
+
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container. More information on containers can be found
+        in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction#containers).
+    account_name:
+      label: Storage Account Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage account. More information on containers can be found in the
+        [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview).
+
+  secrets:
+    account_key:
+      label: Account Key
+      help: |
+        The Azure Blob Storage account key to use to access your Azure Blob Storage data. More information
+        on account keys can be found in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage).
diff --git a/lib/galaxy/objectstore/templates/examples/production_gcp_s3.yml b/lib/galaxy/objectstore/templates/examples/production_gcp_s3.yml
new file mode 100644
index 00000000000..da7622fc01d
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_gcp_s3.yml
@@ -0,0 +1,42 @@
+# https://cloud.google.com/storage/docs/aws-simple-migration
+- id: gcp_s3_interop
+  name: Google Cloud Storage
+  description: |
+    This template can be used to connect to your [Google Cloud Storage](https://cloud.google.com/storage).
+    To use these templates you will need to generate
+    [HMAC Keys](https://cloud.google.com/storage/docs/authentication/hmackeys) - these
+    can be linked to your user or a service account. Additionally, you will need to defined
+    a [default Google cloud project](https://cloud.google.com/storage/docs/aws-simple-migration#defaultproj)
+    to allow Galaxy to access your Google Cloud Storage via the interfaces
+    described by this template.
+  variables:
+    access_key:
+      label: Access ID
+      type: string
+      help: |
+        This will be given to you by Google when you generate [HMAC Keys](https://cloud.google.com/storage/docs/authentication/hmackeys)
+        to use your storage.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The name of a [bucket](https://cloud.google.com/storage/docs/buckets) you've created to store your Galaxy data. Documentation for how to create buckets
+        can be found in [this part of the Google Cloud Storage documentation](https://cloud.google.com/storage/docs/creating-buckets).
+  secrets:
+    secret_key:
+      label: Secret Key
+      help: |
+        This will be given to you by Google when you generate [HMAC Keys](https://cloud.google.com/storage/docs/authentication/hmackeys)
+        to use your storage. It should be 40 characters long and look something like the example used
+        the Google documentation - `bGoa+V7g/yqDXvKRqq+JTFn4uQZbPiQJo4pf9RzJ`.
+
+  configuration:
+    type: boto3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      endpoint_url: 'https://storage.googleapis.com/'
diff --git a/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml b/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
new file mode 100644
index 00000000000..4d8bdefdc24
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
@@ -0,0 +1,61 @@
+- id: generic_s3
+  name: Any S3 Compatible Storage
+  description: |
+    The APIs used to connect to Amazon's S3 (Simple Storage Service) have become something
+    of an unofficial standard for cloud storage across a variety of vendors and services.
+    Many vendors offer storage APIs compatible with S3 - Galaxy calls these ``generic_s3``
+    storage locations. This template configuration allows using such service as a Galaxy storage
+    location as long as you are able to find the connection details and have the relevant credentials.
+
+    Given the amount of information needed to connect to such a service, this is a bit of an
+    advanced template and probably should not be used to connect to a service if a more
+    specific template is available.
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The less secure part of your access tokens or access keys that describe the user
+        that is accessing the data. The [Amazon documentation] calls these an "access key ID",
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_access_key_id``. Internally to Galaxy, we often just call
+        this the ``access_key``.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. How to setup buckets for your storage will vary from service to service
+        but all S3 compatible storage services should have the concept of a bucket to namespace
+        a grouping of your data together with.
+    endpoint_url:
+      label: S3-Compatible API Endpoint
+      type: string
+      help: |
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        For instance, the CloudFlare documentation describes its endpoints as ``https://<accountid>.r2.cloudflarestorage.com``. Here
+        you would substitute your CloudFlare account ID into the endpoint url and use that value.
+        So if your account ID was ``galactian``, you would enter ``galactian.r2.cloudflarestorage.com``.
+        The [MinIO](https://min.io/docs/minio/linux/integrations/aws-cli-with-minio.html)
+        documentation describes the endpoint URL for its Play service as ``https://play.min.io:9000``,
+        this whole value would be entered here.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        The secret key used to connect to the S3 compatible storage with for the given access key.
+
+        The [Amazon documentation] calls these an "secret access key" and
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_secret_access_key``. Internally to Galaxy, we often just call
+        this the ``secret_key``.
+  configuration:
+    type: boto3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      endpoint_url: '{{ variables.endpoint_url }}'
diff --git a/lib/galaxy/objectstore/templates/examples/production_generic_s3_legacy.yml b/lib/galaxy/objectstore/templates/examples/production_generic_s3_legacy.yml
new file mode 100644
index 00000000000..3e325e82746
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_generic_s3_legacy.yml
@@ -0,0 +1,98 @@
+- id: generic_s3_legacy
+  name: Any S3 Compatible Storage (Legacy)
+  description: |
+    The APIs used to connect to Amazon's S3 (Simple Storage Service) have become something
+    of an unofficial standard for cloud storage across a variety of vendors and services.
+    Many vendors offer storage APIs compatible with S3 - Galaxy calls these ``generic_s3``
+    storage locations. This template configuration allows using such service as a Galaxy storage
+    location as long as you are able to find the connection details and have the relevant credentials.
+
+    Given the amount of information needed to connect to such a service, this is a bit of an
+    advanced template and probably should not be used to connect to a service if a more
+    specific template is available.
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The less secure part of your access tokens or access keys that describe the user
+        that is accessing the data. The [Amazon documentation] calls these an "access key ID",
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_access_key_id``. Internally to Galaxy, we often just call
+        this the ``access_key``.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. How to setup buckets for your storage will vary from service to service
+        but all S3 compatible storage services should have the concept of a bucket to namespace
+        a grouping of your data together with.
+    host:
+      label: Connection Host
+      type: string
+      help: |
+        The [hostname](https://en.wikipedia.org/wiki/Hostname) used to connect to the target
+        S3 compatible service.
+        
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. For instance, the CloudFlare documentation
+        describes its endpoints as ``https://<accountid>.r2.cloudflarestorage.com``. Here
+        you would substitute your CloudFlare account ID into the endpoint and shave off the ``https://``,
+        so if your account ID was ``galactian``, you would enter ``galactian.r2.cloudflarestorage.com``.
+
+    port:
+      label: Connection Port
+      type: integer
+      default: 443
+      help: |
+        The [port](https://en.wikipedia.org/wiki/Port_(computer_networking)) used to connect
+        to the target S3 compatible service. This might be ``443`` if you cannot find a relevant
+        port - this is the default for secure HTTP connections.
+
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. The [MinIO](https://min.io/docs/minio/linux/integrations/aws-cli-with-minio.html)
+        documentation describes the endpoint URL for its Play service as ``https://play.min.io:9000``.
+        The ``:9000`` here indicates this port should be specified as ``9000``. Alternatively, the
+        CloudFlare documentation describes its endpoints ``https://<accountid>.r2.cloudflarestorage.com``.
+        Here there is no number at the end of the URL so the port is ``443`` as long the URL starts
+        with ``https``.
+    connection_path:
+      label: Connection Path
+      type: string
+      default: ""
+      help: |
+        This is an advanced configuration option and it is very likely best to just keep this empty
+        for most storage services. If specified, it will be the prefix in the URL for the S3 compatible
+        API after the host and port to reach the target API.
+    secure:
+      label: Use HTTPS?
+      type: boolean
+      default: true
+      help: |
+        This is an advanced configuration option and if this option is not checked, you should not assume
+        your data is secure at all. This should only ever be unchecked during testing new or experimental
+        services with data and keys you do not care about.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        The secret key used to connect to the S3 compatible storage with for the given access key.
+
+        The [Amazon documentation] calls these an "secret access key" and
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_secret_access_key``. Internally to Galaxy, we often just call
+        this the ``secret_key``.
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: '{{ variables.host }}'
+      port: '{{ variables.port  }}'
+      is_secure: '{{ variables.secure }}'
+      conn_path: '{{ variables.connection_path }}'
diff --git a/lib/galaxy/objectstore/templates/examples/simple_example.yml b/lib/galaxy/objectstore/templates/examples/simple_example.yml
new file mode 100644
index 00000000000..6f627c8cf46
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/simple_example.yml
@@ -0,0 +1,15 @@
+- id: project_scratch
+  name: Project Scratch
+  version: 0
+  description: Folder on institutional scratch disk area bound to your user.
+  variables:
+    project_name:
+      type: path_component
+      help: The name of your project scratch.
+  configuration:
+    type: disk
+    files_dir: '/scratch/for_galaxy/{{ user.username | ensure_path_component }}/{{ variables.project_name | ensure_path_component }}'
+    badges:
+    - type: faster
+    - type: less_secure
+    - type: not_backed_up
diff --git a/lib/galaxy/objectstore/templates/examples/testing_multi_version_with_secrets.yml b/lib/galaxy/objectstore/templates/examples/testing_multi_version_with_secrets.yml
new file mode 100644
index 00000000000..fb158d2dda4
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/testing_multi_version_with_secrets.yml
@@ -0,0 +1,43 @@
+# a template with multiple versions that could be coherent for unit/integration
+# testing upgrading object stores templates
+- id: secure_disk
+  version: 0
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/aftersec'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 1
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 2
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/newbar/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
diff --git a/lib/galaxy/objectstore/templates/manager.py b/lib/galaxy/objectstore/templates/manager.py
index 901931b956c..bb5be1c722c 100644
--- a/lib/galaxy/objectstore/templates/manager.py
+++ b/lib/galaxy/objectstore/templates/manager.py
@@ -1,7 +1,5 @@
 import os
 from typing import (
-    Any,
-    Dict,
     List,
     Optional,
 )
@@ -9,35 +7,29 @@ from typing import (
 from typing_extensions import Protocol
 from yaml import safe_load
 
-from galaxy.exceptions import (
-    ObjectNotFound,
-    RequestParameterMissingException,
-)
 from galaxy.objectstore.badges import serialize_badges
+from galaxy.util.config_templates import (
+    apply_syntactic_sugar,
+    find_template,
+    find_template_by,
+    InstanceDefinition,
+    RawTemplateConfig,
+    TemplateReference,
+    validate_secrets_and_variables,
+    verify_vault_configured_if_uses_secrets,
+)
 from .models import (
     ObjectStoreTemplate,
     ObjectStoreTemplateCatalog,
     ObjectStoreTemplateSummaries,
 )
 
-RawTemplateConfig = Dict[str, Any]
-
 
 class AppConfigProtocol(Protocol):
     object_store_templates: Optional[List[RawTemplateConfig]]
     object_store_templates_config_file: Optional[str]
 
 
-class TemplateReference(Protocol):
-    template_id: str
-    template_version: int
-
-
-class InstanceDefinition(TemplateReference, Protocol):
-    variables: Dict[str, Any]
-    secrets: Dict[str, str]
-
-
 SECRETS_NEED_VAULT_MESSAGE = "The object store templates configuration can not be used - a Galaxy vault must be configured for templates that use secrets - please set the vault_config_file configuration option to point at a valid vault configuration."
 
 
@@ -57,19 +49,15 @@ class ConfiguredObjectStoreTemplates:
                     raw_config = safe_load(f)
         if raw_config is None:
             raw_config = []
-        templates = ConfiguredObjectStoreTemplates(raw_config_to_catalog(raw_config))
-        if vault_configured is False and templates.configuration_uses_secrets:
-            raise Exception(SECRETS_NEED_VAULT_MESSAGE)
+        catalog = raw_config_to_catalog(raw_config)
+        verify_vault_configured_if_uses_secrets(
+            catalog,
+            vault_configured,
+            SECRETS_NEED_VAULT_MESSAGE,
+        )
+        templates = ConfiguredObjectStoreTemplates(catalog)
         return templates
 
-    @property
-    def configuration_uses_secrets(self) -> bool:
-        templates = self.catalog.root
-        for template in templates:
-            if template.secrets and len(template.secrets) > 0:
-                return True
-        return False
-
     @property
     def summaries(self) -> ObjectStoreTemplateSummaries:
         templates = self.catalog.root
@@ -77,6 +65,7 @@ class ConfiguredObjectStoreTemplates:
         for template in templates:
             template_dict = template.model_dump()
             configuration = template_dict.pop("configuration")
+            template_dict.pop("environment")
             stored_badges = configuration["badges"] or []
             object_store_type = configuration["type"]
             badges = serialize_badges(stored_badges, False, True, True, object_store_type in ["azure", "s3"])
@@ -87,55 +76,16 @@ class ConfiguredObjectStoreTemplates:
 
     def find_template(self, instance_reference: TemplateReference) -> ObjectStoreTemplate:
         """Find the corresponding template and throw ObjectNotFound if not available."""
-        template_id = instance_reference.template_id
-        template_version = instance_reference.template_version
-        return self.find_template_by(template_id, template_version)
+        return find_template(self.catalog.root, instance_reference, "object store")
 
     def find_template_by(self, template_id: str, template_version: int) -> ObjectStoreTemplate:
-        templates = self.catalog.root
-
-        for template in templates:
-            if template.id == template_id and template.version == template_version:
-                return template
-
-        raise ObjectNotFound(
-            f"Could not find a object store template with id {template_id} and version {template_version}"
-        )
+        return find_template_by(self.catalog.root, template_id, template_version, "object store")
 
     def validate(self, instance: InstanceDefinition):
         template = self.find_template(instance)
-        secrets = instance.secrets
-        for template_secret in template.secrets or []:
-            name = template_secret.name
-            if name not in secrets:
-                raise RequestParameterMissingException(f"Must define secret '{name}'")
-        variables = instance.variables
-        for template_variable in template.variables or []:
-            name = template_variable.name
-            if name not in variables:
-                raise RequestParameterMissingException(f"Must define variable '{name}'")
-        # TODO: validate no extra variables
+        validate_secrets_and_variables(instance, template)
 
 
 def raw_config_to_catalog(raw_config: List[RawTemplateConfig]) -> ObjectStoreTemplateCatalog:
-    effective_root = _apply_syntactic_sugar(raw_config)
+    effective_root = apply_syntactic_sugar(raw_config)
     return ObjectStoreTemplateCatalog.model_validate(effective_root)
-
-
-def _apply_syntactic_sugar(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
-    templates = []
-    for template in raw_templates:
-        _force_key_to_list(template, "variables")
-        _force_key_to_list(template, "secrets")
-        templates.append(template)
-    return templates
-
-
-def _force_key_to_list(template: RawTemplateConfig, key: str) -> None:
-    value = template.get(key, None)
-    if isinstance(value, dict):
-        value_as_list = []
-        for key_name, key_value in value.items():
-            key_value["name"] = key_name
-            value_as_list.append(key_value)
-        template[key] = value_as_list
diff --git a/lib/galaxy/objectstore/templates/models.py b/lib/galaxy/objectstore/templates/models.py
index 9f225786194..2550cef6483 100644
--- a/lib/galaxy/objectstore/templates/models.py
+++ b/lib/galaxy/objectstore/templates/models.py
@@ -7,29 +7,32 @@ from typing import (
     Union,
 )
 
-from boltons.iterutils import remap
-from jinja2.nativetypes import NativeEnvironment
-from pydantic import (
-    BaseModel,
-    ConfigDict,
-    RootModel,
-)
+from pydantic import RootModel
 from typing_extensions import Literal
 
 from galaxy.objectstore.badges import (
     BadgeDict,
     StoredBadgeDict,
 )
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    expand_raw_config,
+    MarkdownContent,
+    populate_default_variables,
+    SecretsDict,
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateExpansion,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableType,
+    TemplateVariableValueType,
+    UserDetailsDict,
+)
 
-
-class StrictModel(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-
-ObjectStoreTemplateVariableType = Literal["string", "boolean", "integer"]
-ObjectStoreTemplateVariableValueType = Union[str, bool, int]
-TemplateExpansion = str
-ObjectStoreTemplateType = Literal["s3", "azure_blob", "disk", "generic_s3"]
+ObjectStoreTemplateVariableType = TemplateVariableType
+ObjectStoreTemplateVariableValueType = TemplateVariableValueType
+ObjectStoreTemplateType = Literal["aws_s3", "azure_blob", "boto3", "disk", "generic_s3"]
 
 
 class S3AuthTemplate(StrictModel):
@@ -55,15 +58,17 @@ class S3Bucket(StrictModel):
 BadgeList = Optional[List[StoredBadgeDict]]
 
 
-class S3ObjectStoreTemplateConfiguration(StrictModel):
-    type: Literal["s3"]
+class AwsS3ObjectStoreTemplateConfiguration(StrictModel):
+    type: Literal["aws_s3"]
     auth: S3AuthTemplate
     bucket: S3BucketTemplate
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
-class S3ObjectStoreConfiguration(StrictModel):
-    type: Literal["s3"]
+class AwsS3ObjectStoreConfiguration(StrictModel):
+    type: Literal["aws_s3"]
     auth: S3Auth
     bucket: S3Bucket
     badges: BadgeList = None
@@ -87,17 +92,131 @@ class AzureContainer(StrictModel):
     name: str
 
 
+class AzureTransferTemplate(StrictModel):
+    max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    download_max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    upload_max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    max_single_put_size: Optional[Union[int, TemplateExpansion]] = None
+    max_single_get_size: Optional[Union[int, TemplateExpansion]] = None
+    max_block_size: Optional[Union[int, TemplateExpansion]] = None
+
+
 class AzureObjectStoreTemplateConfiguration(StrictModel):
     type: Literal["azure_blob"]
     auth: AzureAuthTemplate
     container: AzureContainerTemplate
+    transfer: Optional[AzureTransferTemplate] = None
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class AzureTransfer(StrictModel):
+    max_concurrency: Optional[int] = None
+    download_max_concurrency: Optional[int] = None
+    upload_max_concurrency: Optional[int] = None
+    max_single_put_size: Optional[int] = None
+    max_single_get_size: Optional[int] = None
+    max_block_size: Optional[int] = None
 
 
 class AzureObjectStoreConfiguration(StrictModel):
     type: Literal["azure_blob"]
     auth: AzureAuth
     container: AzureContainer
+    transfer: Optional[AzureTransfer] = None
+    badges: BadgeList = None
+
+
+class Boto3BucketTemplate(StrictModel):
+    name: Union[str, TemplateExpansion]
+
+
+class Boto3ConnectionTemplate(StrictModel):
+    endpoint_url: Union[str, TemplateExpansion]
+    region: Optional[Union[str, TemplateExpansion]] = None
+
+
+class Boto3TransferTemplate(StrictModel):
+    use_threads: Optional[Union[bool, TemplateExpansion]] = None
+    multipart_threshold: Optional[Union[int, TemplateExpansion]] = None
+    max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    multipart_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    num_download_attempts: Optional[Union[int, TemplateExpansion]] = None
+    max_io_queue: Optional[Union[int, TemplateExpansion]] = None
+    io_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    max_bandwidth: Optional[Union[int, TemplateExpansion]] = None
+    download_use_threads: Optional[Union[bool, TemplateExpansion]] = None
+    download_multipart_threshold: Optional[Union[int, TemplateExpansion]] = None
+    download_max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    download_multipart_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    download_num_download_attempts: Optional[Union[int, TemplateExpansion]] = None
+    download_max_io_queue: Optional[Union[int, TemplateExpansion]] = None
+    download_io_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    download_max_bandwidth: Optional[Union[int, TemplateExpansion]] = None
+    upload_use_threads: Optional[Union[bool, TemplateExpansion]] = None
+    upload_multipart_threshold: Optional[Union[int, TemplateExpansion]] = None
+    upload_max_concurrency: Optional[Union[int, TemplateExpansion]] = None
+    upload_multipart_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    upload_num_download_attempts: Optional[Union[int, TemplateExpansion]] = None
+    upload_max_io_queue: Optional[Union[int, TemplateExpansion]] = None
+    upload_io_chunksize: Optional[Union[int, TemplateExpansion]] = None
+    upload_max_bandwidth: Optional[Union[int, TemplateExpansion]] = None
+
+
+class Boto3ObjectStoreTemplateConfiguration(StrictModel):
+    type: Literal["boto3"]
+    auth: S3AuthTemplate
+    bucket: Boto3BucketTemplate
+    connection: Optional[Boto3ConnectionTemplate] = None
+    transfer: Optional[Boto3TransferTemplate] = None
+    badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class Boto3Bucket(StrictModel):
+    name: str
+
+
+class Boto3Connection(StrictModel):
+    endpoint_url: str
+    region: Optional[str] = None
+
+
+class Boto3Transfer(StrictModel):
+    use_threads: Optional[bool] = None
+    multipart_threshold: Optional[int] = None
+    max_concurrency: Optional[int] = None
+    multipart_chunksize: Optional[int] = None
+    num_download_attempts: Optional[int] = None
+    max_io_queue: Optional[int] = None
+    io_chunksize: Optional[int] = None
+    max_bandwidth: Optional[int] = None
+    download_use_threads: Optional[bool] = None
+    download_multipart_threshold: Optional[int] = None
+    download_max_concurrency: Optional[int] = None
+    download_multipart_chunksize: Optional[int] = None
+    download_num_download_attempts: Optional[int] = None
+    download_max_io_queue: Optional[int] = None
+    download_io_chunksize: Optional[int] = None
+    download_max_bandwidth: Optional[int] = None
+    upload_use_threads: Optional[bool] = None
+    upload_multipart_threshold: Optional[int] = None
+    upload_max_concurrency: Optional[int] = None
+    upload_multipart_chunksize: Optional[int] = None
+    upload_num_download_attempts: Optional[int] = None
+    upload_max_io_queue: Optional[int] = None
+    upload_io_chunksize: Optional[int] = None
+    upload_max_bandwidth: Optional[int] = None
+
+
+class Boto3ObjectStoreConfiguration(StrictModel):
+    type: Literal["disk"]
+    auth: S3Auth
+    bucket: Boto3Bucket
+    connection: Optional[Boto3Connection] = None
+    transfer: Optional[Boto3Transfer] = None
     badges: BadgeList = None
 
 
@@ -105,6 +224,8 @@ class DiskObjectStoreTemplateConfiguration(StrictModel):
     type: Literal["disk"]
     files_dir: Union[str, TemplateExpansion]
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
 class DiskObjectStoreConfiguration(StrictModel):
@@ -133,6 +254,8 @@ class GenericS3ObjectStoreTemplateConfiguration(StrictModel):
     bucket: S3BucketTemplate
     connection: S3ConnectionTemplate
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
 class GenericS3ObjectStoreConfiguration(StrictModel):
@@ -144,29 +267,23 @@ class GenericS3ObjectStoreConfiguration(StrictModel):
 
 
 ObjectStoreTemplateConfiguration = Union[
-    S3ObjectStoreTemplateConfiguration,
+    AwsS3ObjectStoreTemplateConfiguration,
+    Boto3ObjectStoreTemplateConfiguration,
     GenericS3ObjectStoreTemplateConfiguration,
     DiskObjectStoreTemplateConfiguration,
     AzureObjectStoreTemplateConfiguration,
 ]
 ObjectStoreConfiguration = Union[
-    S3ObjectStoreConfiguration,
+    AwsS3ObjectStoreConfiguration,
+    Boto3ObjectStoreConfiguration,
     DiskObjectStoreConfiguration,
     AzureObjectStoreConfiguration,
     GenericS3ObjectStoreConfiguration,
 ]
-MarkdownContent = str
 
 
-class ObjectStoreTemplateVariable(StrictModel):
-    name: str
-    help: Optional[MarkdownContent]
-    type: ObjectStoreTemplateVariableType
-
-
-class ObjectStoreTemplateSecret(StrictModel):
-    name: str
-    help: Optional[MarkdownContent]
+ObjectStoreTemplateVariable = TemplateVariable
+ObjectStoreTemplateSecret = TemplateSecret
 
 
 class ObjectStoreTemplateBase(StrictModel):
@@ -188,8 +305,8 @@ class ObjectStoreTemplateBase(StrictModel):
     # template by hiding but keep it in the catalog for backward
     # compatibility for users with existing stores of that template.
     hidden: bool = False
-    variables: Optional[List[ObjectStoreTemplateVariable]] = None
-    secrets: Optional[List[ObjectStoreTemplateSecret]] = None
+    variables: Optional[List[TemplateVariable]] = None
+    secrets: Optional[List[TemplateSecret]] = None
 
 
 class ObjectStoreTemplateSummary(ObjectStoreTemplateBase):
@@ -199,6 +316,7 @@ class ObjectStoreTemplateSummary(ObjectStoreTemplateBase):
 
 class ObjectStoreTemplate(ObjectStoreTemplateBase):
     configuration: ObjectStoreTemplateConfiguration
+    environment: Optional[List[TemplateEnvironmentEntry]] = None
 
 
 ObjectStoreTemplateCatalog = RootModel[List[ObjectStoreTemplate]]
@@ -211,29 +329,19 @@ class ObjectStoreTemplateSummaries(RootModel):
 def template_to_configuration(
     template: ObjectStoreTemplate,
     variables: Dict[str, ObjectStoreTemplateVariableValueType],
-    secrets: Dict[str, str],
-    user_details: Dict[str, Any],
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
 ) -> ObjectStoreConfiguration:
     configuration_template = template.configuration
-    template_variables = {
-        "variables": variables,
-        "secrets": secrets,
-        "user": user_details,
-    }
-
-    def expand_template(_, key, value):
-        if isinstance(value, str) and "{{" in value and "}}" in value:
-            # NativeEnvironment preserves Python types
-            template = NativeEnvironment().from_string(value)
-            return key, template.render(**template_variables)
-        return key, value
-
-    raw_config = remap(configuration_template.model_dump(), visit=expand_template)
+    populate_default_variables(template.variables, variables)
+    raw_config = expand_raw_config(configuration_template, variables, secrets, user_details, environment)
     return to_configuration_object(raw_config)
 
 
 TypesToConfigurationClasses: Dict[ObjectStoreTemplateType, Type[ObjectStoreConfiguration]] = {
-    "s3": S3ObjectStoreConfiguration,
+    "aws_s3": AwsS3ObjectStoreConfiguration,
+    "boto3": Boto3ObjectStoreConfiguration,
     "generic_s3": GenericS3ObjectStoreConfiguration,
     "azure_blob": AzureObjectStoreConfiguration,
     "disk": DiskObjectStoreConfiguration,
diff --git a/lib/galaxy/objectstore/unittest_utils/__init__.py b/lib/galaxy/objectstore/unittest_utils/__init__.py
index c8cff5aa7e5..3de8a1db9db 100644
--- a/lib/galaxy/objectstore/unittest_utils/__init__.py
+++ b/lib/galaxy/objectstore/unittest_utils/__init__.py
@@ -100,7 +100,22 @@ class MockConfig:
         self.enable_quotas = True
 
 
+def app_config(tmpdir) -> objectstore.UserObjectStoresAppConfig:
+    app_config = objectstore.UserObjectStoresAppConfig(
+        jobs_directory=str(tmpdir / "jobs"),
+        new_file_path=str(tmpdir / "new_files"),
+        umask=0o077,
+        gid=0o077,
+        object_store_cache_path=str(tmpdir / "cache"),
+        object_store_cache_size=1,
+        user_config_templates_index_by="uuid",
+        user_config_templates_use_saved_configuration="fallback",
+    )
+    return app_config
+
+
 __all__ = [
+    "app_config",
     "Config",
     "MockConfig",
     "DISK_TEST_CONFIG",
diff --git a/lib/galaxy/schema/__init__.py b/lib/galaxy/schema/__init__.py
index c83d22f4770..9228622c8ac 100644
--- a/lib/galaxy/schema/__init__.py
+++ b/lib/galaxy/schema/__init__.py
@@ -25,6 +25,7 @@ from pydantic.fields import FieldInfo
 class BootstrapAdminUser(BaseModel):
     id: int = 0
     email: Optional[str] = None
+    username: Optional[str] = None
     preferences: Dict[str, str] = {}
     bootstrap_admin_user: bool = True
 
diff --git a/lib/galaxy/selenium/navigates_galaxy.py b/lib/galaxy/selenium/navigates_galaxy.py
index 35e99ec633d..cfb53b38bf7 100644
--- a/lib/galaxy/selenium/navigates_galaxy.py
+++ b/lib/galaxy/selenium/navigates_galaxy.py
@@ -9,6 +9,10 @@ import random
 import string
 import time
 from abc import abstractmethod
+from dataclasses import (
+    dataclass,
+    field,
+)
 from functools import (
     partial,
     wraps,
@@ -18,6 +22,7 @@ from typing import (
     cast,
     Dict,
     List,
+    Literal,
     NamedTuple,
     Optional,
     Tuple,
@@ -180,6 +185,29 @@ def edit_details(f, scope=".history-index"):
     return func_wrapper
 
 
+@dataclass
+class ConfigTemplateParameter:
+    form_element_type: Literal["string", "boolean", "integer"]
+    name: str
+    value: Any
+
+
+@dataclass
+class FileSourceInstance:
+    template_id: str
+    name: str
+    description: Optional[str]
+    parameters: List[ConfigTemplateParameter] = field(default_factory=list)
+
+
+@dataclass
+class ObjectStoreInstance:
+    template_id: str
+    name: str
+    description: Optional[str]
+    parameters: List[ConfigTemplateParameter] = field(default_factory=list)
+
+
 class NavigatesGalaxy(HasDriver):
     """Class with helpers methods for driving components of the Galaxy interface.
 
@@ -987,6 +1015,26 @@ class NavigatesGalaxy(HasDriver):
         textarea = self.wait_for_selector(f"{tab_locator} .upload-row:last-of-type .upload-text-content")
         textarea.send_keys(pasted_content)
 
+    def upload_uri(self, uri, wait=False):
+        upload = self.components.upload
+        upload.start.wait_for_and_click()
+        upload.file_dialog.wait_for_and_click()
+        scheme, uri_rest = uri.split("://", 1)
+        parts = uri_rest.split("/")
+
+        root = f"{scheme}://{parts[0]}"
+        upload.file_source_selector(path=root).wait_for_and_click()
+        rest_parts = parts[1:]
+        path = root
+        for part in rest_parts:
+            path = f"{path}/{part}"
+            upload.file_source_selector(path=path).wait_for_and_click()
+        upload.file_dialog_ok.wait_for_and_click()
+        self.upload_start()
+        if wait:
+            self.sleep_for(self.wait_types.UX_RENDER)
+            self.wait_for_history()
+
     def upload_rule_start(self):
         self.upload_start_click()
         self.upload_tab_click("rule-based")
@@ -2303,6 +2351,78 @@ class NavigatesGalaxy(HasDriver):
             self.wait_for_xpath_visible(xpath)
         self.screenshot_if(screenshot_after_submit)
 
+    def create_file_source_template(self, instance: FileSourceInstance) -> str:
+        self.navigate_to_user_preferences()
+        template_id = instance.template_id
+        preferences = self.components.preferences
+        preferences.manage_file_sources.wait_for_and_click()
+        file_source_instances = self.components.file_source_instances
+        file_source_instances.index.create_button.wait_for_and_click()
+
+        select_template = file_source_instances.create.select(template_id=template_id)
+        select_template.wait_for_present()
+        self.screenshot(f"user_file_source_select_{template_id}")
+        select_template.wait_for_and_click()
+
+        file_source_instances.create._.wait_for_present()
+        self.screenshot(f"user_file_source_form_empty_{template_id}")
+        self._fill_configuration_template(instance.name, instance.description, instance.parameters)
+        self.screenshot(f"user_file_source_form_full_{template_id}")
+        file_source_instances.create.submit.wait_for_and_click()
+
+        file_source_instances = self.components.file_source_instances
+        file_source_instances.index._.wait_for_present()
+        self.screenshot(f"user_file_source_created_{template_id}")
+        instances = self.api_get("file_source_instances")
+        newest_instance = instances[-1]
+        uri_root = newest_instance["uri_root"]
+        return uri_root
+
+    def create_object_store_template(self, instance: ObjectStoreInstance) -> str:
+        self.navigate_to_user_preferences()
+        template_id = instance.template_id
+        preferences = self.components.preferences
+        preferences.manage_object_stores.wait_for_and_click()
+        object_store_instances = self.components.object_store_instances
+        object_store_instances.index.create_button.wait_for_and_click()
+
+        select_template = object_store_instances.create.select(template_id=template_id)
+        select_template.wait_for_present()
+        self.screenshot(f"user_object_store_select_{template_id}")
+        select_template.wait_for_and_click()
+
+        object_store_instances.create._.wait_for_present()
+        self.screenshot(f"user_object_store_form_empty_{template_id}")
+        self._fill_configuration_template(instance.name, instance.description, instance.parameters)
+        self.screenshot(f"user_object_store_form_full_{template_id}")
+        object_store_instances.create.submit.wait_for_and_click()
+        object_store_instances.index._.wait_for_present()
+        self.screenshot(f"user_object_store_created_{template_id}")
+        instances = self.api_get("object_store_instances")
+        newest_instance = instances[-1]
+        object_store_id = newest_instance["object_store_id"]
+        return object_store_id
+
+    def _fill_configuration_template(
+        self, name: str, description: Optional[str], parameters: List[ConfigTemplateParameter]
+    ):
+        self.components.tool_form.parameter_input(parameter="_meta_name").wait_for_and_send_keys(
+            name,
+        )
+        if description:
+            self.components.tool_form.parameter_input(parameter="_meta_description").wait_for_and_send_keys(
+                description,
+            )
+
+        for parameter in parameters:
+            form_type = parameter.form_element_type
+            if form_type in ["integer", "string"]:
+                self.components.tool_form.parameter_input(parameter=parameter.name).wait_for_and_send_keys(
+                    str(parameter.value),
+                )
+            else:
+                raise NotImplementedError("Configuration templates of type {form_type} not yet implemented")
+
     def tutorial_mode_activate(self):
         search_selector = "#gtn a"
         self.wait_for_and_click_selector(search_selector)
diff --git a/lib/galaxy/util/config_templates.py b/lib/galaxy/util/config_templates.py
new file mode 100644
index 00000000000..84410e56633
--- /dev/null
+++ b/lib/galaxy/util/config_templates.py
@@ -0,0 +1,417 @@
+"""Utilities for defining user configuration bits from admin templates.
+
+This is capturing code shared by file source templates and object store templates.
+"""
+
+import os
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+    Type,
+    TypeVar,
+    Union,
+)
+
+import yaml
+from boltons.iterutils import remap
+from pydantic import (
+    BaseModel,
+    ConfigDict,
+    RootModel,
+)
+from typing_extensions import (
+    Literal,
+    Protocol,
+)
+
+try:
+    from jinja2.nativetypes import NativeEnvironment
+except ImportError:
+    NativeEnvironment = None  # type:ignore[assignment, misc, unused-ignore]
+
+from galaxy.exceptions import (
+    ObjectNotFound,
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.util import asbool
+
+TemplateVariableType = Literal["string", "path_component", "boolean", "integer"]
+TemplateVariableValueType = Union[str, bool, int]
+TemplateExpansion = str
+MarkdownContent = str
+RawTemplateConfig = Dict[str, Any]
+UserDetailsDict = Dict[str, Any]
+VariablesDict = Dict[str, TemplateVariableValueType]
+SecretsDict = Dict[str, str]
+EnvironmentDict = Dict[str, str]
+
+
+class StrictModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class BaseTemplateVariable(StrictModel):
+    name: str
+    label: Optional[str] = None
+    help: Optional[MarkdownContent]
+
+
+class TemplateVariableString(BaseTemplateVariable):
+    type: Literal["string"]
+    default: str = ""
+    # add non-empty validation?
+
+
+class TemplateVariableInteger(BaseTemplateVariable):
+    type: Literal["integer"]
+    default: int = 0
+    # add min/max
+
+
+class TemplateVariablePathComponent(BaseTemplateVariable):
+    type: Literal["path_component"]
+    default: Optional[str] = None
+
+
+class TemplateVariableBoolean(BaseTemplateVariable):
+    type: Literal["boolean"]
+    default: bool = False
+
+
+TemplateVariable = Union[
+    TemplateVariableString, TemplateVariableInteger, TemplateVariablePathComponent, TemplateVariableBoolean
+]
+
+
+class TemplateSecret(StrictModel):
+    name: str
+    label: Optional[str] = None
+    help: Optional[MarkdownContent]
+
+
+class TemplateEnvironmentSecret(StrictModel):
+    type: Literal["secret"]
+    name: str
+    vault_key: str
+    default: Optional[str] = None
+
+
+class TemplateEnvironmentVariable(StrictModel):
+    type: Literal["variable"]
+    name: str
+    variable: str
+    default: Optional[str] = None
+
+
+TemplateEnvironmentEntry = Union[TemplateEnvironmentVariable, TemplateEnvironmentSecret]
+TemplateEnvironment = RootModel[List[TemplateEnvironmentEntry]]
+
+
+def _ensure_path_component(input: Any):
+    input_as_string = str(input)
+    if not acts_as_simple_path_component(input_as_string):
+        raise Exception("Path manipulation detected, failing evaluation")
+    return input
+
+
+# NativeEnvironment preserves Python types
+def _environment(template_start: str, template_end: str) -> NativeEnvironment:
+    env = NativeEnvironment(
+        variable_start_string=template_start,
+        variable_end_string=template_end,
+    )
+    env.filters["ensure_path_component"] = _ensure_path_component
+    env.filters["asbool"] = asbool
+    return env
+
+
+class TemplateConfiguration(Protocol):
+
+    def model_dump(self) -> Dict[str, Any]:
+        """Implements a pydantic model dump to build simple JSON dictionary."""
+
+    @property
+    def template_start(self) -> Optional[str]:
+        """Set a custom variable start for Jinja variable substitution.
+
+        https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+        """
+
+    @property
+    def template_end(self) -> Optional[str]:
+        """Set a custom variable end for Jinja variable substitution.
+
+        https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+        """
+
+
+def populate_default_variables(variables: Optional[List[TemplateVariable]], variable_values: VariablesDict):
+    if variables:
+        for variable in variables:
+            name = variable.name
+            if name not in variable_values and variable.default is not None:
+                variable_values[name] = variable.default
+
+
+def expand_raw_config(
+    template_configuration: TemplateConfiguration,
+    variables: VariablesDict,
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
+) -> RawTemplateConfig:
+    template_variables = {
+        "variables": variables,
+        "secrets": secrets,
+        "user": user_details,
+        "environment": environment,
+    }
+
+    template_start = template_configuration.template_start or "{{"
+    template_end = template_configuration.template_end or "}}"
+
+    def expand_template(_, key, value):
+        if isinstance(value, str) and template_start in value and template_end in value:
+            template = _environment(template_start, template_end).from_string(value)
+            return key, template.render(**template_variables)
+        return key, value
+
+    template_model_as_json = template_configuration.model_dump()
+    raw_config = remap(template_model_as_json, visit=expand_template)
+    _clean_template_meta_parameters(raw_config)
+    return raw_config
+
+
+def verify_vault_configured_if_uses_secrets(catalog, vault_configured: bool, exception_message: str) -> None:
+    if _catalog_uses_secrets(catalog) and not vault_configured:
+        raise Exception(exception_message)
+
+
+def _catalog_uses_secrets(catalog) -> bool:
+    templates = catalog.root
+    for template in templates:
+        if template.secrets and len(template.secrets) > 0:
+            return True
+    return False
+
+
+def _clean_template_meta_parameters(config: RawTemplateConfig) -> RawTemplateConfig:
+    # slight templating differences between what is allowed in the template definition
+    # and what is allowed in the actual configuration objects we send to respective modules
+    # to instantiate plugins. In particular, descriptions of how templating is done should
+    # eliminated after templates have been expanded.
+    meta_parameters = ["template_start", "template_end"]
+    for meta_parameter in meta_parameters:
+        if meta_parameter in config:
+            del config[meta_parameter]
+    return config
+
+
+# cwl-like - convert simple dictionary to list of dictionaries for quickly
+# configuring variables and secrets
+def apply_syntactic_sugar(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
+    templates = []
+    expanded_raw_templates = _expand_includes(raw_templates)
+    for template in expanded_raw_templates:
+        _force_key_to_list(template, "variables")
+        _force_key_to_list(template, "secrets")
+        _force_key_to_list(template, "environment")
+        templates.append(template)
+    return templates
+
+
+def _expand_includes(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
+    expanded_raw_templates = []
+    for raw_template in raw_templates:
+        expanded_raw_templates.extend(_expand_include(raw_template))
+    return expanded_raw_templates
+
+
+def _expand_include(raw_template: RawTemplateConfig) -> List[RawTemplateConfig]:
+    has_one_key = len(raw_template.keys()) == 1
+    has_include = "include" in raw_template
+
+    if has_one_key and has_include:
+        include = raw_template["include"]
+        with open(include) as f:
+            included = yaml.safe_load(f)
+            raw_templates: List[RawTemplateConfig]
+            if isinstance(included, list):
+                raw_templates = included
+            else:
+                raw_templates = [included]
+            return _expand_includes(raw_templates)
+    else:
+        return [raw_template]
+
+
+def _force_key_to_list(template: RawTemplateConfig, key: str) -> None:
+    value = template.get(key, None)
+    if isinstance(value, dict):
+        value_as_list = []
+        for key_name, key_value in value.items():
+            key_value["name"] = key_name
+            value_as_list.append(key_value)
+        template[key] = value_as_list
+
+
+class TemplateReference(Protocol):
+    template_id: str
+    template_version: int
+
+
+class InstanceDefinition(TemplateReference, Protocol):
+    variables: Dict[str, Any]
+    secrets: SecretsDict
+
+
+class Template(Protocol):
+    @property
+    def id(self) -> str: ...
+
+    @property
+    def version(self) -> int: ...
+
+    @property
+    def variables(self) -> Optional[List[TemplateVariable]]: ...
+
+    @property
+    def secrets(self) -> Optional[List[TemplateSecret]]: ...
+
+    @property
+    def environment(self) -> Optional[List[TemplateEnvironmentEntry]]: ...
+
+
+T = TypeVar("T", bound=Template, covariant=True)
+
+
+def find_template(templates: List[T], instance_reference: TemplateReference, what: str) -> T:
+    template_id = instance_reference.template_id
+    template_version = instance_reference.template_version
+    return find_template_by(templates, template_id, template_version, what)
+
+
+def find_template_by(templates: List[T], template_id: str, template_version: int, what: str) -> T:
+    for template in templates:
+        if template.id == template_id and template.version == template_version:
+            return template
+
+    raise ObjectNotFound(f"Could not find a {what} template with id {template_id} and version {template_version}")
+
+
+def validate_variable_types(instance: InstanceDefinition, template: Template) -> None:
+    pass
+
+
+def validate_defines_all_required_secrets(instance: InstanceDefinition, template: Template):
+    secrets = instance.secrets
+    for template_secret in template.secrets or []:
+        name = template_secret.name
+        if name not in secrets:
+            raise RequestParameterMissingException(f"Must define secret '{name}'")
+
+
+def validate_defines_all_required_variables(instance: InstanceDefinition, template: Template):
+    variables = instance.variables
+    for template_variable in template.variables or []:
+        name = template_variable.name
+        has_default = template_variable.default is not None
+        if name not in variables and not has_default:
+            raise RequestParameterMissingException(f"Must define variable '{name}'")
+
+
+def validate_specified_datatypes(instance: InstanceDefinition, template: Template):
+    secrets = instance.secrets
+    for name, value in secrets.items():
+        if not isinstance(value, str):
+            raise RequestParameterInvalidException(f"Secret value for secret '{name}' must be of type string")
+    variables = instance.variables
+    validate_specified_datatypes_variables(variables, template)
+
+
+def validate_specified_datatypes_variables(variables: Dict[str, Any], template: Template):
+    for template_variable in template.variables or []:
+        name = template_variable.name
+        variable_value = variables.get(name, template_variable.default)
+        template_type = template_variable.type
+        if template_type in ["string", "path_component"]:
+            if not isinstance(variable_value, str):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type str")
+            if template_type == "path_component":
+                if ".." in variable_value or "/" in variable_value:
+                    raise RequestParameterInvalidException(
+                        f"Variable value for variable '{name}' must be simple path component, invalid characters found"
+                    )
+                if not acts_as_simple_path_component(variable_value):
+                    raise RequestParameterInvalidException(
+                        f"Variable value for variable '{name}' must be simple path component, invalid characters found"
+                    )
+        if template_type == "integer":
+            if not _is_of_exact_type(variable_value, int):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type int")
+        if template_type == "boolean":
+            if not _is_of_exact_type(variable_value, bool):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type bool")
+
+
+def validate_no_extra_secrets_defined(secrets: Dict[str, str], template: Template) -> None:
+    template_secrets = secrets_as_dict(template.secrets)
+    for secret in secrets.keys():
+        if secret not in template_secrets:
+            raise RequestParameterInvalidException(f"No secret named {secret} for this template")
+
+
+def validate_no_extra_variables_defined(variables: Dict[str, Any], template: Template):
+    template_variables = _variables_as_dict(template.variables)
+    for variable in variables.keys():
+        if variable not in template_variables:
+            raise RequestParameterInvalidException(f"No variable named {variable} for this template")
+
+
+def validate_secrets_and_variables(instance: InstanceDefinition, template: Template) -> None:
+    validate_defines_all_required_secrets(instance, template)
+    validate_defines_all_required_variables(instance, template)
+    validate_specified_datatypes(instance, template)
+    validate_no_extra_secrets_defined(instance.secrets, template)
+    validate_no_extra_variables_defined(instance.variables, template)
+
+
+def secrets_as_dict(secrets: Optional[List[TemplateSecret]]) -> Dict[str, TemplateSecret]:
+    as_dict = {}
+    for secret in secrets or []:
+        as_dict[secret.name] = secret
+    return as_dict
+
+
+def _variables_as_dict(variables: Optional[List[TemplateVariable]]) -> Dict[str, TemplateVariable]:
+    as_dict = {}
+    for variable in variables or []:
+        as_dict[variable.name] = variable
+    return as_dict
+
+
+def _is_of_exact_type(object: Any, target_type: Type):
+    # isinstance(False, int) and False == 0 are both True in Python...
+    # We are creating a DSL here that is intentionally more strict than Python
+    # so we are using type() instead of isinstance and we have the test coverage
+    # to ensure this is the desired behavior and remains. Think JSON typing, not
+    # pythonic typing. Galaxy's internals as a Python project should not be
+    # exposed here.
+    return type(object) == target_type  # noqa: E721
+
+
+def acts_as_simple_path_component(value: str):
+    cwd = os.getcwd()
+    abs_path = os.path.abspath(f"{cwd}/{value}")
+    unaffected_by_normpath = os.path.normpath(abs_path) == abs_path
+    if not unaffected_by_normpath:
+        return False
+    should_be_cwd, should_be_value = os.path.split(abs_path)
+    if should_be_cwd != cwd:
+        return False
+    if should_be_value != value:
+        return False
+    return True
diff --git a/lib/galaxy/webapps/galaxy/api/file_sources.py b/lib/galaxy/webapps/galaxy/api/file_sources.py
new file mode 100644
index 00000000000..bf0862661a3
--- /dev/null
+++ b/lib/galaxy/webapps/galaxy/api/file_sources.py
@@ -0,0 +1,107 @@
+import logging
+from typing import List
+
+from fastapi import (
+    Body,
+    Path,
+)
+
+from galaxy.files.templates import FileSourceTemplateSummaries
+from galaxy.managers.context import ProvidesUserContext
+from galaxy.managers.file_source_instances import (
+    CreateInstancePayload,
+    FileSourceInstancesManager,
+    ModifyInstancePayload,
+    UserFileSourceModel,
+)
+from . import (
+    depends,
+    DependsOnTrans,
+    Router,
+)
+
+log = logging.getLogger(__name__)
+
+router = Router(tags=["file_sources"])
+
+
+UserFileSourceIdPathParam: str = Path(
+    ..., title="User File Source ID", description="The index for a persisted UserFileSourceStore object."
+)
+
+
+@router.cbv
+class FastAPIFileSources:
+    file_source_instances_manager: FileSourceInstancesManager = depends(FileSourceInstancesManager)
+
+    @router.get(
+        "/api/file_source_templates",
+        summary="Get a list of file source templates available to build user defined file sources from",
+        response_description="A list of the configured file source templates.",
+        operation_id="file_sources__templates_index",
+    )
+    def index_templates(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+    ) -> FileSourceTemplateSummaries:
+        return self.file_source_instances_manager.summaries
+
+    @router.post(
+        "/api/file_source_instances",
+        summary="Create a user-bound object store.",
+        operation_id="file_sources__create_instance",
+    )
+    def create(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        payload: CreateInstancePayload = Body(...),
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.create_instance(trans, payload)
+
+    @router.get(
+        "/api/file_source_instances",
+        summary="Get a list of persisted file source instances defined by the requesting user.",
+        operation_id="file_sources__instances_index",
+    )
+    def instance_index(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+    ) -> List[UserFileSourceModel]:
+        return self.file_source_instances_manager.index(trans)
+
+    @router.get(
+        "/api/file_source_instances/{user_file_source_id}",
+        summary="Get a list of persisted file source instances defined by the requesting user.",
+        operation_id="file_sources__instances_get",
+    )
+    def instances_show(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_file_source_id: str = UserFileSourceIdPathParam,
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.show(trans, user_file_source_id)
+
+    @router.put(
+        "/api/file_source_instances/{user_file_source_id}",
+        summary="Update or upgrade user file source instance.",
+        operation_id="file_sources__instances_update",
+    )
+    def update_instance(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_file_source_id: str = UserFileSourceIdPathParam,
+        payload: ModifyInstancePayload = Body(...),
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.modify_instance(trans, user_file_source_id, payload)
+
+    @router.delete(
+        "/api/file_source_instances/{user_file_source_id}",
+        summary="Purge user file source instance.",
+        operation_id="file_sources__instances_purge",
+    )
+    def purge_instance(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_file_source_id: str = UserFileSourceIdPathParam,
+    ) -> None:
+        self.file_source_instances_manager.purge_instance(trans, user_file_source_id)
diff --git a/lib/galaxy/webapps/galaxy/api/object_store.py b/lib/galaxy/webapps/galaxy/api/object_store.py
index 90531860446..62890b8c073 100644
--- a/lib/galaxy/webapps/galaxy/api/object_store.py
+++ b/lib/galaxy/webapps/galaxy/api/object_store.py
@@ -3,7 +3,10 @@ API operations on Galaxy's object store.
 """
 
 import logging
-from typing import List
+from typing import (
+    List,
+    Union,
+)
 
 from fastapi import (
     Body,
@@ -68,7 +71,7 @@ class FastAPIObjectStore:
         self,
         trans: ProvidesUserContext = DependsOnTrans,
         selectable: bool = SelectableQueryParam,
-    ) -> List[ConcreteObjectStoreModel]:
+    ) -> List[Union[ConcreteObjectStoreModel, UserConcreteObjectStoreModel]]:
         if not selectable:
             raise RequestParameterInvalidException(
                 "The object store index query currently needs to be called with selectable=true"
@@ -140,6 +143,18 @@ class FastAPIObjectStore:
     ) -> UserConcreteObjectStoreModel:
         return self.object_store_instance_manager.modify_instance(trans, user_object_store_id, payload)
 
+    @router.delete(
+        "/api/object_store_instances/{user_object_store_id}",
+        summary="Purge user object store instance.",
+        operation_id="object_stores__instances_purge",
+    )
+    def purge_instance(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_object_store_id: str = UserObjectStoreIdPathParam,
+    ) -> None:
+        self.object_store_instance_manager.purge_instance(trans, user_object_store_id)
+
     @router.get(
         "/api/object_store_templates",
         summary="Get a list of object store templates available to build user defined object stores from",
diff --git a/lib/galaxy/webapps/galaxy/buildapp.py b/lib/galaxy/webapps/galaxy/buildapp.py
index 34de1df2783..a5d7c5e04e9 100644
--- a/lib/galaxy/webapps/galaxy/buildapp.py
+++ b/lib/galaxy/webapps/galaxy/buildapp.py
@@ -227,6 +227,11 @@ def app_pair(global_conf, load_app_kwds=None, wsgi_preflight=True, **kwargs):
     webapp.add_client_route("/object_store_instances/{user_object_store_id}/edit")
     webapp.add_client_route("/object_store_instances/{user_object_store_id}/upgrade")
     webapp.add_client_route("/object_store_templates/{template_id}/new")
+    webapp.add_client_route("/file_source_instances/create")
+    webapp.add_client_route("/file_source_instances/index")
+    webapp.add_client_route("/file_source_instances/{user_file_source_id}/edit")
+    webapp.add_client_route("/file_source_instances/{user_file_source_id}/upgrade")
+    webapp.add_client_route("/file_source_templates/{template_id}/new")
     webapp.add_client_route("/welcome/new")
     webapp.add_client_route("/visualizations")
     webapp.add_client_route("/visualizations/edit")
diff --git a/lib/galaxy_test/base/populators.py b/lib/galaxy_test/base/populators.py
index db224dff00e..58b0039e45b 100644
--- a/lib/galaxy_test/base/populators.py
+++ b/lib/galaxy_test/base/populators.py
@@ -507,6 +507,19 @@ class BaseDatasetPopulator(BasePopulator):
         details = self.get_history_dataset_details(history_id, dataset=output)
         return details
 
+    def export_dataset_to_remote_file(self, history_id: str, content: str, name: str, target_uri: str):
+        dataset = self.new_dataset(history_id, content=content, wait=True, name=name)
+        infile = {"src": "hda", "id": dataset["id"]}
+        inputs = {
+            "d_uri": target_uri,
+            "export_type|export_type_selector": "datasets_named",
+            "export_type|datasets_0|infile": infile,
+            "export_type|datasets_0|name": name,
+        }
+        response = self.run_tool("export_remote", inputs, history_id)
+        self.wait_for_job(response["jobs"][0]["id"], assert_ok=True)
+        return f"{target_uri}/{name}"
+
     def tag_dataset(self, history_id, hda_id, tags, raise_on_error=True):
         url = f"histories/{history_id}/contents/{hda_id}"
         response = self._put(url, {"tags": tags}, json=True)
diff --git a/lib/galaxy_test/driver/integration_util.py b/lib/galaxy_test/driver/integration_util.py
index 5189a7394f9..90c971a1e29 100644
--- a/lib/galaxy_test/driver/integration_util.py
+++ b/lib/galaxy_test/driver/integration_util.py
@@ -261,6 +261,32 @@ class ConfiguresObjectStores:
         config["object_store_templates_config_file"] = template_config_path
 
 
+class ConfiguresFileSourceTemplates:
+    _test_driver: GalaxyTestDriver
+
+    @classmethod
+    def _configure_file_source_template_catalog(cls, catalog: str, config):
+        temp_directory = cls._test_driver.mkdtemp()
+        template_config_path = os.path.join(temp_directory, "file_source_templates.yml")
+        with open(template_config_path, "w") as f:
+            f.write(catalog)
+
+        config["file_source_templates_config_file"] = template_config_path
+
+
+class ConfiguresObjectStoreTemplates:
+    _test_driver: GalaxyTestDriver
+
+    @classmethod
+    def _configure_object_Store_template_catalog(cls, catalog: str, config):
+        temp_directory = cls._test_driver.mkdtemp()
+        template_config_path = os.path.join(temp_directory, "object_store_templates.yml")
+        with open(template_config_path, "w") as f:
+            f.write(catalog)
+
+        config["object_store_templates_config_file"] = template_config_path
+
+
 class ConfiguresDatabaseVault:
     @classmethod
     def _configure_database_vault(cls, config):
diff --git a/packages/files/MANIFEST.in b/packages/files/MANIFEST.in
index 12302eb8dff..4b43016d6ed 100644
--- a/packages/files/MANIFEST.in
+++ b/packages/files/MANIFEST.in
@@ -1 +1,2 @@
 include *.rst *.txt LICENSE */py.typed
+include galaxy/files/templates/examples/*yml
diff --git a/packages/files/setup.cfg b/packages/files/setup.cfg
index f294659aa77..dc0599c9b7c 100644
--- a/packages/files/setup.cfg
+++ b/packages/files/setup.cfg
@@ -32,7 +32,7 @@ version = 23.2.dev0
 [options]
 include_package_data = True
 install_requires =
-    galaxy-util
+    galaxy-util[config_template]
     fs
     isal
     typing-extensions
diff --git a/packages/objectstore/MANIFEST.in b/packages/objectstore/MANIFEST.in
index 834ea5362a6..9469f2c19e7 100644
--- a/packages/objectstore/MANIFEST.in
+++ b/packages/objectstore/MANIFEST.in
@@ -1,2 +1,2 @@
 include *.rst *.txt LICENSE */py.typed
-
+include galaxy/objectstore/templates/examples/*yml
\ No newline at end of file
diff --git a/packages/objectstore/setup.cfg b/packages/objectstore/setup.cfg
index 0b47a88eaa1..6ba5fe551e6 100644
--- a/packages/objectstore/setup.cfg
+++ b/packages/objectstore/setup.cfg
@@ -33,10 +33,9 @@ version = 23.2.dev0
 [options]
 include_package_data = True
 install_requires =
-    galaxy-util
+    galaxy-util[config_template]
     pydantic>=2,!=2.6.0,!=2.6.1
     PyYAML
-    Jinja2
 packages = find:
 python_requires = >=3.7
 
diff --git a/packages/test.sh b/packages/test.sh
index 0d1d1655d94..be98e038285 100755
--- a/packages/test.sh
+++ b/packages/test.sh
@@ -49,7 +49,7 @@ while read -r package_dir || [ -n "$package_dir" ]; do  # https://stackoverflow.
 
     # Install extras (if needed)
     if [ "$package_dir" = "util" ]; then
-        pip install '.[template,jstree]'
+        pip install '.[template,jstree,config_template]'
     elif [ "$package_dir" = "tool_util" ]; then
         pip install '.[cwl,mulled,edam,extended-assertions]'
     else
diff --git a/packages/util/setup.cfg b/packages/util/setup.cfg
index 70add5d8311..d0a614868fa 100644
--- a/packages/util/setup.cfg
+++ b/packages/util/setup.cfg
@@ -53,6 +53,9 @@ jstree =
 template =
     Cheetah3
     future>=1.0.0
+config_template =
+    Jinja2
+    pydantic
 
 [options.packages.find]
 exclude =
diff --git a/test/integration/objectstore/test_per_user.py b/test/integration/objectstore/test_per_user.py
index fe6b595cea9..c5b155bc371 100644
--- a/test/integration/objectstore/test_per_user.py
+++ b/test/integration/objectstore/test_per_user.py
@@ -4,6 +4,7 @@ from typing import (
     Tuple,
 )
 
+from galaxy.objectstore.templates.examples import get_example
 from galaxy_test.base import api_asserts
 from galaxy_test.driver import integration_util
 from ._base import BaseObjectStoreIntegrationTestCase
@@ -78,49 +79,7 @@ MULTI_VERSION_LIBRARY = """
 """
 
 
-MULTI_VERSION_WITH_SECRETS_LIBRARY = """
-- id: secure_disk
-  version: 0
-  name: Secure Disk
-  description: Secure Disk Bound to You
-  secrets:
-    sec1:
-      help: This is my test secret.
-  configuration:
-    type: disk
-    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/aftersec'
-    badges:
-    - type: more_secure
-    - type: slower
-- id: secure_disk
-  version: 1
-  name: Secure Disk
-  description: Secure Disk Bound to You
-  secrets:
-    sec1:
-      help: This is my test secret.
-    sec2:
-      help: This is my test secret 2.
-  configuration:
-    type: disk
-    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/{{ secrets.sec2 }}'
-    badges:
-    - type: more_secure
-    - type: slower
-- id: secure_disk
-  version: 2
-  name: Secure Disk
-  description: Secure Disk Bound to You
-  secrets:
-    sec2:
-      help: This is my test secret 2.
-  configuration:
-    type: disk
-    files_dir: '/data/secure/{{ user.username }}/newbar/{{ secrets.sec2 }}'
-    badges:
-    - type: more_secure
-    - type: slower
-"""
+MULTI_VERSION_WITH_SECRETS_LIBRARY = get_example("testing_multi_version_with_secrets.yml")
 
 
 class BaseUserObjectStoreIntegration(BaseObjectStoreIntegrationTestCase):
diff --git a/test/integration_selenium/_base_user_file_sources.py b/test/integration_selenium/_base_user_file_sources.py
new file mode 100644
index 00000000000..6532e134109
--- /dev/null
+++ b/test/integration_selenium/_base_user_file_sources.py
@@ -0,0 +1,25 @@
+from typing import TYPE_CHECKING
+
+from galaxy.files.templates.examples import get_example
+from galaxy_test.driver.integration_util import (
+    ConfiguresDatabaseVault,
+    ConfiguresFileSourceTemplates,
+)
+from .framework import SeleniumIntegrationTestCase
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+class BaseUserObjectStoreSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguresFileSourceTemplates, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+    example_filename: str
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_database_vault(config)
+        template = get_example(cls.example_filename)
+        cls._configure_file_source_template_catalog(template, config)
diff --git a/test/integration_selenium/_base_user_object_stores.py b/test/integration_selenium/_base_user_object_stores.py
new file mode 100644
index 00000000000..9f20348af1b
--- /dev/null
+++ b/test/integration_selenium/_base_user_object_stores.py
@@ -0,0 +1,25 @@
+from typing import TYPE_CHECKING
+
+from galaxy.objectstore.templates.examples import get_example
+from galaxy_test.driver.integration_util import (
+    ConfiguresDatabaseVault,
+    ConfiguresObjectStoreTemplates,
+)
+from .framework import SeleniumIntegrationTestCase
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+class BaseUserObjectStoreSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguresObjectStoreTemplates, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+    example_filename: str
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_database_vault(config)
+        template = get_example(cls.example_filename)
+        cls._configure_object_Store_template_catalog(template, config)
diff --git a/test/integration_selenium/framework.py b/test/integration_selenium/framework.py
index 97a3cb8ef4e..0bdc8283815 100644
--- a/test/integration_selenium/framework.py
+++ b/test/integration_selenium/framework.py
@@ -7,6 +7,7 @@ if TYPE_CHECKING:
     from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
 
 selenium_test = framework.selenium_test
+managed_history = framework.managed_history
 
 
 class SeleniumIntegrationTestCase(
diff --git a/test/integration_selenium/test_objectstore_creation.py b/test/integration_selenium/test_objectstore_creation.py
new file mode 100644
index 00000000000..00c5aff6513
--- /dev/null
+++ b/test/integration_selenium/test_objectstore_creation.py
@@ -0,0 +1,80 @@
+from typing import TYPE_CHECKING
+
+from galaxy_test.driver.integration_util import (
+    ConfiguresDatabaseVault,
+    ConfiguresObjectStores,
+)
+from .framework import (
+    selenium_test,
+    SeleniumIntegrationTestCase,
+)
+from .test_objectstore_selection import MSI_EXAMPLE_OBJECT_STORE_CONFIG_TEMPLATE
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+MULTI_VERSION_WITH_SECRETS_LIBRARY = """
+- id: secure_disk
+  version: 0
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/aftersec'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 1
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 2
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/newbar/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
+"""
+
+
+class TestObjectStoreSelectionSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguresObjectStores, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_object_store(MSI_EXAMPLE_OBJECT_STORE_CONFIG_TEMPLATE, config)
+        cls._configure_database_vault(config)
+        cls._configure_object_store_template_catalog(MULTI_VERSION_WITH_SECRETS_LIBRARY, config)
+
+    @selenium_test
+    def test_create_and_use(self):
+        self.navigate_to_user_preferences()
+        preferences = self.components.preferences
+        preferences.manage_object_stores.wait_for_and_click()
+        object_store_instances = self.components.object_store_instances
+        object_store_instances.index.create_button.wait_for_and_click()
diff --git a/test/integration_selenium/test_user_file_source_aws_public.py b/test/integration_selenium/test_user_file_source_aws_public.py
new file mode 100644
index 00000000000..668d022b97f
--- /dev/null
+++ b/test/integration_selenium/test_user_file_source_aws_public.py
@@ -0,0 +1,29 @@
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    FileSourceInstance,
+)
+from ._base_user_file_sources import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestUserFileSourceAwsPublicSeleniumIntegration(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_aws_public_bucket.yml"
+
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        self.navigate_to_user_preferences()
+        random_name = self._get_random_name(prefix="Encyclopedia of DNA Elements ENCODE")
+        instance = FileSourceInstance(
+            template_id="aws_public",
+            name=random_name,
+            description="The Encyclopedia of DNA Elements (ENCODE) Consortium is an international collaboration of research groups funded by the National Human Genome Research Institute (NHGRI)",
+            parameters=[
+                ConfigTemplateParameter("string", "bucket", "encode-public"),
+            ],
+        )
+        uri_root = self.create_file_source_template(instance)
+        self.upload_uri(f"{uri_root}/robots.txt", wait=True)
diff --git a/test/integration_selenium/test_user_file_source_azure.py b/test/integration_selenium/test_user_file_source_azure.py
new file mode 100644
index 00000000000..cb0f1a86cb5
--- /dev/null
+++ b/test/integration_selenium/test_user_file_source_azure.py
@@ -0,0 +1,43 @@
+import os
+
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    FileSourceInstance,
+)
+from galaxy.util.unittest_utils import skip_unless_environ
+from ._base_user_file_sources import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestObjectStoreSelectionSeleniumIntegration(BaseUserObjectStoreSeleniumIntegration):
+
+    @skip_unless_environ("GALAXY_TEST_AZURE_CONTAINER_NAME")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_KEY")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_NAME")
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        history_id = self.current_history_id()
+        self.navigate_to_user_preferences()
+        random_name = self._get_random_name(prefix="azure source")
+        instance = FileSourceInstance(
+            template_id="azure",
+            name=random_name,
+            description="automated test for azure file source",
+            parameters=[
+                ConfigTemplateParameter("string", "container_name", os.environ["GALAXY_TEST_AZURE_CONTAINER_NAME"]),
+                ConfigTemplateParameter("string", "account_name", os.environ["GALAXY_TEST_AZURE_ACCOUNT_NAME"]),
+                ConfigTemplateParameter("string", "account_key", os.environ["GALAXY_TEST_AZURE_ACCOUNT_KEY"]),
+            ],
+        )
+        uri_root = self.create_file_source_template(instance)
+        published_uri = self.dataset_populator.export_dataset_to_remote_file(
+            history_id,
+            "my file contents",
+            "my_cool_file",
+            uri_root,
+        )
+        self.upload_uri(published_uri, wait=True)
diff --git a/test/integration_selenium/test_user_file_source_ftp.py b/test/integration_selenium/test_user_file_source_ftp.py
new file mode 100644
index 00000000000..8b25468adad
--- /dev/null
+++ b/test/integration_selenium/test_user_file_source_ftp.py
@@ -0,0 +1,30 @@
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    FileSourceInstance,
+)
+from ._base_user_file_sources import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestObjectStoreSelectionSeleniumIntegration(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_ftp.yml"
+
+    @selenium_test
+    @managed_history
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="scene ftp")
+        instance = FileSourceInstance(
+            template_id="ftp",
+            name=random_name,
+            description="Archive of computer art from demoscene subsculture",
+            parameters=[
+                ConfigTemplateParameter("string", "host", "ftp.scene.org"),
+                ConfigTemplateParameter("string", "user", "ftp"),
+                ConfigTemplateParameter("string", "password", "email@example.com"),
+            ],
+        )
+        uri_root = self.create_file_source_template(instance)
+        self.upload_uri(f"{uri_root}/welcome.msg", wait=True)
diff --git a/test/integration_selenium/test_user_object_store_aws.py b/test/integration_selenium/test_user_object_store_aws.py
new file mode 100644
index 00000000000..3c05c1033f4
--- /dev/null
+++ b/test/integration_selenium/test_user_object_store_aws.py
@@ -0,0 +1,36 @@
+import os
+
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    ObjectStoreInstance,
+)
+from galaxy.util.unittest_utils import skip_unless_environ
+from ._base_user_object_stores import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestUserObjectStoreAwsS3(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_aws_s3.yml"
+
+    @skip_unless_environ("GALAXY_TEST_AWS_ACCESS_KEY")
+    @skip_unless_environ("GALAXY_TEST_AWS_SECRET_KEY")
+    @skip_unless_environ("GALAXY_TEST_AWS_BUCKET")
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="aws s3 object store")
+        instance = ObjectStoreInstance(
+            template_id="aws_s3",
+            name=random_name,
+            description="automated test for aws s3 object stores",
+            parameters=[
+                ConfigTemplateParameter("string", "access_key", os.environ["GALAXY_TEST_AWS_ACCESS_KEY"]),
+                ConfigTemplateParameter("string", "secret_key", os.environ["GALAXY_TEST_AWS_SECRET_KEY"]),
+                ConfigTemplateParameter("string", "bucket", os.environ["GALAXY_TEST_AWS_BUCKET"]),
+            ],
+        )
+        object_store_id = self.create_object_store_template(instance)
+        assert object_store_id
diff --git a/test/integration_selenium/test_user_object_store_azure.py b/test/integration_selenium/test_user_object_store_azure.py
new file mode 100644
index 00000000000..bb6f9c123dd
--- /dev/null
+++ b/test/integration_selenium/test_user_object_store_azure.py
@@ -0,0 +1,36 @@
+import os
+
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    ObjectStoreInstance,
+)
+from galaxy.util.unittest_utils import skip_unless_environ
+from ._base_user_object_stores import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestUserObjectStoreAzureBlob(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_azure_blob.yml"
+
+    @skip_unless_environ("GALAXY_TEST_AZURE_CONTAINER_NAME")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_KEY")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_NAME")
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="azure object store")
+        instance = ObjectStoreInstance(
+            template_id="azure",
+            name=random_name,
+            description="automated test for azure object store",
+            parameters=[
+                ConfigTemplateParameter("string", "container_name", os.environ["GALAXY_TEST_AZURE_CONTAINER_NAME"]),
+                ConfigTemplateParameter("string", "account_name", os.environ["GALAXY_TEST_AZURE_ACCOUNT_NAME"]),
+                ConfigTemplateParameter("string", "account_key", os.environ["GALAXY_TEST_AZURE_ACCOUNT_KEY"]),
+            ],
+        )
+        object_store_id = self.create_object_store_template(instance)
+        assert object_store_id
diff --git a/test/integration_selenium/test_user_object_store_gcp.py b/test/integration_selenium/test_user_object_store_gcp.py
new file mode 100644
index 00000000000..ec8b10bfb02
--- /dev/null
+++ b/test/integration_selenium/test_user_object_store_gcp.py
@@ -0,0 +1,36 @@
+import os
+
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    ObjectStoreInstance,
+)
+from galaxy.util.unittest_utils import skip_unless_environ
+from ._base_user_object_stores import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+
+class TestUserObjectStoreGcpViaS3(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_gcp_s3.yml"
+
+    @skip_unless_environ("GALAXY_TEST_GOOGLE_INTEROP_ACCESS_KEY")
+    @skip_unless_environ("GALAXY_TEST_GOOGLE_INTEROP_SECRET_KEY")
+    @skip_unless_environ("GALAXY_TEST_GOOGLE_BUCKET")
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="Google Cloud Storage object store")
+        instance = ObjectStoreInstance(
+            template_id="gcp_s3_interop",
+            name=random_name,
+            description="automated test for Google Cloud Storage S3 interop object stores",
+            parameters=[
+                ConfigTemplateParameter("string", "access_key", os.environ["GALAXY_TEST_GOOGLE_INTEROP_ACCESS_KEY"]),
+                ConfigTemplateParameter("string", "secret_key", os.environ["GALAXY_TEST_GOOGLE_INTEROP_SECRET_KEY"]),
+                ConfigTemplateParameter("string", "bucket", os.environ["GALAXY_TEST_GOOGLE_BUCKET"]),
+            ],
+        )
+        object_store_id = self.create_object_store_template(instance)
+        assert object_store_id
diff --git a/test/integration_selenium/test_user_object_store_generic_s3.py b/test/integration_selenium/test_user_object_store_generic_s3.py
new file mode 100644
index 00000000000..e59d1715c98
--- /dev/null
+++ b/test/integration_selenium/test_user_object_store_generic_s3.py
@@ -0,0 +1,40 @@
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    ObjectStoreInstance,
+)
+from ._base_user_object_stores import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+from .test_user_object_store_generic_s3_legacy import (
+    GALAXY_TEST_PLAY_MINIO_BUCKET,
+    GALAXY_TEST_PLAY_MINIO_KEY,
+    GALAXY_TEST_PLAY_MINIO_SECRET,
+    PLAY_HOST,
+    PLAY_PORT,
+)
+
+PLAY_ENDPOINT_URL = f"https://{PLAY_HOST}:{PLAY_PORT}/"
+
+
+class TestUserObjectStoreGenericS3(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_generic_s3.yml"
+
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="generic s3 object store using play.min.io")
+        instance = ObjectStoreInstance(
+            template_id="generic_s3",
+            name=random_name,
+            description="automated test for legacy generic s3 object store against play.min.io",
+            parameters=[
+                ConfigTemplateParameter("string", "access_key", GALAXY_TEST_PLAY_MINIO_KEY),
+                ConfigTemplateParameter("string", "secret_key", GALAXY_TEST_PLAY_MINIO_SECRET),
+                ConfigTemplateParameter("string", "bucket", GALAXY_TEST_PLAY_MINIO_BUCKET),
+                ConfigTemplateParameter("string", "endpoint_url", PLAY_ENDPOINT_URL),
+            ],
+        )
+        object_store_id = self.create_object_store_template(instance)
+        assert object_store_id
diff --git a/test/integration_selenium/test_user_object_store_generic_s3_legacy.py b/test/integration_selenium/test_user_object_store_generic_s3_legacy.py
new file mode 100644
index 00000000000..506c3c11360
--- /dev/null
+++ b/test/integration_selenium/test_user_object_store_generic_s3_legacy.py
@@ -0,0 +1,38 @@
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    ObjectStoreInstance,
+)
+from ._base_user_object_stores import BaseUserObjectStoreSeleniumIntegration
+from .framework import (
+    managed_history,
+    selenium_test,
+)
+
+PLAY_HOST = "play.min.io"
+PLAY_PORT = "9000"
+GALAXY_TEST_PLAY_MINIO_KEY = "LEHFJDNqSA4xcJmmezU7"
+GALAXY_TEST_PLAY_MINIO_SECRET = "E3ycZrp2nV8WscER8HqgsPPL2aFc2uuTbRchelcX"
+GALAXY_TEST_PLAY_MINIO_BUCKET = "gxtest1"
+
+
+class TestUserObjectStoreGenericS3Legacy(BaseUserObjectStoreSeleniumIntegration):
+    example_filename = "production_generic_s3_legacy.yml"
+
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="generic s3 object store using play.min.io")
+        instance = ObjectStoreInstance(
+            template_id="generic_s3_legacy",
+            name=random_name,
+            description="automated test for legacy generic s3 object store against play.min.io",
+            parameters=[
+                ConfigTemplateParameter("string", "access_key", GALAXY_TEST_PLAY_MINIO_KEY),
+                ConfigTemplateParameter("string", "secret_key", GALAXY_TEST_PLAY_MINIO_SECRET),
+                ConfigTemplateParameter("string", "bucket", GALAXY_TEST_PLAY_MINIO_BUCKET),
+                ConfigTemplateParameter("string", "host", PLAY_HOST),
+                ConfigTemplateParameter("integer", "port", PLAY_PORT),
+            ],
+        )
+        object_store_id = self.create_object_store_template(instance)
+        assert object_store_id
diff --git a/test/unit/app/managers/base.py b/test/unit/app/managers/base.py
index 5251fc06730..5eee85e4e02 100644
--- a/test/unit/app/managers/base.py
+++ b/test/unit/app/managers/base.py
@@ -35,11 +35,13 @@ class BaseTestCase(TestCase):
 
     def set_up_mocks(self):
         admin_users_list = [u for u in admin_users.split(",") if u]
-        self.trans = cast(
-            SessionRequestContext, galaxy_mock.MockTrans(admin_users=admin_users, admin_users_list=admin_users_list)
-        )
+        self.mock_trans = galaxy_mock.MockTrans(admin_users=admin_users, admin_users_list=admin_users_list)
+        self.trans = cast(SessionRequestContext, self.mock_trans)
         self.app = self.trans.app
 
+    def init_user_in_database(self):
+        self.mock_trans.init_user_in_database()
+
     def set_up_managers(self):
         self.user_manager = self.app[UserManager]
 
diff --git a/test/unit/app/managers/test_user_file_sources.py b/test/unit/app/managers/test_user_file_sources.py
new file mode 100644
index 00000000000..e428caa3f9c
--- /dev/null
+++ b/test/unit/app/managers/test_user_file_sources.py
@@ -0,0 +1,370 @@
+import os
+from typing import (
+    cast,
+    List,
+    Optional,
+)
+
+from galaxy.files import FileSourcesUserContext
+from galaxy.files.templates import ConfiguredFileSourceTemplates
+from galaxy.managers.file_source_instances import (
+    CreateInstancePayload,
+    FileSourceInstancesManager,
+    UpdateInstancePayload,
+    UpdateInstanceSecretPayload,
+    USER_FILE_SOURCES_SCHEME,
+    UserDefinedFileSourcesConfig,
+    UserDefinedFileSourcesImpl,
+    UserFileSourceModel,
+)
+from galaxy.util.config_templates import RawTemplateConfig
+from .base import BaseTestCase
+
+SIMPLE_FILE_SOURCE_NAME = "myfilesource"
+SIMPLE_FILE_SOURCE_DESCRIPTION = "a description of my file source"
+
+
+class Config:
+    file_source_templates: Optional[List[RawTemplateConfig]] = None
+    file_source_templates_config_file: Optional[str] = None
+
+    def __init__(self, templates: List[RawTemplateConfig]):
+        self.file_source_templates = templates
+
+
+def home_directory_template(tmp_path):
+    return {
+        "id": "home_directory",
+        "name": "Home Directory",
+        "description": "Your Home Directory on this System",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ user.username }}"),
+            "writable": True,
+        },
+    }
+
+
+def secret_directory_template(tmp_path):
+    return {
+        "id": "admin_secret_directory",
+        "name": "Secret Directory",
+        "description": "An directory constructed from admin secrets.",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ environment.var }}/{{ environment.sec }}"),
+            "writable": True,
+        },
+        "environment": {
+            "var": {
+                "type": "variable",
+                "variable": "GX_UNIT_TEST_SECRET_HOME_VAR",
+            },
+            "sec": {
+                "type": "secret",
+                "vault_key": "secret_directory_file_source/my_secret",
+            },
+        },
+    }
+
+
+def secret_directory_template_with_defaults(tmp_path):
+    return {
+        "id": "admin_secret_directory",
+        "name": "Secret Directory",
+        "description": "An directory constructed from admin secrets.",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ environment.var }}/{{ environment.sec }}"),
+            "writable": True,
+        },
+        "environment": {
+            "var": {
+                "type": "variable",
+                "variable": "GX_UNIT_TEST_SECRET_HOME_VAR_2",
+                "default": "fine_default_var",
+            },
+            "sec": {
+                "type": "secret",
+                "vault_key": "secret_directory_file_source/my_secret_2",
+                "default": "fine_default_sec",
+            },
+        },
+    }
+
+
+def simple_variable_template(tmp_path):
+    return {
+        "id": "simple_variable",
+        "name": "Simple Variable Driven Example",
+        "description": "This is a simple description",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ user.username }}/{{ variables.var1 }}"),
+        },
+        "variables": {
+            "var1": {
+                "type": "string",
+                "help": "This is some simple help.",
+            },
+        },
+    }
+
+
+def simple_vault_template(tmp_path):
+    return {
+        "id": "simple_vault",
+        "name": "Simple Vault",
+        "description": "This is a simple description",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ user.username }}/{{ secrets.sec1 }}"),
+        },
+        "secrets": {
+            "sec1": {
+                "help": "This is some simple help.",
+            },
+        },
+    }
+
+
+SIMPLE_VAULT_CREATE_PAYLOAD = CreateInstancePayload(
+    name=SIMPLE_FILE_SOURCE_NAME,
+    description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+    template_id="simple_vault",
+    template_version=0,
+    variables={},
+    secrets={"sec1": "foosec"},
+)
+
+
+class TestFileSourcesTestCase(BaseTestCase):
+    manager: FileSourceInstancesManager
+    file_sources: UserDefinedFileSourcesImpl
+
+    def test_create_posix(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        assert match.score == len(uri_root)
+        file_source = match.file_source
+        assert file_source
+        assert file_source.label == SIMPLE_FILE_SOURCE_NAME
+        assert file_source.doc == SIMPLE_FILE_SOURCE_DESCRIPTION
+        assert file_source.get_scheme() == USER_FILE_SOURCES_SCHEME
+        assert file_source.get_uri_root() == uri_root
+
+    def test_io(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        target = tmp_path / "round_trip"
+        file_source.realize_to("/moo", target)
+        assert target.read_text("utf-8") == "Moo Cow"
+
+    def test_to_dict_filters_hidden(self, tmp_path):
+        self.init_user_in_database()
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        assert user_file_source.uri_root in self._uri_roots()
+        hide = UpdateInstancePayload(hidden=True)
+        self.manager.modify_instance(self.trans, user_file_source.uuid, hide)
+
+    def test_find_best_match_not_filters_hidden(self, tmp_path):
+        self.init_user_in_database()
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        hide = UpdateInstancePayload(hidden=True)
+        self.manager.modify_instance(self.trans, user_file_source.uuid, hide)
+        match = self.file_sources.find_best_match(user_file_source.uri_root)
+        assert match
+
+    def test_find_best_match_filters_deactivated(self, tmp_path):
+        self.init_user_in_database()
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        hide = UpdateInstancePayload(active=False)
+        self.manager.modify_instance(self.trans, user_file_source.uuid, hide)
+        match = self.file_sources.find_best_match(user_file_source.uri_root)
+        assert not match
+
+    def _uri_roots(self) -> List[str]:
+        sources_as_dicts = self.file_sources.user_file_sources_to_dicts(
+            False,
+            cast(FileSourcesUserContext, self.trans),
+        )
+        return [s["uri_root"] for s in sources_as_dicts]
+
+    def test_environment_injection(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=secret_directory_template(tmp_path))
+
+        expected_target = tmp_path / "cool_var" / "cool_sec"
+        assert not expected_target.exists()
+
+        os.environ["GX_UNIT_TEST_SECRET_HOME_VAR"] = "cool_var"
+        self.app.vault.write_secret("secret_directory_file_source/my_secret", "cool_sec")
+
+        user_file_source = self._create_user_file_source("admin_secret_directory")
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        assert expected_target.exists()
+        assert (expected_target / "moo").exists()
+
+    def test_environment_defaults(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=secret_directory_template_with_defaults(tmp_path))
+
+        expected_target = tmp_path / "fine_default_var" / "fine_default_sec"
+        assert not expected_target.exists()
+
+        user_file_source = self._create_user_file_source("admin_secret_directory")
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        assert expected_target.exists()
+        assert (expected_target / "moo").exists()
+
+    def test_show(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed
+        assert user_file_source_showed.uuid == user_file_source.uuid
+        assert user_file_source_showed.id == user_file_source.id
+
+    def test_simple_update(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "originalvarval"},
+            secrets={},
+        )
+        user_file_source = self._create_instance(create_payload)
+        assert user_file_source.variables
+        assert user_file_source.variables["var1"] == "originalvarval"
+
+        update = UpdateInstancePayload(
+            variables={
+                "var1": "newval",
+            }
+        )
+
+        # assert response includes updated variable as well as a fresh show()
+        response = self.manager.modify_instance(self.trans, user_file_source.uuid, update)
+        assert response.variables
+        assert response.variables["var1"] == "newval"
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed.variables
+        assert user_file_source_showed.variables["var1"] == "newval"
+
+    def test_hide(self, tmp_path):
+        user_file_source = self._init_and_create_simple(tmp_path)
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert not user_file_source_showed.hidden
+
+        hide = UpdateInstancePayload(hidden=True)
+        self.manager.modify_instance(self.trans, user_file_source.uuid, hide)
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed.hidden
+
+    def test_deactivate(self, tmp_path):
+        user_file_source = self._init_and_create_simple(tmp_path)
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert not user_file_source_showed.hidden
+        assert user_file_source_showed.active
+        assert not user_file_source_showed.purged
+
+        deactivate = UpdateInstancePayload(active=False)
+        self.manager.modify_instance(self.trans, user_file_source.uuid, deactivate)
+
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed.hidden
+        assert not user_file_source_showed.active
+        assert not user_file_source_showed.purged
+
+    def test_purge(self, tmp_path):
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        user_file_source = self._create_instance(SIMPLE_VAULT_CREATE_PAYLOAD)
+        assert "sec1" in user_file_source.secrets
+        user_vault = self.trans.user_vault
+        config_secret_key = f"file_source_config/{user_file_source.uuid}/sec1"
+        assert user_vault.read_secret(config_secret_key) == "foosec"
+        self.manager.purge_instance(self.trans, user_file_source.uuid)
+        # delete resets it to ''
+        assert user_vault.read_secret(config_secret_key) == ""
+
+    def test_update_secret(self, tmp_path):
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        user_file_source = self._create_instance(SIMPLE_VAULT_CREATE_PAYLOAD)
+        user_vault = self.trans.user_vault
+        config_secret_key = f"file_source_config/{user_file_source.uuid}/sec1"
+        assert user_vault.read_secret(config_secret_key) == "foosec"
+        update = UpdateInstanceSecretPayload(secret_name="sec1", secret_value="newvalue")
+        self.manager.modify_instance(self.trans, user_file_source.uuid, update)
+        assert user_vault.read_secret(config_secret_key) == "newvalue"
+
+    def _init_and_create_simple(self, tmp_path) -> UserFileSourceModel:
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        return user_file_source
+
+    def _create_user_file_source(self, template_id="home_directory") -> UserFileSourceModel:
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id=template_id,
+            template_version=0,
+            variables={},
+            secrets={},
+        )
+        return self._create_instance(create_payload)
+
+    def _create_instance(self, create_payload: CreateInstancePayload) -> UserFileSourceModel:
+        user_file_source = self.manager.create_instance(self.trans, create_payload)
+        return user_file_source
+
+    def _init_managers(self, tmp_path, config_dict=None):
+        file_sources_config = UserDefinedFileSourcesConfig(
+            user_config_templates_index_by="uuid",
+            user_config_templates_use_saved_configuration="fallback",
+        )
+        self.app[UserDefinedFileSourcesConfig] = file_sources_config
+        self.app.setup_test_vault()
+        if config_dict is None:
+            config_dict = home_directory_template(tmp_path)
+        templates_config = Config([config_dict])
+        templates = ConfiguredFileSourceTemplates.from_app_config(
+            templates_config,
+            vault_configured=True,
+        )
+        self.app[ConfiguredFileSourceTemplates] = templates
+        file_sources = self.app[UserDefinedFileSourcesImpl]
+        manager = self.app[FileSourceInstancesManager]
+        self.file_sources = file_sources
+        self.manager = manager
diff --git a/test/unit/app/managers/test_user_object_stores.py b/test/unit/app/managers/test_user_object_stores.py
new file mode 100644
index 00000000000..af980392382
--- /dev/null
+++ b/test/unit/app/managers/test_user_object_stores.py
@@ -0,0 +1,364 @@
+from typing import (
+    List,
+    Optional,
+    Type,
+)
+
+from yaml import safe_load
+
+from galaxy.exceptions import (
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.managers.object_store_instances import (
+    CreateInstancePayload,
+    ModifyInstancePayload,
+    ObjectStoreInstancesManager,
+    UpdateInstancePayload,
+    UpdateInstanceSecretPayload,
+    UpgradeInstancePayload,
+    UserConcreteObjectStoreModel,
+)
+from galaxy.objectstore import UserObjectStoresAppConfig
+from galaxy.objectstore.templates import ConfiguredObjectStoreTemplates
+from galaxy.objectstore.templates.examples import get_example
+from galaxy.objectstore.unittest_utils import app_config
+from galaxy.util.config_templates import RawTemplateConfig
+from .base import BaseTestCase
+
+SIMPLE_FILE_SOURCE_NAME = "myobjectstore"
+SIMPLE_FILE_SOURCE_DESCRIPTION = "a description of my object store"
+
+
+class Config:
+    object_store_templates: Optional[List[RawTemplateConfig]] = None
+    object_store_templates_config_file: Optional[str] = None
+
+    def __init__(self, templates: List[RawTemplateConfig]):
+        self.object_store_templates = templates
+
+
+def simple_vault_template(tmp_path):
+    return {
+        "id": "simple_vault",
+        "name": "Simple Vault",
+        "description": "This is a simple description",
+        "configuration": {
+            "type": "disk",
+            "files_dir": str(tmp_path / "{{ user.username }}/{{ secrets.sec1 }}"),
+        },
+        "secrets": {
+            "sec1": {
+                "help": "This is some simple help.",
+            },
+        },
+    }
+
+
+SIMPLE_VAULT_CREATE_PAYLOAD = CreateInstancePayload(
+    name=SIMPLE_FILE_SOURCE_NAME,
+    description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+    template_id="simple_vault",
+    template_version=0,
+    variables={},
+    secrets={"sec1": "foosec"},
+)
+
+
+def simple_variable_template(tmp_path):
+    return {
+        "id": "simple_variable",
+        "name": "Simple Variable",
+        "description": "This is a simple description",
+        "configuration": {
+            "type": "disk",
+            "files_dir": str(tmp_path / "{{ user.username }}/{{ variables.var1 }}"),
+        },
+        "variables": {
+            "var1": {
+                "type": "path_component",
+                "help": "This is some simple help.",
+            },
+        },
+    }
+
+
+UPGRADE_EXAMPLE = get_example("testing_multi_version_with_secrets.yml")
+UPGRADE_INITIAL_PAYLOAD = CreateInstancePayload(
+    name="My Upgradable Disk",
+    template_id="secure_disk",
+    template_version=0,
+    secrets={
+        "sec1": "moocow",
+    },
+    variables={},
+)
+
+
+class TestUserObjectStoreTestCase(BaseTestCase):
+    manager: ObjectStoreInstancesManager
+
+    def test_show(self, tmp_path):
+        user_object_store = self._init_and_create_simple(tmp_path)
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert user_object_store_showed
+        assert user_object_store_showed.uuid == user_object_store.uuid
+        assert user_object_store_showed.id == user_object_store.id
+
+    def test_simple_update(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "originalvarval"},
+            secrets={},
+        )
+        user_object_store = self._create_instance(create_payload)
+        assert user_object_store.variables
+        assert user_object_store.variables["var1"] == "originalvarval"
+
+        update = UpdateInstancePayload(
+            variables={
+                "var1": "newval",
+            }
+        )
+
+        # assert response includes updated variable as well as a fresh show()
+        response = self._modify(user_object_store, update)
+        assert response.variables
+        assert response.variables["var1"] == "newval"
+
+        user_file_source_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert user_file_source_showed.variables
+        assert user_file_source_showed.variables["var1"] == "newval"
+
+    def test_update_errors_on_extra_variables(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "originalvarval"},
+            secrets={},
+        )
+        user_object_store = self._create_instance(create_payload)
+        update = UpdateInstancePayload(
+            variables={
+                "var1": "newval",
+                "extra_var": "ghostval",
+            }
+        )
+        self._assert_modify_throws_exception(user_object_store, update, RequestParameterInvalidException)
+
+    def test_update_errors_on_invalid_variable_type(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=simple_variable_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_variable",
+            template_version=0,
+            variables={"var1": "originalvarval"},
+            secrets={},
+        )
+        user_object_store = self._create_instance(create_payload)
+        update = UpdateInstancePayload(
+            variables={
+                "var1": 13,
+            }
+        )
+
+        self._assert_modify_throws_exception(user_object_store, update, RequestParameterInvalidException)
+
+    def test_hide(self, tmp_path):
+        user_object_store = self._init_and_create_simple(tmp_path)
+
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert not user_object_store_showed.hidden
+
+        hide = UpdateInstancePayload(hidden=True)
+        self._modify(user_object_store, hide)
+
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert user_object_store_showed.hidden
+
+    def test_deactivate(self, tmp_path):
+        user_object_store = self._init_and_create_simple(tmp_path)
+
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert not user_object_store_showed.hidden
+        assert user_object_store_showed.active
+        assert not user_object_store_showed.purged
+
+        deactivate = UpdateInstancePayload(active=False)
+        self._modify(user_object_store, deactivate)
+
+        user_object_store_showed = self.manager.show(self.trans, user_object_store.uuid)
+        assert user_object_store_showed.hidden
+        assert not user_object_store_showed.active
+        assert not user_object_store_showed.purged
+
+    def test_purge(self, tmp_path):
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        user_object_store = self._create_instance(SIMPLE_VAULT_CREATE_PAYLOAD)
+        self._assert_secret_is(user_object_store, "sec1", "foosec")
+        self.manager.purge_instance(self.trans, user_object_store.uuid)
+        self._assert_secret_absent(user_object_store, "sec1")
+
+    def test_update_secret(self, tmp_path):
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        user_object_store = self._create_instance(SIMPLE_VAULT_CREATE_PAYLOAD)
+        self._assert_secret_is(user_object_store, "sec1", "foosec")
+        update = UpdateInstanceSecretPayload(secret_name="sec1", secret_value="newvalue")
+        self._modify(user_object_store, update)
+        self._assert_secret_is(user_object_store, "sec1", "newvalue")
+
+    def test_cannot_update_invalid_secret(self, tmp_path):
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        user_object_store = self._create_instance(SIMPLE_VAULT_CREATE_PAYLOAD)
+        update = UpdateInstanceSecretPayload(secret_name="undefinedsec", secret_value="newvalue")
+        self._assert_modify_throws_exception(user_object_store, update, RequestParameterInvalidException)
+
+    def test_upgrade(self, tmp_path):
+        user_object_store = self._init_upgrade_test_case(tmp_path)
+        assert "sec1" in user_object_store.secrets
+        assert "sec2" not in user_object_store.secrets
+        self._assert_secret_is(user_object_store, "sec1", "moocow")
+        self._assert_secret_absent(user_object_store, "foobarxyz")
+        self._assert_secret_absent(user_object_store, "sec2")
+        upgrade_to_1 = UpgradeInstancePayload(
+            template_version=1,
+            secrets={
+                "sec1": "moocow",
+                "sec2": "aftersec2",
+            },
+            variables={},
+        )
+        user_object_store = self._modify(user_object_store, upgrade_to_1)
+        assert "sec1" in user_object_store.secrets
+        assert "sec2" in user_object_store.secrets
+        self._assert_secret_is(user_object_store, "sec1", "moocow")
+        self._assert_secret_is(user_object_store, "sec2", "aftersec2")
+        upgrade_to_2 = UpgradeInstancePayload(
+            template_version=2,
+            secrets={},
+            variables={},
+        )
+
+        user_object_store = self._modify(user_object_store, upgrade_to_2)
+        assert "sec1" not in user_object_store.secrets
+        assert "sec2" in user_object_store.secrets
+        self._assert_secret_absent(user_object_store, "sec1")
+        self._assert_secret_is(user_object_store, "sec2", "aftersec2")
+
+    def test_upgrade_does_not_allow_extra_variables(self, tmp_path):
+        user_object_store = self._init_upgrade_test_case(tmp_path)
+        upgrade_to_1 = UpgradeInstancePayload(
+            template_version=1,
+            variables={
+                "extra_variable": "moocow",
+            },
+            secrets={
+                "sec1": "moocow",
+                "sec2": "aftersec2",
+            },
+        )
+
+        self._assert_modify_throws_exception(user_object_store, upgrade_to_1, RequestParameterInvalidException)
+
+    def test_upgrade_does_not_allow_extra_secrets(self, tmp_path):
+        user_object_store = self._init_upgrade_test_case(tmp_path)
+        upgrade_to_1 = UpgradeInstancePayload(
+            template_version=1,
+            variables={},
+            secrets={
+                "sec1": "moocow",
+                "sec2": "aftersec2",
+                "extrasec": "moo345",
+            },
+        )
+
+        self._assert_modify_throws_exception(user_object_store, upgrade_to_1, RequestParameterInvalidException)
+
+    def test_upgrade_fails_if_new_secrets_absent(self, tmp_path):
+        user_object_store = self._init_upgrade_test_case(tmp_path)
+        upgrade_to_1 = UpgradeInstancePayload(
+            template_version=1,
+            variables={},
+            secrets={
+                "sec1": "moocow",
+            },
+        )
+
+        self._assert_modify_throws_exception(user_object_store, upgrade_to_1, RequestParameterMissingException)
+
+    def _init_upgrade_test_case(self, tmp_path) -> UserConcreteObjectStoreModel:
+        example_yaml_str = UPGRADE_EXAMPLE
+        example_yaml_str.replace("/data", str(tmp_path))
+        config = safe_load(example_yaml_str)
+        self._init_managers(tmp_path, config)
+        user_object_store = self._create_instance(UPGRADE_INITIAL_PAYLOAD)
+        return user_object_store
+
+    def _read_secret(self, user_object_store: UserConcreteObjectStoreModel, secret_name: str) -> str:
+        user_vault = self.trans.user_vault
+        config_secret_key = f"object_store_config/{user_object_store.uuid}/{secret_name}"
+        return user_vault.read_secret(config_secret_key)
+
+    def _assert_secret_is(self, user_object_store: UserConcreteObjectStoreModel, secret_name: str, expected_value: str):
+        assert self._read_secret(user_object_store, secret_name) == expected_value
+
+    def _assert_secret_absent(self, user_object_store: UserConcreteObjectStoreModel, secret_name: str):
+        sec_val = self._read_secret(user_object_store, secret_name)
+        # deleting vs never inserted...
+        assert sec_val in ["", None]
+
+    def _init_and_create_simple(self, tmp_path) -> UserConcreteObjectStoreModel:
+        self._init_managers(tmp_path, simple_vault_template(tmp_path))
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id="simple_vault",
+            template_version=0,
+            variables={},
+            secrets={"sec1": "foosec"},
+        )
+        user_object_store = self._create_instance(create_payload)
+        return user_object_store
+
+    def _init_managers(self, tmp_path, config_dict=None):
+        object_stores_config = app_config(tmp_path)
+        self.app[UserObjectStoresAppConfig] = object_stores_config
+        self.app.setup_test_vault()
+        if isinstance(config_dict, dict):
+            templates_config = Config([config_dict])
+        else:
+            templates_config = Config(config_dict)
+        templates = ConfiguredObjectStoreTemplates.from_app_config(
+            templates_config,
+            vault_configured=True,
+        )
+        self.app[ConfiguredObjectStoreTemplates] = templates
+        manager = self.app[ObjectStoreInstancesManager]
+        self.manager = manager
+
+    def _assert_modify_throws_exception(
+        self, user_object_store: UserConcreteObjectStoreModel, modify: ModifyInstancePayload, exception_type: Type
+    ):
+        exception_thrown = False
+        try:
+            self._modify(user_object_store, modify)
+        except exception_type:
+            exception_thrown = True
+        assert exception_thrown
+
+    def _modify(
+        self, user_object_store: UserConcreteObjectStoreModel, modify: ModifyInstancePayload
+    ) -> UserConcreteObjectStoreModel:
+        return self.manager.modify_instance(self.trans, user_object_store.uuid, modify)
+
+    def _create_instance(self, create_payload: CreateInstancePayload) -> UserConcreteObjectStoreModel:
+        user_object_store = self.manager.create_instance(self.trans, create_payload)
+        return user_object_store
diff --git a/test/unit/files/_util.py b/test/unit/files/_util.py
index 8354c17ecd8..61fe070e870 100644
--- a/test/unit/files/_util.py
+++ b/test/unit/files/_util.py
@@ -5,6 +5,7 @@ import tempfile
 
 from galaxy.files import (
     ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
     DictFileSourcesUserContext,
     OptionalUserContext,
 )
@@ -158,10 +159,10 @@ def write_from(
 def configured_file_sources(conf_file):
     file_sources_config = FileSourcePluginsConfig()
     if isinstance(conf_file, str):
-        conf = ConfiguredFileSources(file_sources_config, conf_file=conf_file)
+        conf = ConfiguredFileSourcesConf(conf_file=conf_file)
     else:
-        conf = ConfiguredFileSources(file_sources_config, conf_dict=conf_file)
-    return conf
+        conf = ConfiguredFileSourcesConf(conf_dict=conf_file)
+    return ConfiguredFileSources(file_sources_config, conf)
 
 
 def assert_can_write_and_read_to_conf(conf: dict):
diff --git a/test/unit/files/test_azure.py b/test/unit/files/test_azure.py
index 1b6e263c4f8..26a9057a51c 100644
--- a/test/unit/files/test_azure.py
+++ b/test/unit/files/test_azure.py
@@ -19,7 +19,7 @@ def test_azure():
         "container_name": os.environ["GALAXY_TEST_AZURE_CONTAINER_NAME"],
         "account_key": os.environ["GALAXY_TEST_AZURE_ACCOUNT_KEY"],
         "account_name": os.environ["GALAXY_TEST_AZURE_ACCOUNT_NAME"],
-        "namespace_type": os.environ.get("GALAXY_TEST_AZURE_NAMESPACE_TYPE", "flat"),
+        "namespace_type": os.environ.get("GALAXY_TEST_AZURE_NAMESPACE_TYPE", "hierarchal"),
         "writable": True,
     }
     assert_can_write_and_read_to_conf(conf)
diff --git a/test/unit/files/test_posix.py b/test/unit/files/test_posix.py
index f64322db082..a5749500c59 100644
--- a/test/unit/files/test_posix.py
+++ b/test/unit/files/test_posix.py
@@ -12,7 +12,10 @@ from galaxy.exceptions import (
     ItemAccessibilityException,
     RequestParameterInvalidException,
 )
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+)
 from galaxy.files.plugins import FileSourcePluginsConfig
 from galaxy.files.unittest_utils import (
     setup_root,
@@ -159,7 +162,7 @@ def test_user_ftp_explicit_config():
         "type": "gxftp",
     }
     tmp, root = setup_root()
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[plugin])
+    file_sources = ConfiguredFileSources(file_sources_config, ConfiguredFileSourcesConf(conf_dict=[plugin]))
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
 
@@ -181,7 +184,9 @@ def test_user_ftp_implicit_config():
         ftp_upload_dir=root,
         ftp_upload_purge=False,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert os.path.exists(os.path.join(root, "a"))
@@ -199,7 +204,9 @@ def test_user_ftp_respects_upload_purge_off():
         ftp_upload_dir=root,
         ftp_upload_purge=True,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert_realizes_as(file_sources, "gxftp://a", "a\n", user_context=user_context)
@@ -211,7 +218,9 @@ def test_user_ftp_respects_upload_purge_on_by_default():
     file_sources_config = FileSourcePluginsConfig(
         ftp_upload_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert_realizes_as(file_sources, "gxftp://a", "a\n", user_context=user_context)
@@ -226,7 +235,7 @@ def test_import_dir_explicit_config():
     plugin = {
         "type": "gximport",
     }
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[plugin])
+    file_sources = ConfiguredFileSources(file_sources_config, ConfiguredFileSourcesConf(conf_dict=[plugin]))
     write_file_fixtures(tmp, root)
 
     assert_realizes_as(file_sources, "gximport://a", "a\n")
@@ -237,7 +246,9 @@ def test_import_dir_implicit_config():
     file_sources_config = FileSourcePluginsConfig(
         library_import_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     write_file_fixtures(tmp, root)
 
     assert_realizes_as(file_sources, "gximport://a", "a\n")
@@ -248,7 +259,9 @@ def test_user_import_dir_implicit_config():
     file_sources_config = FileSourcePluginsConfig(
         user_library_import_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
 
     write_file_fixtures(tmp, os.path.join(root, EMAIL))
 
diff --git a/test/unit/files/test_template_manager.py b/test/unit/files/test_template_manager.py
new file mode 100644
index 00000000000..5c89405b0c8
--- /dev/null
+++ b/test/unit/files/test_template_manager.py
@@ -0,0 +1,58 @@
+from galaxy.files.templates import ConfiguredFileSourceTemplates
+from .test_template_models import (
+    LIBRARY_AWS,
+    LIBRARY_HOME_DIRECTORY,
+)
+
+
+class MockConfig:
+    def __init__(self, config_path):
+        self.file_source_templates = None
+        self.file_source_templates_config_file = config_path
+
+
+def test_manager(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_HOME_DIRECTORY, "utf-8")
+    config = MockConfig(config_path)
+    templates = ConfiguredFileSourceTemplates.from_app_config(config)
+    summaries = templates.summaries
+    assert summaries
+    assert len(summaries.root) == 1
+
+
+def test_manager_throws_exception_if_vault_is_required_but_configured(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_AWS, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=False)
+    except Exception as e:
+        exc = e
+    assert exc, "catalog creation should result in an exception"
+    assert "vault must be configured" in str(exc)
+
+
+def test_manager_with_secrets_is_fine_if_vault_is_required_and_configured(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_AWS, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=True)
+    except Exception as e:
+        exc = e
+    assert exc is None
+
+
+def test_manager_does_not_throw_exception_if_vault_is_not_required(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_HOME_DIRECTORY, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=False)
+    except Exception as e:
+        exc = e
+    assert exc is None
diff --git a/test/unit/files/test_template_models.py b/test/unit/files/test_template_models.py
new file mode 100644
index 00000000000..7fced1b7f4b
--- /dev/null
+++ b/test/unit/files/test_template_models.py
@@ -0,0 +1,327 @@
+from yaml import safe_load
+
+from galaxy.files.templates.examples import get_example
+from galaxy.files.templates.manager import raw_config_to_catalog
+from galaxy.files.templates.models import (
+    FileSourceTemplate,
+    FileSourceTemplateCatalog,
+    FtpFileSourceConfiguration,
+    PosixFileSourceConfiguration,
+    S3FSFileSourceConfiguration,
+    template_to_configuration,
+)
+
+# API example server - all data is public and anyone can create keys and buckets
+GALAXY_TEST_PLAY_MINIO_KEY = "LEHFJDNqSA4xcJmmezU7"
+GALAXY_TEST_PLAY_MINIO_SECRET = "E3ycZrp2nV8WscER8HqgsPPL2aFc2uuTbRchelcX"
+GALAXY_TEST_PLAY_MINIO_BUCKET = "gxtest1"
+
+LIBRARY_AWS = """
+- id: aws_bucket
+  name: Amazon Bucket
+  description: An Amazon S3 Bucket
+  variables:
+    bucket_name:
+      type: string
+      help: Name of bucket to use when connecting to AWS resources.
+  secrets:
+    access_key:
+      help: AWS access key to use when connecting to AWS resources.
+    secret_key:
+      help: AWS secret key to use when connecting to AWS resources.
+  configuration:
+    type: s3fs
+    key: '{{ secrets.access_key}}'
+    secret: '{{ secrets.secret_key}}'
+    bucket: '{{ variables.bucket_name}}'
+"""
+
+
+def test_aws_s3_config():
+    template_library = _parse_template_library(LIBRARY_AWS)
+    s3_template = _assert_has_one_template(template_library)
+    assert s3_template.description == "An Amazon S3 Bucket"
+    configuration_obj = template_to_configuration(
+        s3_template,
+        {"bucket_name": "sec3"},
+        {"access_key": "sec1", "secret_key": "sec2"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, S3FSFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "s3fs"
+    assert configuration["key"] == "sec1"
+    assert configuration["secret"] == "sec2"
+    assert configuration["bucket"] == "sec3"
+
+
+LIBRARY_HOME_DIRECTORY = """
+- id: home_directory
+  name: Home Directory
+  description: Your Home Directory on this System
+  configuration:
+    type: posix
+    root: "/home/{{ user.username}}/"
+"""
+
+
+def test_a_posix_template():
+    template_library = _parse_template_library(LIBRARY_HOME_DIRECTORY)
+    posix_template = _assert_has_one_template(template_library)
+    assert posix_template.description == "Your Home Directory on this System"
+    configuration_obj = template_to_configuration(
+        posix_template,
+        {},
+        {},
+        user_details={"username": "foobar"},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, PosixFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "posix"
+    assert configuration["root"] == "/home/foobar/"
+
+
+LIBRARY_FTP = """
+- id: ftp
+  name: Generic FTP Server
+  description: Generic FTP configuration with all configuration options exposed.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of FTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+      default: false
+    port:
+      type: integer
+      help: Port used to connect to the FTP server.
+      default: 21
+  secrets:
+    password:
+      help: Password to connect to FTP server with.
+"""
+
+
+def test_ftp():
+    template_library = _parse_template_library(LIBRARY_FTP)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "port": 22, "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Not optional but it does specify a default so the configuration object does
+    assert configuration["port"] == 22
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+LIBRARY_FTP_NO_PORT = """
+- id: ftp_no_port
+  name: FTP (no port specified)
+  description: Generic FTP configuration with no port specified.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of FTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+  secrets:
+    password:
+      help: Password to connect to FTP server with.
+"""
+
+
+def test_ftp_no_port_template():
+    template_library = _parse_template_library(LIBRARY_FTP_NO_PORT)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Not optional but it does specify a default so the configuration object does
+    assert configuration["port"] == 21
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+LIBRARY_FTP_WITH_DEFAULT_SFTP_PORT = """
+- id: ftp
+  name: Generic SFTP Server
+  description: Generic SFTP configuration with all configuration options exposed.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of SFTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an SFTP server you have permission to write to?
+    port:
+      type: integer
+      help: Port used to connect to the SFTP server.
+      default: 22
+  secrets:
+    password:
+      help: Password to connect to SFTP server with.
+"""
+
+
+def test_ftp_default_to_sftp_port():
+    template_library = _parse_template_library(LIBRARY_FTP_WITH_DEFAULT_SFTP_PORT)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Using the template default for not supplied values
+    assert configuration["port"] == 22
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+def test_s3fs_endpoint_building():
+    s3fs_template = _get_example_template("s3fs_by_host_and_port.yml")
+    configuration_obj = template_to_configuration(
+        s3fs_template,
+        {
+            "host": "play.min.io",
+            "access_key": GALAXY_TEST_PLAY_MINIO_KEY,
+            "port": 9000,
+            "connection_path": "",
+            "secure": True,
+            "bucket": GALAXY_TEST_PLAY_MINIO_BUCKET,
+        },
+        {"secret_key": GALAXY_TEST_PLAY_MINIO_SECRET},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, S3FSFileSourceConfiguration)
+    assert configuration_obj.endpoint_url == "https://play.min.io:9000/"
+    assert configuration_obj.key == GALAXY_TEST_PLAY_MINIO_KEY
+    assert configuration_obj.secret == GALAXY_TEST_PLAY_MINIO_SECRET
+    assert configuration_obj.anon is False
+    assert configuration_obj.bucket == GALAXY_TEST_PLAY_MINIO_BUCKET
+
+
+def test_production_aws_public_bucket():
+    aws_public_bucket_template = _get_example_template("production_aws_public_bucket.yml")
+    configuration_obj = template_to_configuration(
+        aws_public_bucket_template,
+        {
+            "bucket": "encode-public",
+        },
+        {},
+        user_details={},
+        environment={},
+    )
+    assert isinstance(configuration_obj, S3FSFileSourceConfiguration)
+    assert configuration_obj.anon is True
+    assert configuration_obj.bucket == "encode-public"
+
+
+def test_examples_parse():
+    _assert_example_parses("production_ftp.yml")
+    _assert_example_parses("production_azure.yml")
+    _assert_example_parses("production_aws_private_bucket.yml")
+    _assert_example_parses("production_aws_public_bucket.yml")
+    _assert_example_parses("production_s3fs.yml")
+    _assert_example_parses("s3fs_by_host_and_port.yml")
+    _assert_example_parses("templating_override.yml")
+    _assert_example_parses("admin_secrets.yml")
+    _assert_example_parses("admin_secrets_with_defaults.yml")
+
+
+def _assert_example_parses(filename: str):
+    # just parsing it does the validation - using the assert function name for clarify
+    # though.
+    _get_example_library(filename)
+
+
+def _get_example_template(filename: str) -> FileSourceTemplate:
+    return _assert_has_one_template(_get_example_library(filename))
+
+
+def _get_example_library(filename: str) -> FileSourceTemplateCatalog:
+    as_str = get_example(filename)
+    return _parse_template_library(as_str)
+
+
+def _assert_has_one_template(catalog: FileSourceTemplateCatalog) -> FileSourceTemplate:
+    assert len(catalog.root) == 1
+    template = catalog.root[0]
+    return template
+
+
+def _parse_template_library(contents: str) -> FileSourceTemplateCatalog:
+    raw_contents = safe_load(contents)
+    return raw_config_to_catalog(raw_contents)
diff --git a/test/unit/objectstore/test_from_configuration_object.py b/test/unit/objectstore/test_from_configuration_object.py
index 3829bd64fd7..ccceb8f699c 100644
--- a/test/unit/objectstore/test_from_configuration_object.py
+++ b/test/unit/objectstore/test_from_configuration_object.py
@@ -1,8 +1,6 @@
-from galaxy.objectstore import (
-    concrete_object_store,
-    UserObjectStoresAppConfig,
-)
+from galaxy.objectstore import concrete_object_store
 from galaxy.objectstore.templates.models import DiskObjectStoreConfiguration
+from galaxy.objectstore.unittest_utils import app_config
 from .test_objectstore import MockDataset
 
 
@@ -32,15 +30,3 @@ def test_disk(tmpdir):
     object_store.create(example_dataset)
     object_store.update_from_file(example_dataset, file_name=str(temp_file))
     assert object_store.size(example_dataset) == 7
-
-
-def app_config(tmpdir) -> UserObjectStoresAppConfig:
-    app_config = UserObjectStoresAppConfig(
-        jobs_directory=str(tmpdir / "jobs"),
-        new_file_path=str(tmpdir / "new_files"),
-        umask=0o077,
-        object_store_cache_path=str(tmpdir / "cache"),
-        object_store_cache_size=1,
-        user_object_store_index_by="uuid",
-    )
-    return app_config
diff --git a/test/unit/objectstore/test_serializing_user_object_stores.py b/test/unit/objectstore/test_serializing_user_object_stores.py
index bddcbbd4704..fff04661521 100644
--- a/test/unit/objectstore/test_serializing_user_object_stores.py
+++ b/test/unit/objectstore/test_serializing_user_object_stores.py
@@ -8,8 +8,10 @@ from galaxy.objectstore.templates.models import (
     DiskObjectStoreConfiguration,
     ObjectStoreConfiguration,
 )
-from galaxy.objectstore.unittest_utils import Config
-from .test_from_configuration_object import app_config
+from galaxy.objectstore.unittest_utils import (
+    app_config,
+    Config,
+)
 from .test_objectstore import MockDataset
 
 DISTRIBUTED_TEST_CONFIG_YAML = """
diff --git a/test/unit/objectstore/test_template_models.py b/test/unit/objectstore/test_template_models.py
index 505f9b3e8d9..81f0bce8068 100644
--- a/test/unit/objectstore/test_template_models.py
+++ b/test/unit/objectstore/test_template_models.py
@@ -1,14 +1,18 @@
+import os
+
 from yaml import safe_load
 
+from galaxy.objectstore.templates.examples import get_example
 from galaxy.objectstore.templates.manager import raw_config_to_catalog
 from galaxy.objectstore.templates.models import (
+    AwsS3ObjectStoreConfiguration,
     AzureObjectStoreConfiguration,
     DiskObjectStoreConfiguration,
     GenericS3ObjectStoreConfiguration,
     ObjectStoreTemplateCatalog,
-    S3ObjectStoreConfiguration,
     template_to_configuration,
 )
+from galaxy.util.config_templates import VariablesDict
 
 LIBRARY_1 = """
 - id: amazon_bucket
@@ -26,7 +30,7 @@ LIBRARY_1 = """
     bucket_name:
       help: Name of bucket to use when connecting to AWS resources.
   configuration:
-    type: s3
+    type: aws_s3
     auth:
         access_key: '{{ secrets.access_key}}'
         secret_key: '{{ secrets.secret_key}}'
@@ -50,16 +54,17 @@ def test_parsing_simple_s3():
         {"use_reduced_redundancy": False},
         {"access_key": "sec1", "secret_key": "sec2", "bucket_name": "sec3"},
         user_details={},
+        environment={},
     )
     badges = s3_template.configuration.badges
     assert badges
     assert len(badges) == 3
 
     # expanded configuration should validate with template expansions...
-    assert isinstance(configuration_obj, S3ObjectStoreConfiguration)
+    assert isinstance(configuration_obj, AwsS3ObjectStoreConfiguration)
     configuration = configuration_obj.model_dump()
 
-    assert configuration["type"] == "s3"
+    assert configuration["type"] == "aws_s3"
     assert configuration["auth"]["access_key"] == "sec1"
     assert configuration["auth"]["secret_key"] == "sec2"
     assert configuration["bucket"]["name"] == "sec3"
@@ -110,6 +115,7 @@ def test_parsing_generic_s3():
         {"use_reduced_redundancy": False},
         {"access_key": "sec1", "secret_key": "sec2", "bucket_name": "sec3"},
         user_details={},
+        environment={},
     )
     badges = s3_template.configuration.badges
     assert badges
@@ -157,15 +163,91 @@ def test_parsing_multiple_posix():
     assert secure_template.version == 0
     assert secure_template.hidden is False
 
-    general_configuration = template_to_configuration(general_template, {}, {}, user_details={"username": "jane"})
+    general_configuration = template_to_configuration(
+        general_template, {}, {}, user_details={"username": "jane"}, environment={}
+    )
     assert isinstance(general_configuration, DiskObjectStoreConfiguration)
     assert general_configuration.files_dir == "/data/general/jane"
 
-    secure_configuration = template_to_configuration(secure_template, {}, {}, user_details={"username": "jane"})
+    secure_configuration = template_to_configuration(
+        secure_template, {}, {}, user_details={"username": "jane"}, environment={}
+    )
     assert isinstance(secure_configuration, DiskObjectStoreConfiguration)
     assert secure_configuration.files_dir == "/data/secure/jane"
 
 
+LIBRARY_WITH_PATH_PARAMETER = """
+- id: path_disk
+  name: General Disk
+  description: General Disk Bound to You
+  configuration:
+    type: disk
+    files_dir: '/data/general/{{ user.username | ensure_path_component }}//{{ variables.project_name | ensure_path_component }}'
+  variables:
+    project_name:
+      type: string  # dont do this in practice - use path_component for more eager validation
+      help: Project name used in path for this template library.
+"""
+
+
+def test_parsing_with_path_security():
+    template_library = _parse_template_library(LIBRARY_WITH_PATH_PARAMETER)
+    assert len(template_library.root) == 1
+    path_template = template_library.root[0]
+
+    assert path_template.version == 0
+
+    user_details = {"username": "jane"}
+    variables: VariablesDict = {"project_name": "moo"}
+
+    general_configuration = template_to_configuration(
+        path_template, variables, {}, user_details=user_details, environment={}
+    )
+    assert isinstance(general_configuration, DiskObjectStoreConfiguration)
+    assert os.path.abspath(general_configuration.files_dir) == "/data/general/jane/moo"
+
+    variables = {"project_name": "../moo"}
+    exc = None
+    try:
+        template_to_configuration(path_template, variables, {}, user_details=user_details, environment={})
+    except Exception as e:
+        exc = e
+    assert exc is not None
+
+
+LIBRARY_WITH_CUSTOM_TEMPLATE_START_END = """
+- id: path_disk
+  name: General Disk
+  description: General Disk Bound to You
+  configuration:
+    type: disk
+    files_dir: '/data/general/@= user.username | ensure_path_component =@/@= variables.project_name | ensure_path_component =@'
+    template_start: '@='
+    template_end: '=@'
+  variables:
+    project_name:
+      type: string  # dont do this in practice - use path_component for more eager validation
+      help: Project name used in path for this template library.
+"""
+
+
+def test_custom_template_start_and_ends():
+    template_library = _parse_template_library(LIBRARY_WITH_CUSTOM_TEMPLATE_START_END)
+    assert len(template_library.root) == 1
+    path_template = template_library.root[0]
+
+    assert path_template.version == 0
+
+    user_details = {"username": "jane"}
+    variables: VariablesDict = {"project_name": "moo"}
+
+    general_configuration = template_to_configuration(
+        path_template, variables, {}, user_details=user_details, environment={}
+    )
+    assert isinstance(general_configuration, DiskObjectStoreConfiguration)
+    assert os.path.abspath(general_configuration.files_dir) == "/data/general/jane/moo"
+
+
 LIBRARY_AZURE_CONTAINER = """
 - id: amazon_bucket
   name: Azure Container
@@ -199,6 +281,7 @@ def test_parsing_azure():
         {"account_name": "galaxyproject"},
         {"account_key": "sec1", "container_name": "sec2"},
         user_details={},
+        environment={},
     )
     assert isinstance(configuration_obj, AzureObjectStoreConfiguration)
     assert configuration_obj.auth.account_name == "galaxyproject"
@@ -206,6 +289,52 @@ def test_parsing_azure():
     assert configuration_obj.container.name == "sec2"
 
 
+def test_minio_example_boolean():
+    template_library = _parse_template_library(get_example("minio_example.yml"))
+    assert len(template_library.root) == 1
+    minio_template = template_library.root[0]
+    configuration_obj = template_to_configuration(
+        minio_template,
+        {"access_key": "galaxyproject", "bucket": "galaxy"},
+        {"secret_key": "sec1"},
+        user_details={},
+        environment={"host": "localhost", "port": "9000", "secure": "1", "connection_path": "moo/cow"},
+    )
+    assert isinstance(configuration_obj, GenericS3ObjectStoreConfiguration)
+    assert configuration_obj.connection.is_secure
+
+    configuration_obj = template_to_configuration(
+        minio_template,
+        {"access_key": "galaxyproject", "bucket": "galaxy"},
+        {"secret_key": "sec1"},
+        user_details={},
+        environment={"host": "localhost", "port": "9000", "secure": "no", "connection_path": "moo/cow"},
+    )
+    assert isinstance(configuration_obj, GenericS3ObjectStoreConfiguration)
+    assert not configuration_obj.connection.is_secure
+
+
+def test_examples_parse():
+    assert_example_parses("simple_example.yml")
+    assert_example_parses("minio_example.yml")
+    assert_example_parses("production_generic_s3_legacy.yml")
+    assert_example_parses("production_generic_s3.yml")
+    assert_example_parses("production_aws_s3.yml")
+    assert_example_parses("production_aws_s3_legacy.yml")
+    assert_example_parses("production_azure_blob.yml")
+    assert_example_parses("cloudflare.yml")
+    assert_example_parses("cloudflare_legacy.yml")
+    assert_example_parses("minio_just_buckets.yml")
+    assert_example_parses("minio_just_buckets_legacy.yml")
+    assert_example_parses("azure_just_container.yml")
+    assert_example_parses("production_gcp_s3.yml")
+
+
+def assert_example_parses(filename: str):
+    as_str = get_example(filename)
+    _parse_template_library(as_str)
+
+
 def _parse_template_library(contents: str) -> ObjectStoreTemplateCatalog:
     raw_contents = safe_load(contents)
     return raw_config_to_catalog(raw_contents)
diff --git a/test/unit/util/test_config_template_validation.py b/test/unit/util/test_config_template_validation.py
new file mode 100644
index 00000000000..dd388068e9e
--- /dev/null
+++ b/test/unit/util/test_config_template_validation.py
@@ -0,0 +1,179 @@
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+)
+
+from galaxy.exceptions import (
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.util.config_templates import (
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableBoolean,
+    TemplateVariableInteger,
+    TemplateVariablePathComponent,
+    TemplateVariableString,
+    validate_secrets_and_variables,
+)
+
+TEST_TEMPLATE_ID = "test_id"
+TEST_TEMPLATE_VERSION = 0
+
+
+class TestTemplate(StrictModel):
+    id: str
+    version: int
+    variables: Optional[List[TemplateVariable]]
+    secrets: Optional[List[TemplateSecret]]
+    environment: Optional[List[TemplateEnvironmentEntry]]
+
+
+def _template_with_variable(variable: TemplateVariable) -> TestTemplate:
+    return TestTemplate(
+        id=TEST_TEMPLATE_ID,
+        version=TEST_TEMPLATE_VERSION,
+        variables=[variable],
+        secrets=None,
+        environment=None,
+    )
+
+
+def _template_with_secret(name: str) -> TestTemplate:
+    secret = TemplateSecret(name=name, help="Help for secret.")
+    return TestTemplate(
+        id=TEST_TEMPLATE_ID,
+        version=TEST_TEMPLATE_VERSION,
+        variables=[],
+        secrets=[secret],
+        environment=None,
+    )
+
+
+class TestInstanceDefinition(StrictModel):
+    template_id: str
+    template_version: int
+    variables: Dict[str, Any]
+    secrets: Dict[str, str]
+
+
+def _test_instance_with_variables(variables: Dict[str, Any]) -> TestInstanceDefinition:
+    return TestInstanceDefinition(
+        template_id=TEST_TEMPLATE_ID,
+        template_version=TEST_TEMPLATE_VERSION,
+        variables=variables,
+        secrets={},
+    )
+
+
+def _test_instance_with_secrets(secrets: Dict[str, str]) -> TestInstanceDefinition:
+    return TestInstanceDefinition(
+        template_id=TEST_TEMPLATE_ID,
+        template_version=TEST_TEMPLATE_VERSION,
+        variables={},
+        secrets=secrets,
+    )
+
+
+def test_variable_typing_string():
+    template = _template_with_variable(TemplateVariableString(name="test_var", help=None, type="string"))
+    instance = _test_instance_with_variables({"test_var": "moocow"})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 5})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_boolean():
+    template = _template_with_variable(TemplateVariableBoolean(name="test_var", help=None, type="boolean"))
+    instance = _test_instance_with_variables({"test_var": False})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 0})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "false"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_int():
+    template = _template_with_variable(TemplateVariableInteger(name="test_var", help=None, type="integer"))
+    instance = _test_instance_with_variables({"test_var": 6})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "six"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_path_component():
+    template = _template_with_variable(TemplateVariablePathComponent(name="test_var", help=None, type="path_component"))
+    instance = _test_instance_with_variables({"test_var": "simple_directory"})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 0})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "../simple_directory"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "/simple_directory"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "simple_directory", "extra": "4"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_missing():
+    template = _template_with_variable(TemplateVariablePathComponent(name="test_var", help=None, type="path_component"))
+    instance = _test_instance_with_variables({})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterMissingException)
+
+
+def test_secret_missing():
+    template = _template_with_secret("mysecret")
+    instance = _test_instance_with_secrets({})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterMissingException)
+
+
+def test_extra_secret():
+    template = _template_with_secret("mysecret")
+    instance = _test_instance_with_secrets({"mysecret": "myvalue"})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_secrets({"mysecret": "myvalue", "extrasecret": "extravalue"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def assert_validation_throws(instance: TestInstanceDefinition, template: TestTemplate) -> Exception:
+    try:
+        validate_secrets_and_variables(instance, template)
+    except Exception as e:
+        return e
+    raise AssertionError("Expected validation error did not occur.")