diff --git a/client/src/api/configTemplates.ts b/client/src/api/configTemplates.ts
new file mode 100644
index 000000000000..5ca51cf7e2ee
--- /dev/null
+++ b/client/src/api/configTemplates.ts
@@ -0,0 +1,25 @@
+import type { components } from "@/api/schema/schema";
+
+export type Instance =
+    | components["schemas"]["UserFileSourceModel"]
+    | components["schemas"]["UserConcreteObjectStoreModel"];
+
+export type TemplateVariable =
+    | components["schemas"]["TemplateVariableString"]
+    | components["schemas"]["TemplateVariableInteger"]
+    | components["schemas"]["TemplateVariablePathComponent"]
+    | components["schemas"]["TemplateVariableBoolean"];
+export type TemplateSecret = components["schemas"]["TemplateSecret"];
+export type VariableValueType = (string | boolean | number) | undefined;
+export type VariableData = { [key: string]: VariableValueType };
+export type SecretData = { [key: string]: string };
+
+export interface TemplateSummary {
+    description: string | null;
+    hidden?: boolean;
+    id: string;
+    name: string | null;
+    secrets?: TemplateSecret[] | null;
+    variables?: TemplateVariable[] | null;
+    version?: number;
+}
diff --git a/client/src/api/fileSources.ts b/client/src/api/fileSources.ts
new file mode 100644
index 000000000000..68935db4573f
--- /dev/null
+++ b/client/src/api/fileSources.ts
@@ -0,0 +1,6 @@
+import { type components } from "@/api/schema";
+
+export type FileSourceTemplateSummary = components["schemas"]["FileSourceTemplateSummary"];
+export type FileSourceTemplateSummaries = FileSourceTemplateSummary[];
+
+export type UserFileSourceModel = components["schemas"]["UserFileSourceModel"];
diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 330d362ff387..8332283069d2 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -318,6 +318,22 @@ export interface paths {
         /** Download */
         get: operations["download_api_drs_download__object_id__get"];
     };
+    "/api/file_source_instances": {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        get: operations["file_sources__instances_index"];
+        /** Create a user-bound object store. */
+        post: operations["file_sources__create_instance"];
+    };
+    "/api/file_source_instances/{user_file_source_id}": {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        get: operations["file_sources__instances_get"];
+        /** Update or upgrade user file source instance. */
+        put: operations["file_sources__instances_update"];
+    };
+    "/api/file_source_templates": {
+        /** Get a list of file source templates available to build user defined file sources from */
+        get: operations["file_sources__templates_index"];
+    };
     "/api/folders/{folder_id}/contents": {
         /**
          * Returns a list of a folder's contents (files and sub-folders) with additional metadata about the folder.
@@ -5234,6 +5250,43 @@ export interface components {
              */
             update_time: string;
         };
+        /** FileSourceTemplateSummaries */
+        FileSourceTemplateSummaries: components["schemas"]["FileSourceTemplateSummary"][];
+        /** FileSourceTemplateSummary */
+        FileSourceTemplateSummary: {
+            /** Description */
+            description: string | null;
+            /**
+             * Hidden
+             * @default false
+             */
+            hidden?: boolean;
+            /** Id */
+            id: string;
+            /** Name */
+            name: string | null;
+            /** Secrets */
+            secrets?: components["schemas"]["TemplateSecret"][] | null;
+            /**
+             * Type
+             * @enum {string}
+             */
+            type: "ftp" | "posix" | "s3fs" | "azure";
+            /** Variables */
+            variables?:
+                | (
+                      | components["schemas"]["TemplateVariableString"]
+                      | components["schemas"]["TemplateVariableInteger"]
+                      | components["schemas"]["TemplateVariablePathComponent"]
+                      | components["schemas"]["TemplateVariableBoolean"]
+                  )[]
+                | null;
+            /**
+             * Version
+             * @default 0
+             */
+            version?: number;
+        };
         /** FilesSourcePlugin */
         FilesSourcePlugin: {
             /**
@@ -9920,13 +9973,6 @@ export interface components {
              */
             up_to_date: boolean;
         };
-        /** ObjectStoreTemplateSecret */
-        ObjectStoreTemplateSecret: {
-            /** Help */
-            help: string | null;
-            /** Name */
-            name: string;
-        };
         /** ObjectStoreTemplateSummaries */
         ObjectStoreTemplateSummaries: components["schemas"]["ObjectStoreTemplateSummary"][];
         /** ObjectStoreTemplateSummary */
@@ -9945,32 +9991,27 @@ export interface components {
             /** Name */
             name: string | null;
             /** Secrets */
-            secrets?: components["schemas"]["ObjectStoreTemplateSecret"][] | null;
+            secrets?: components["schemas"]["TemplateSecret"][] | null;
             /**
              * Type
              * @enum {string}
              */
-            type: "s3" | "azure_blob" | "disk" | "generic_s3";
+            type: "aws_s3" | "azure_blob" | "disk" | "generic_s3";
             /** Variables */
-            variables?: components["schemas"]["ObjectStoreTemplateVariable"][] | null;
+            variables?:
+                | (
+                      | components["schemas"]["TemplateVariableString"]
+                      | components["schemas"]["TemplateVariableInteger"]
+                      | components["schemas"]["TemplateVariablePathComponent"]
+                      | components["schemas"]["TemplateVariableBoolean"]
+                  )[]
+                | null;
             /**
              * Version
              * @default 0
              */
             version?: number;
         };
-        /** ObjectStoreTemplateVariable */
-        ObjectStoreTemplateVariable: {
-            /** Help */
-            help: string | null;
-            /** Name */
-            name: string;
-            /**
-             * Type
-             * @enum {string}
-             */
-            type: "string" | "boolean" | "integer";
-        };
         /** OutputReferenceByLabel */
         OutputReferenceByLabel: {
             /**
@@ -11847,6 +11888,92 @@ export interface components {
          * @enum {string}
          */
         TaskState: "PENDING" | "STARTED" | "RETRY" | "FAILURE" | "SUCCESS";
+        /** TemplateSecret */
+        TemplateSecret: {
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+        };
+        /** TemplateVariableBoolean */
+        TemplateVariableBoolean: {
+            /**
+             * Default
+             * @default false
+             */
+            default?: boolean;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "boolean";
+        };
+        /** TemplateVariableInteger */
+        TemplateVariableInteger: {
+            /**
+             * Default
+             * @default 0
+             */
+            default?: number;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "integer";
+        };
+        /** TemplateVariablePathComponent */
+        TemplateVariablePathComponent: {
+            /** Default */
+            default?: string | null;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "path_component";
+        };
+        /** TemplateVariableString */
+        TemplateVariableString: {
+            /**
+             * Default
+             * @default
+             */
+            default?: string;
+            /** Help */
+            help: string | null;
+            /** Label */
+            label?: string | null;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @constant
+             * @enum {string}
+             */
+            type: "string";
+        };
         /** ToolDataDetails */
         ToolDataDetails: {
             /**
@@ -12529,7 +12656,7 @@ export interface components {
              * Type
              * @enum {string}
              */
-            type: "s3" | "azure_blob" | "disk" | "generic_s3";
+            type: "aws_s3" | "azure_blob" | "disk" | "generic_s3";
             /** Uuid */
             uuid: string;
             /** Variables */
@@ -12577,6 +12704,34 @@ export interface components {
              */
             id: string;
         };
+        /** UserFileSourceModel */
+        UserFileSourceModel: {
+            /** Description */
+            description: string | null;
+            /** Id */
+            id: string | number;
+            /** Name */
+            name: string;
+            /** Secrets */
+            secrets: string[];
+            /** Template Id */
+            template_id: string;
+            /** Template Version */
+            template_version: number;
+            /**
+             * Type
+             * @enum {string}
+             */
+            type: "ftp" | "posix" | "s3fs" | "azure";
+            /** Uri Root */
+            uri_root: string;
+            /** Uuid */
+            uuid: string;
+            /** Variables */
+            variables: {
+                [key: string]: (string | boolean | number) | undefined;
+            } | null;
+        };
         /**
          * UserModel
          * @description User in a transaction context.
@@ -14766,6 +14921,142 @@ export interface operations {
             };
         };
     };
+    file_sources__instances_index: {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"][];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__create_instance: {
+        /** Create a user-bound object store. */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateInstancePayload"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__instances_get: {
+        /** Get a list of persisted file source instances defined by the requesting user. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The index for a persisted UserFileSourceStore object. */
+            path: {
+                user_file_source_id: string;
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__instances_update: {
+        /** Update or upgrade user file source instance. */
+        parameters: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+            /** @description The index for a persisted UserFileSourceStore object. */
+            path: {
+                user_file_source_id: string;
+            };
+        };
+        requestBody: {
+            content: {
+                "application/json":
+                    | components["schemas"]["UpdateInstanceSecretPayload"]
+                    | components["schemas"]["UpgradeInstancePayload"]
+                    | components["schemas"]["UpdateInstancePayload"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["UserFileSourceModel"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    file_sources__templates_index: {
+        /** Get a list of file source templates available to build user defined file sources from */
+        parameters?: {
+            /** @description The user ID that will be used to effectively make this API call. Only admins and designated users can make API calls on behalf of other users. */
+            header?: {
+                "run-as"?: string | null;
+            };
+        };
+        responses: {
+            /** @description A list of the configured file source templates. */
+            200: {
+                content: {
+                    "application/json": components["schemas"]["FileSourceTemplateSummaries"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
     index_api_folders__folder_id__contents_get: {
         /**
          * Returns a list of a folder's contents (files and sub-folders) with additional metadata about the folder.
diff --git a/client/src/components/ConfigTemplates/CreateInstance.test.ts b/client/src/components/ConfigTemplates/CreateInstance.test.ts
new file mode 100644
index 000000000000..fe4e59ad4a59
--- /dev/null
+++ b/client/src/components/ConfigTemplates/CreateInstance.test.ts
@@ -0,0 +1,32 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import CreateInstance from "./CreateInstance.vue";
+
+const localVue = getLocalVue(true);
+
+describe("CreateInstance", () => {
+    it("should render a loading message during loading", async () => {
+        const wrapper = shallowMount(CreateInstance, {
+            propsData: {
+                loading: true,
+                loadingMessage: "component loading...",
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeTruthy();
+    });
+
+    it("should hide a loading message after loading", async () => {
+        const wrapper = shallowMount(CreateInstance, {
+            propsData: {
+                loading: false,
+                loadingMessage: "component loading...",
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeFalsy();
+    });
+});
diff --git a/client/src/components/ConfigTemplates/CreateInstance.vue b/client/src/components/ConfigTemplates/CreateInstance.vue
new file mode 100644
index 000000000000..334d341bc590
--- /dev/null
+++ b/client/src/components/ConfigTemplates/CreateInstance.vue
@@ -0,0 +1,21 @@
+<script lang="ts" setup>
+import { BContainer } from "bootstrap-vue";
+
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    loading: boolean;
+    loadingMessage: string;
+}
+
+defineProps<Props>();
+</script>
+
+<template>
+    <BContainer fluid class="p-0">
+        <LoadingSpan v-if="loading" :message="loadingMessage" />
+        <div v-else>
+            <slot />
+        </div>
+    </BContainer>
+</template>
diff --git a/client/src/components/ConfigTemplates/EditSecretsForm.test.ts b/client/src/components/ConfigTemplates/EditSecretsForm.test.ts
new file mode 100644
index 000000000000..3a6252da0e29
--- /dev/null
+++ b/client/src/components/ConfigTemplates/EditSecretsForm.test.ts
@@ -0,0 +1,36 @@
+import { mount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE, STANDARD_OBJECT_STORE_TEMPLATE } from "./test_fixtures";
+
+import EditSecretsForm from "./EditSecretsForm.vue";
+
+const localVue = getLocalVue(true);
+
+describe("EditSecretsForm", () => {
+    it("should render a secrets for for file source templates", async () => {
+        const wrapper = mount(EditSecretsForm, {
+            propsData: {
+                template: STANDARD_FILE_SOURCE_TEMPLATE,
+                title: "Secrets FORM for file source",
+            },
+            localVue,
+        });
+        const titleText = wrapper.find(".portlet-title-text");
+        expect(titleText.exists()).toBeTruthy();
+        expect(titleText.text()).toEqual("Secrets FORM for file source");
+    });
+
+    it("should render a secrets for for object store templates", async () => {
+        const wrapper = mount(EditSecretsForm, {
+            propsData: {
+                template: STANDARD_OBJECT_STORE_TEMPLATE,
+                title: "Secrets FORM for object store",
+            },
+            localVue,
+        });
+        const titleText = wrapper.find(".portlet-title-text");
+        expect(titleText.exists()).toBeTruthy();
+        expect(titleText.text()).toEqual("Secrets FORM for object store");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/EditSecretsForm.vue b/client/src/components/ConfigTemplates/EditSecretsForm.vue
new file mode 100644
index 000000000000..9baa7ac5f7c0
--- /dev/null
+++ b/client/src/components/ConfigTemplates/EditSecretsForm.vue
@@ -0,0 +1,39 @@
+<script setup lang="ts">
+import { TemplateSummary } from "@/api/configTemplates";
+
+import VaultSecret from "./VaultSecret.vue";
+import FormCard from "@/components/Form/FormCard.vue";
+
+interface Props {
+    template: TemplateSummary;
+    title: string;
+}
+
+defineProps<Props>();
+
+const emit = defineEmits<{
+    (e: "update", secretName: string, secretValue: string): void;
+}>();
+
+async function update(secretName: string, secretValue: string) {
+    emit("update", secretName, secretValue);
+}
+</script>
+
+<template>
+    <FormCard :title="title">
+        <template v-slot:body>
+            <div>
+                <div v-for="secret in template.secrets" :key="secret.name">
+                    <VaultSecret
+                        :label="secret.label || secret.name"
+                        :name="secret.name"
+                        :help="secret.help || ''"
+                        :is-set="true"
+                        @update="update">
+                    </VaultSecret>
+                </div>
+            </div>
+        </template>
+    </FormCard>
+</template>
diff --git a/client/src/components/ConfigTemplates/InstanceDropdown.test.ts b/client/src/components/ConfigTemplates/InstanceDropdown.test.ts
new file mode 100644
index 000000000000..e0a54fd53489
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceDropdown.test.ts
@@ -0,0 +1,40 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import InstanceDropdown from "./InstanceDropdown.vue";
+
+const localVue = getLocalVue(true);
+
+describe("InstanceDropdown", () => {
+    it("should render a drop down without upgrade if upgrade unavailable as an option", async () => {
+        const wrapper = shallowMount(InstanceDropdown, {
+            propsData: {
+                prefix: "file-source",
+                name: "my cool instance",
+                routeEdit: "/object_store_instance/edit",
+                routeUpgrade: "/object_store_instance/upgrade",
+                isUpgradable: false,
+            },
+            localVue,
+        });
+        const menu = wrapper.find(".dropdown-menu");
+        const links = menu.findAll("a");
+        expect(links.length).toBe(1);
+    });
+
+    it("should render a drop down with upgrade if upgrade available as an option", async () => {
+        const wrapper = shallowMount(InstanceDropdown, {
+            propsData: {
+                prefix: "file-source",
+                name: "my cool instance",
+                routeEdit: "/object_store_instance/edit",
+                routeUpgrade: "/object_store_instance/upgrade",
+                isUpgradable: true,
+            },
+            localVue,
+        });
+        const menu = wrapper.find(".dropdown-menu");
+        const links = menu.findAll("a");
+        expect(links.length).toBe(2);
+    });
+});
diff --git a/client/src/components/ConfigTemplates/InstanceDropdown.vue b/client/src/components/ConfigTemplates/InstanceDropdown.vue
new file mode 100644
index 000000000000..e825479bc3e3
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceDropdown.vue
@@ -0,0 +1,50 @@
+<script setup lang="ts">
+import "./icons";
+
+import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BLink } from "bootstrap-vue";
+import { useRouter } from "vue-router/composables";
+
+interface Props {
+    prefix: string;
+    name: string;
+    routeEdit: string;
+    routeUpgrade: string;
+    isUpgradable: boolean;
+}
+
+const title = "";
+
+const router = useRouter();
+
+defineProps<Props>();
+</script>
+
+<template>
+    <div>
+        <BLink
+            v-b-tooltip.hover
+            :class="`${prefix}-instance-dropdown font-weight-bold`"
+            data-toggle="dropdown"
+            :title="title"
+            aria-haspopup="true"
+            aria-expanded="false">
+            <FontAwesomeIcon icon="caret-down" />
+            <span class="instance-dropdown-name">{{ name }}</span>
+        </BLink>
+        <div class="dropdown-menu" :aria-labelledby="`${prefix}-instance-dropdown`">
+            <a
+                v-if="isUpgradable"
+                class="dropdown-item"
+                @keypress="router.push(routeUpgrade)"
+                @click.prevent="router.push(routeUpgrade)">
+                <span class="fa fa-edit fa-fw mr-1" />
+                <span v-localize>Upgrade</span>
+            </a>
+            <a class="dropdown-item" @keypress="router.push(routeEdit)" @click.prevent="router.push(routeEdit)">
+                <span class="fa fa-edit fa-fw mr-1" />
+                <span v-localize>Edit configuration</span>
+            </a>
+        </div>
+    </div>
+</template>
diff --git a/client/src/components/ConfigTemplates/InstanceForm.test.ts b/client/src/components/ConfigTemplates/InstanceForm.test.ts
new file mode 100644
index 000000000000..546a6670d68f
--- /dev/null
+++ b/client/src/components/ConfigTemplates/InstanceForm.test.ts
@@ -0,0 +1,42 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import InstanceForm from "./InstanceForm.vue";
+
+const localVue = getLocalVue(true);
+
+const inputs: any[] = [];
+const SUBMIT_TITLE = "Submit the form!";
+
+describe("InstanceForm", () => {
+    it("should render a loading message and not submit button if inputs is null", async () => {
+        const wrapper = shallowMount(InstanceForm, {
+            propsData: {
+                title: "MY FORM",
+                loading: true,
+                inputs: null,
+                submitTitle: SUBMIT_TITLE,
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeTruthy();
+        expect(wrapper.find("#submit").exists()).toBeFalsy();
+    });
+
+    it("should hide a loading message after loading", async () => {
+        const wrapper = shallowMount(InstanceForm, {
+            propsData: {
+                title: "MY FORM",
+                loading: false,
+                inputs: inputs,
+                submitTitle: SUBMIT_TITLE,
+            },
+            localVue,
+        });
+        const loadingSpan = wrapper.findComponent({ name: "LoadingSpan" }).exists();
+        expect(loadingSpan).toBeFalsy();
+        expect(wrapper.find("#submit").exists()).toBeTruthy();
+        expect(wrapper.find("#submit").text()).toEqual(SUBMIT_TITLE);
+    });
+});
diff --git a/client/src/components/ObjectStore/Instances/InstanceForm.vue b/client/src/components/ConfigTemplates/InstanceForm.vue
similarity index 79%
rename from client/src/components/ObjectStore/Instances/InstanceForm.vue
rename to client/src/components/ConfigTemplates/InstanceForm.vue
index 97d4525aa4cb..7e9bba13e4aa 100644
--- a/client/src/components/ObjectStore/Instances/InstanceForm.vue
+++ b/client/src/components/ConfigTemplates/InstanceForm.vue
@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { BButton } from "bootstrap-vue";
+
 import FormCard from "@/components/Form/FormCard.vue";
 import FormDisplay from "@/components/Form/FormDisplay.vue";
 import LoadingSpan from "@/components/LoadingSpan.vue";
@@ -7,6 +9,7 @@ interface Props {
     title: string;
     inputs: any | null; // not fully reactive so make sure these are ready to go when loading is false
     submitTitle: string;
+    loadingMessage: string;
 }
 
 defineProps<Props>();
@@ -26,7 +29,7 @@ async function handleSubmit() {
 </script>
 <template>
     <div>
-        <LoadingSpan v-if="inputs == null" message="Loading storage location template and instance information" />
+        <LoadingSpan v-if="inputs == null" :message="loadingMessage" />
         <div v-else>
             <FormCard :title="title">
                 <template v-slot:body>
@@ -34,9 +37,9 @@ async function handleSubmit() {
                 </template>
             </FormCard>
             <div class="mt-3">
-                <b-button id="submit" variant="primary" class="mr-1" @click="handleSubmit">
+                <BButton id="submit" variant="primary" class="mr-1" @click="handleSubmit">
                     {{ submitTitle }}
-                </b-button>
+                </BButton>
             </div>
         </div>
     </div>
diff --git a/client/src/components/ConfigTemplates/ManageIndexHeader.vue b/client/src/components/ConfigTemplates/ManageIndexHeader.vue
new file mode 100644
index 000000000000..880c1a92c3d7
--- /dev/null
+++ b/client/src/components/ConfigTemplates/ManageIndexHeader.vue
@@ -0,0 +1,35 @@
+<script setup lang="ts">
+import "./icons";
+
+import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BAlert, BButton, BCol, BRow } from "bootstrap-vue";
+import { useRouter } from "vue-router/composables";
+
+import _l from "@/utils/localization";
+
+interface Props {
+    message: String | null | undefined;
+    createButtonId: string;
+    createRoute: string;
+}
+
+defineProps<Props>();
+
+const router = useRouter();
+</script>
+
+<template>
+    <div>
+        <BAlert v-if="message" show dismissible>
+            {{ message || "" }}
+        </BAlert>
+        <BRow class="mb-3">
+            <BCol>
+                <BButton :id="createButtonId" class="m-1 float-right" @click="router.push(createRoute)">
+                    <FontAwesomeIcon icon="plus" />
+                    {{ _l("Create") }}
+                </BButton>
+            </BCol>
+        </BRow>
+    </div>
+</template>
diff --git a/client/src/components/ConfigTemplates/SelectTemplate.test.js b/client/src/components/ConfigTemplates/SelectTemplate.test.js
new file mode 100644
index 000000000000..ce631ceb54d0
--- /dev/null
+++ b/client/src/components/ConfigTemplates/SelectTemplate.test.js
@@ -0,0 +1,33 @@
+import { mount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE } from "./test_fixtures";
+
+import SelectTemplate from "./SelectTemplate.vue";
+
+const localVue = getLocalVue(true);
+
+const help = "some help text about selection";
+
+describe("SelectTemplate", () => {
+    it("should render a selection row for supplied templates", async () => {
+        const wrapper = mount(SelectTemplate, {
+            propsData: {
+                templates: [STANDARD_FILE_SOURCE_TEMPLATE],
+                selectText: help,
+                idPrefix: "file-source",
+            },
+            localVue,
+        });
+        console.log(wrapper.html());
+        const helpText = wrapper.find(".file-source-template-select-help");
+        expect(helpText.exists()).toBeTruthy();
+        expect(helpText.text()).toBeLocalizationOf(help);
+        const buttons = wrapper.findAll("button");
+        expect(buttons.length).toBe(1);
+        const button = buttons.at(0);
+        expect(button.attributes().id).toEqual("file-source-template-button-moo");
+        expect(button.attributes()["data-template-id"]).toEqual("moo");
+        expect(button.text()).toEqual("moo");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/SelectTemplate.vue b/client/src/components/ConfigTemplates/SelectTemplate.vue
new file mode 100644
index 000000000000..012edb83ebf0
--- /dev/null
+++ b/client/src/components/ConfigTemplates/SelectTemplate.vue
@@ -0,0 +1,44 @@
+<script lang="ts" setup>
+import { BButton, BButtonGroup, BCol, BRow } from "bootstrap-vue";
+
+import type { TemplateSummary } from "@/api/configTemplates";
+
+interface Props {
+    selectText: string;
+    idPrefix: string;
+    templates: TemplateSummary[];
+}
+
+defineProps<Props>();
+
+const emit = defineEmits<{
+    (e: "onSubmit", id: string): void;
+}>();
+
+async function handleSubmit(templateId: string) {
+    emit("onSubmit", templateId);
+}
+</script>
+
+<template>
+    <BRow>
+        <BCol cols="7">
+            <BButtonGroup vertical size="lg" style="width: 100%">
+                <BButton
+                    v-for="template in templates"
+                    :id="`${idPrefix}-template-button-${template.id}`"
+                    :key="template.id"
+                    :class="`${idPrefix}-template-select-button`"
+                    :data-template-id="template.id"
+                    @click="handleSubmit(template.id)"
+                    >{{ template.name }}
+                </BButton>
+            </BButtonGroup>
+        </BCol>
+        <BCol cols="5">
+            <p v-localize style="float: right" :class="`${idPrefix}-template-select-help`">
+                {{ selectText }}
+            </p>
+        </BCol>
+    </BRow>
+</template>
diff --git a/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts b/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts
new file mode 100644
index 000000000000..e230874d65e7
--- /dev/null
+++ b/client/src/components/ConfigTemplates/TemplateSummaryPopover.test.ts
@@ -0,0 +1,22 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_FILE_SOURCE_TEMPLATE } from "./test_fixtures";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const localVue = getLocalVue(true);
+
+describe("TemplateSummaryPopover", () => {
+    it("should render a secrets for for file source templates", async () => {
+        const wrapper = shallowMount(TemplateSummaryPopover, {
+            propsData: {
+                template: STANDARD_FILE_SOURCE_TEMPLATE,
+                target: "popover-target",
+            },
+            localVue,
+        });
+        const popover = wrapper.findComponent({ name: "BPopover" });
+        expect(popover.attributes().target).toEqual("popover-target");
+    });
+});
diff --git a/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue b/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue
new file mode 100644
index 000000000000..77484b6b8c9a
--- /dev/null
+++ b/client/src/components/ConfigTemplates/TemplateSummaryPopover.vue
@@ -0,0 +1,21 @@
+<script lang="ts" setup>
+import { BPopover } from "bootstrap-vue";
+
+import type { TemplateSummary } from "@/api/configTemplates";
+
+interface Props {
+    target: String;
+    template: TemplateSummary;
+}
+
+const props = defineProps<Props>();
+
+const popoverPlacement = "rightbottom";
+</script>
+
+<template>
+    <BPopover :target="target" triggers="hover" boundary="window" :placement="popoverPlacement">
+        <template v-slot:title>{{ props.template.name }}</template>
+        <slot />
+    </BPopover>
+</template>
diff --git a/client/src/components/ConfigTemplates/VaultSecret.test.ts b/client/src/components/ConfigTemplates/VaultSecret.test.ts
new file mode 100644
index 000000000000..6ab7e53f5304
--- /dev/null
+++ b/client/src/components/ConfigTemplates/VaultSecret.test.ts
@@ -0,0 +1,25 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import VaultSecret from "./VaultSecret.vue";
+
+const localVue = getLocalVue(true);
+
+describe("VaultSecret", () => {
+    it("should render a form element", async () => {
+        const wrapper = shallowMount(VaultSecret, {
+            propsData: {
+                name: "secret name",
+                label: "Label Secret",
+                help: "here is some good *help*",
+                isSet: true,
+            },
+            localVue,
+        });
+        const titleWrapper = wrapper.find(".ui-form-title-text");
+        expect(titleWrapper.text()).toEqual("Label Secret");
+        const helpWrapper = wrapper.find(".ui-form-info p");
+        // verify markdown converted
+        expect(helpWrapper.html()).toEqual("<p>here is some good <em>help</em></p>");
+    });
+});
diff --git a/client/src/components/ObjectStore/Instances/VaultSecret.vue b/client/src/components/ConfigTemplates/VaultSecret.vue
similarity index 50%
rename from client/src/components/ObjectStore/Instances/VaultSecret.vue
rename to client/src/components/ConfigTemplates/VaultSecret.vue
index 41fb485bd67d..11835fd4fe71 100644
--- a/client/src/components/ObjectStore/Instances/VaultSecret.vue
+++ b/client/src/components/ConfigTemplates/VaultSecret.vue
@@ -1,8 +1,12 @@
 <script setup lang="ts">
+import { BButton, BFormInput, BInputGroup, BInputGroupAppend } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
+import { markup } from "@/components/ObjectStore/configurationMarkdown";
+
 interface Props {
     name: string;
+    label: string;
     help: string;
     isSet: boolean;
 }
@@ -10,7 +14,8 @@ const props = defineProps<Props>();
 
 const showEdit = ref<boolean>(false);
 const secretValue = ref<string>("");
-const editTitle = computed(() => `Edit ${props.name}`);
+const editTitle = computed(() => `Edit ${props.label}`);
+const helpHtml = computed(() => markup(props.help, true));
 
 function onClick() {
     showEdit.value = true;
@@ -29,37 +34,35 @@ async function onOk() {
         <div class="ui-form-element section-row">
             <div class="ui-form-title">
                 <div class="ui-form-title-text">
-                    {{ name }}
+                    {{ label }}
                 </div>
             </div>
             <div class="ui-form-field">
                 <div>
-                    <b-input-group>
-                        <b-form-input type="password" value="*****************************" disabled @click="onClick" />
-                        <b-input-group-append>
-                            <b-button @click="onClick">
+                    <BInputGroup>
+                        <BFormInput type="password" value="*****************************" disabled @click="onClick" />
+                        <BInputGroupAppend>
+                            <BButton @click="onClick">
                                 <icon icon="edit" />
                                 Update
-                            </b-button>
-                        </b-input-group-append>
-                    </b-input-group>
+                            </BButton>
+                        </BInputGroupAppend>
+                    </BInputGroup>
                 </div>
             </div>
-            <span class="ui-form-info form-text text-muted">
-                {{ help }}
-            </span>
+            <!-- eslint-disable-next-line vue/no-v-html -->
+            <span class="ui-form-info form-text text-muted" v-html="helpHtml" />
         </div>
         <b-modal ref="edit-modal" v-model="showEdit" :title="editTitle" ok-title="Update" @ok="onOk">
             <div>
-                <b-form-input v-model="secretValue" type="password" />
-                <span class="ui-form-info form-text text-muted">
-                    {{ help }}
-                </span>
+                <BFormInput v-model="secretValue" type="password" />
+                <!-- eslint-disable-next-line vue/no-v-html -->
+                <span class="ui-form-info form-text text-muted" v-html="helpHtml" />
             </div>
         </b-modal>
     </div>
 </template>
 
 <style lang="scss" scoped>
-@import "../../Form/form-elements.scss";
+@import "../Form/form-elements.scss";
 </style>
diff --git a/client/src/components/ConfigTemplates/fields.ts b/client/src/components/ConfigTemplates/fields.ts
new file mode 100644
index 000000000000..33a00f7e69f4
--- /dev/null
+++ b/client/src/components/ConfigTemplates/fields.ts
@@ -0,0 +1,25 @@
+import _l from "@/utils/localization";
+
+export const NAME_FIELD = {
+    key: "name",
+    label: _l("Name"),
+    sortable: true,
+};
+
+export const DESCRIPTION_FIELD = {
+    key: "description",
+    label: _l("Description"),
+    sortable: true,
+};
+
+export const TYPE_FIELD = {
+    key: "type",
+    label: _l("Type"),
+    sortable: true,
+};
+
+export const TEMPLATE_FIELD = {
+    key: "template",
+    label: _l("From Template"),
+    sortable: true,
+};
diff --git a/client/src/components/ConfigTemplates/formUtil.test.ts b/client/src/components/ConfigTemplates/formUtil.test.ts
new file mode 100644
index 000000000000..e95caf3d95f5
--- /dev/null
+++ b/client/src/components/ConfigTemplates/formUtil.test.ts
@@ -0,0 +1,100 @@
+import { TemplateVariable } from "@/api/configTemplates";
+
+import { createTemplateForm, templateVariableFormEntry, upgradeForm } from "./formUtil";
+import {
+    GENERIC_FTP_FILE_SOURCE_TEMPLATE,
+    OBJECT_STORE_INSTANCE,
+    STANDARD_FILE_SOURCE_TEMPLATE,
+    STANDARD_OBJECT_STORE_TEMPLATE,
+} from "./test_fixtures";
+
+const FTP_VARIABLES = GENERIC_FTP_FILE_SOURCE_TEMPLATE.variables as TemplateVariable[];
+const PROJECT_VARIABLE = {
+    name: "Project",
+    type: "path_component",
+} as TemplateVariable;
+
+describe("formUtils", () => {
+    describe("createTemplateForm", () => {
+        it("should create a form from an object store templates", () => {
+            const form = createTemplateForm(STANDARD_OBJECT_STORE_TEMPLATE, "storage location");
+            expect(form.length).toBe(6);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("_meta_name");
+            expect(formEl0?.help).toEqual("Label this new storage location with a name.");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("_meta_description");
+        });
+
+        it("should create a form from a file source templates", () => {
+            const form = createTemplateForm(STANDARD_FILE_SOURCE_TEMPLATE, "file source");
+            expect(form.length).toBe(6);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("_meta_name");
+            expect(formEl0?.help).toEqual("Label this new file source with a name.");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("_meta_description");
+        });
+    });
+
+    describe("upgradeForm", () => {
+        it("should create a form from an object store templates", () => {
+            const form = upgradeForm(STANDARD_OBJECT_STORE_TEMPLATE, OBJECT_STORE_INSTANCE);
+            expect(form.length).toBe(3);
+            const formEl0 = form[0];
+            expect(formEl0?.name).toEqual("oldvar");
+            const formEl1 = form[1];
+            expect(formEl1?.name).toEqual("newvar");
+        });
+
+        it("should only ask for new secrets during upgrade", () => {
+            const form = upgradeForm(STANDARD_OBJECT_STORE_TEMPLATE, OBJECT_STORE_INSTANCE);
+            expect(form.length).toBe(3);
+            const formEl0 = form[2];
+            expect(formEl0?.name).toEqual("newsecret");
+            expect(formEl0?.type).toEqual("password");
+        });
+    });
+
+    describe("templateVariableFormEntry", () => {
+        it("should render string types as Galaxy text form inputs", () => {
+            const hostVariable = FTP_VARIABLES[0] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(hostVariable, undefined);
+            expect(formEntry.name).toBe("host");
+            expect(formEntry.label).toBe("FTP Host");
+            expect(formEntry.type).toBe("text");
+            expect(formEntry.help).toBe("<p>Host of FTP Server to connect to.</p>\n");
+        });
+        it("should render integer types as Galaxy integer inputs", () => {
+            const portVariable = FTP_VARIABLES[3] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(portVariable, undefined);
+            expect(formEntry.name).toBe("port");
+            expect(formEntry.label).toBe("FTP Port");
+            expect(formEntry.type).toBe("integer");
+            expect(formEntry.value).toBe(21);
+        });
+        it("should render boolean types as Galaxy boolean inputs", () => {
+            const writableVariable = FTP_VARIABLES[2] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(writableVariable, undefined);
+            expect(formEntry.name).toBe("writable");
+            expect(formEntry.label).toBe("Writable?");
+            expect(formEntry.type).toBe("boolean");
+            expect(formEntry.value).toBe(false);
+        });
+        it("should render path_component types as Galaxy text form inputs", () => {
+            const formEntry = templateVariableFormEntry(PROJECT_VARIABLE, undefined);
+            expect(formEntry.name).toBe("Project");
+            expect(formEntry.label).toBe("Project");
+            expect(formEntry.type).toBe("text");
+        });
+        it("should render path_component updated default values if supplied", () => {
+            const formEntry = templateVariableFormEntry(PROJECT_VARIABLE, "foobar");
+            expect(formEntry.value).toBe("foobar");
+        });
+        it("should render string types with updated default values if supplied", () => {
+            const hostVariable = FTP_VARIABLES[0] as TemplateVariable;
+            const formEntry = templateVariableFormEntry(hostVariable, "mycoolhost.org");
+            expect(formEntry.value).toBe("mycoolhost.org");
+        });
+    });
+});
diff --git a/client/src/components/ConfigTemplates/formUtil.ts b/client/src/components/ConfigTemplates/formUtil.ts
new file mode 100644
index 000000000000..1f65581ffe5f
--- /dev/null
+++ b/client/src/components/ConfigTemplates/formUtil.ts
@@ -0,0 +1,236 @@
+import type {
+    Instance,
+    SecretData,
+    TemplateSecret,
+    TemplateSummary,
+    TemplateVariable,
+    VariableData,
+    VariableValueType,
+} from "@/api/configTemplates";
+import { markup } from "@/components/ObjectStore/configurationMarkdown";
+
+export function metadataFormEntryName(what: string) {
+    return {
+        name: "_meta_name",
+        label: "Name",
+        type: "text",
+        optional: false,
+        help: `Label this new ${what} with a name.`,
+    };
+}
+
+export function metadataFormEntryDescription(what: string) {
+    return {
+        name: "_meta_description",
+        label: "Description",
+        optional: true,
+        type: "textarea",
+        help: `Provide some notes to yourself about this ${what} - perhaps to remind you how it is configured, where it stores the data, etc..`,
+    };
+}
+
+export function templateVariableFormEntry(variable: TemplateVariable, variableValue: VariableValueType) {
+    const common_fields = {
+        name: variable.name,
+        label: variable.label ?? variable.name,
+        help: markup(variable.help || "", true),
+    };
+    if (variable.type == "string") {
+        const defaultValue = variable.default ?? "";
+        return {
+            type: "text",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "path_component") {
+        const defaultValue = variable.default ?? "";
+        // TODO: do extra validation with form somehow...
+        return {
+            type: "text",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "integer") {
+        const defaultValue = variable.default ?? 0;
+        return {
+            type: "integer",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else if (variable.type == "boolean") {
+        const defaultValue = variable.default ?? false;
+        return {
+            type: "boolean",
+            value: variableValue == undefined ? defaultValue : variableValue,
+            ...common_fields,
+        };
+    } else {
+        throw Error("Invalid template form input type found.");
+    }
+}
+
+export function templateSecretFormEntry(secret: TemplateSecret) {
+    return {
+        name: secret.name,
+        label: secret.label ?? secret.name,
+        type: "password",
+        help: markup(secret.help || "", true),
+        value: "",
+    };
+}
+
+export function editTemplateForm(template: TemplateSummary, what: string, instance: Instance) {
+    const form = [];
+    const nameInput = metadataFormEntryName(what);
+    form.push({ value: instance.name ?? "", ...nameInput });
+
+    const descriptionInput = metadataFormEntryDescription(what);
+    form.push({ value: instance.description ?? "", ...descriptionInput });
+
+    const variables = template.variables ?? [];
+    const variableValues: VariableData = instance.variables || {};
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
+    }
+    return form;
+}
+
+export function editFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const name = formData["_meta_name"];
+    const description = formData["_meta_description"];
+    const variableData: VariableData = {};
+    for (const variable of variables) {
+        const variableValue = formDataTypedGet(variable, formData);
+        if (variableValue !== undefined) {
+            variableData[variable.name] = variableValue;
+        }
+    }
+    const payload = {
+        name: name,
+        description: description,
+        variables: variableData,
+    };
+    return payload;
+}
+
+export function createTemplateForm(template: TemplateSummary, what: string) {
+    const form = [];
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    form.push(metadataFormEntryName(what));
+    form.push(metadataFormEntryDescription(what));
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, undefined));
+    }
+    for (const secret of secrets) {
+        form.push(templateSecretFormEntry(secret));
+    }
+    return form;
+}
+
+export function createFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    const variableData: VariableData = {};
+    const secretData: SecretData = {};
+    for (const variable of variables) {
+        const variableValue = formDataTypedGet(variable, formData);
+        if (variableValue !== undefined) {
+            variableData[variable.name] = variableValue;
+        }
+    }
+    for (const secret of secrets) {
+        secretData[secret.name] = formData[secret.name];
+    }
+    const name: string = formData._meta_name;
+    const description: string = formData._meta_description;
+    const payload = {
+        name: name,
+        description: description,
+        secrets: secretData,
+        variables: variableData,
+        template_id: template.id,
+        template_version: template.version ?? 0,
+    };
+    return payload;
+}
+
+export function formDataTypedGet(variableDefinition: TemplateVariable, formData: any): VariableValueType {
+    // galaxy form library doesn't type values traditionally, so add a typed
+    // access to the data if coming back as string. Though it does seem to be
+    // typed properly - this might not be needed anymore?
+    const variableType = variableDefinition.type;
+    const variableName = variableDefinition.name;
+    const rawValue: boolean | string | number | null | undefined = formData[variableName];
+    if (variableType == "string") {
+        if (rawValue == null || rawValue == undefined) {
+            return undefined;
+        } else {
+            return String(rawValue);
+        }
+    } else if (variableType == "path_component") {
+        if (rawValue == null || rawValue == undefined) {
+            return undefined;
+        } else {
+            return String(rawValue);
+        }
+    } else if (variableType == "boolean") {
+        if (rawValue == null || rawValue == undefined || typeof rawValue == "number") {
+            return undefined;
+        } else {
+            return String(rawValue).toLowerCase() == "true";
+        }
+    } else if (variableType == "integer") {
+        if (rawValue == null || rawValue == undefined || typeof rawValue == "boolean") {
+            return undefined;
+        } else {
+            if (typeof rawValue == "string") {
+                return parseInt(rawValue);
+            } else {
+                return rawValue;
+            }
+        }
+    } else {
+        throw Error("Unknown variable type encountered, shouldn't be possible.");
+    }
+}
+
+export function upgradeForm(template: TemplateSummary, instance: Instance): Array<any> {
+    const form = [];
+    const variables = template.variables ?? [];
+    const secrets = template.secrets ?? [];
+    const variableValues: VariableData = instance.variables || {};
+    const secretsSet = instance.secrets || [];
+    for (const variable of variables) {
+        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
+    }
+    for (const secret of secrets) {
+        const secretName = secret.name;
+        if (secretsSet.indexOf(secretName) >= 0) {
+            console.log("skipping...");
+        } else {
+            form.push(templateSecretFormEntry(secret));
+        }
+    }
+    return form;
+}
+
+export function upgradeFormDataToPayload(template: TemplateSummary, formData: any) {
+    const variables = template.variables ?? [];
+    const variableData: VariableData = {};
+    for (const variable of variables) {
+        variableData[variable.name] = formData[variable.name];
+    }
+    const secrets = {};
+    // ideally we would be able to force a template version here,
+    // maybe rework backend types to force this in the API response
+    // even if we don't need it in the config files
+    const templateVersion: number = template.version || 0;
+    const payload = {
+        template_version: templateVersion,
+        variables: variableData,
+        secrets: secrets,
+    };
+    return payload;
+}
diff --git a/client/src/components/ObjectStore/Instances/icons.ts b/client/src/components/ConfigTemplates/icons.ts
similarity index 100%
rename from client/src/components/ObjectStore/Instances/icons.ts
rename to client/src/components/ConfigTemplates/icons.ts
diff --git a/client/src/components/ConfigTemplates/test_fixtures.ts b/client/src/components/ConfigTemplates/test_fixtures.ts
new file mode 100644
index 000000000000..de926f236ba6
--- /dev/null
+++ b/client/src/components/ConfigTemplates/test_fixtures.ts
@@ -0,0 +1,119 @@
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+import type { UserConcreteObjectStore } from "@/components/ObjectStore/Instances/types";
+import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templates/types";
+
+export const STANDARD_OBJECT_STORE_TEMPLATE: ObjectStoreTemplateSummary = {
+    type: "aws_s3",
+    name: "moo",
+    description: null,
+    variables: [
+        {
+            name: "oldvar",
+            type: "string",
+            help: "old var help",
+        },
+        {
+            name: "newvar",
+            type: "string",
+            help: "new var help",
+        },
+    ],
+    secrets: [
+        {
+            name: "oldsecret",
+            help: "old secret help",
+        },
+        {
+            name: "newsecret",
+            help: "new secret help",
+        },
+    ],
+    id: "moo",
+    version: 2,
+    badges: [],
+};
+
+export const STANDARD_FILE_SOURCE_TEMPLATE: FileSourceTemplateSummary = {
+    type: "s3fs",
+    name: "moo",
+    description: null,
+    variables: [
+        {
+            name: "oldvar",
+            type: "string",
+            help: "old var help",
+        },
+        {
+            name: "newvar",
+            type: "string",
+            help: "new var help",
+        },
+    ],
+    secrets: [
+        {
+            name: "oldsecret",
+            help: "old secret help",
+        },
+        {
+            name: "newsecret",
+            help: "new secret help",
+        },
+    ],
+    id: "moo",
+    version: 2,
+};
+
+export const GENERIC_FTP_FILE_SOURCE_TEMPLATE: FileSourceTemplateSummary = {
+    id: "ftp",
+    type: "ftp",
+    name: "Generic FTP Server",
+    description: "Generic FTP configuration with all configuration options exposed.",
+    variables: [
+        { name: "host", label: "FTP Host", type: "string", help: "Host of FTP Server to connect to." },
+        {
+            name: "user",
+            label: "FTP User",
+            type: "string",
+            help: "Username to login to target FTP server with.",
+        },
+        {
+            name: "writable",
+            label: "Writable?",
+            type: "boolean",
+            help: "Is this an FTP server you have permission to write to?",
+            default: false,
+        },
+        {
+            name: "port",
+            label: "FTP Port",
+            type: "integer",
+            help: "Port used to connect to the FTP server.",
+            default: 21,
+        },
+    ],
+    secrets: [
+        {
+            name: "password",
+            label: "FTP Password",
+            help: "Password to connect to FTP server with.",
+        },
+    ],
+};
+
+export const OBJECT_STORE_INSTANCE: UserConcreteObjectStore = {
+    type: "aws_s3",
+    name: "moo",
+    description: undefined,
+    template_id: "moo",
+    template_version: 1,
+    badges: [],
+    variables: {
+        oldvar: "my old value",
+        droppedvar: "this will be dropped",
+    },
+    secrets: ["oldsecret", "droppedsecret"],
+    quota: { enabled: false },
+    private: false,
+    id: 4,
+    uuid: "112f889f-72d7-4619-a8e8-510a8c685aa7",
+};
diff --git a/client/src/components/FileSources/FileSourceTypeSpan.vue b/client/src/components/FileSources/FileSourceTypeSpan.vue
new file mode 100644
index 000000000000..538b635c4a42
--- /dev/null
+++ b/client/src/components/FileSources/FileSourceTypeSpan.vue
@@ -0,0 +1,23 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+const MESSAGES = {
+    posix: "This is a simple path based object store that assumes the all the relevant paths are already mounted on the Galaxy server and target worker nodes.",
+    s3fs: "This is an remote file source plugin based on the Amazon Simple Storage Service (S3) interface. The AWS interface has become an industry standard and many storage vendors support it and use it to expose 'object' based storage.",
+};
+
+interface Props {
+    type: "posix" | "s3fs";
+}
+
+const props = defineProps<Props>();
+const title = computed<string>(() => MESSAGES[props.type] ?? "");
+</script>
+
+<template>
+    <span v-b-tooltip.hover class="file-source-type file-source-help-on-hover" :title="title">{{ type }}</span>
+</template>
+
+<style scoped>
+@import "./style.css";
+</style>
diff --git a/client/src/components/FileSources/Instances/CreateForm.vue b/client/src/components/FileSources/Instances/CreateForm.vue
new file mode 100644
index 000000000000..7d8a8b7ecef3
--- /dev/null
+++ b/client/src/components/FileSources/Instances/CreateForm.vue
@@ -0,0 +1,53 @@
+<script lang="ts" setup>
+import { BAlert } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { createFormDataToPayload, createTemplateForm } from "@/components/ConfigTemplates/formUtil";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { create } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface CreateFormProps {
+    template: FileSourceTemplateSummary;
+}
+const error = ref<string | null>(null);
+const props = defineProps<CreateFormProps>();
+const title = "Create a new file source for your data";
+const submitTitle = "Submit";
+const loadingMessage = "Loading file source template and instance information";
+
+const inputs = computed(() => {
+    return createTemplateForm(props.template, "file source");
+});
+
+async function onSubmit(formData: any) {
+    const payload = createFormDataToPayload(props.template, formData);
+    try {
+        const { data: fileSource } = await create(payload);
+        emit("created", fileSource);
+    } catch (e) {
+        error.value = errorMessageAsString(e);
+        return;
+    }
+}
+
+const emit = defineEmits<{
+    (e: "created", fileSource: UserFileSourceModel): void;
+}>();
+</script>
+<template>
+    <div id="create-file-source-landing">
+        <BAlert v-if="error" variant="danger" class="file-source-instance-creation-error" show>
+            {{ error }}
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/CreateInstance.vue b/client/src/components/FileSources/Instances/CreateInstance.vue
new file mode 100644
index 000000000000..9b93e2d7c269
--- /dev/null
+++ b/client/src/components/FileSources/Instances/CreateInstance.vue
@@ -0,0 +1,34 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import { useInstanceRouting } from "./routing";
+
+import CreateForm from "@/components/FileSources/Instances/CreateForm.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    templateId: string;
+}
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+fileSourceTemplatesStore.fetchTemplates();
+
+const { goToIndex } = useInstanceRouting();
+
+const props = defineProps<Props>();
+const template = computed(() => fileSourceTemplatesStore.getLatestTemplate(props.templateId));
+
+async function onCreated(objectStore: UserFileSourceModel) {
+    const message = `Created file source ${objectStore.name}`;
+    goToIndex({ message });
+}
+</script>
+
+<template>
+    <div>
+        <LoadingSpan v-if="!template" message="Loading file source templates" />
+        <CreateForm v-else :template="template" @created="onCreated"></CreateForm>
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/EditInstance.vue b/client/src/components/FileSources/Instances/EditInstance.vue
new file mode 100644
index 000000000000..311bb7fdc838
--- /dev/null
+++ b/client/src/components/FileSources/Instances/EditInstance.vue
@@ -0,0 +1,77 @@
+<script setup lang="ts">
+import { BTab, BTabs } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { editFormDataToPayload, editTemplateForm } from "@/components/ConfigTemplates/formUtil";
+
+import { useInstanceAndTemplate } from "./instance";
+import { useInstanceRouting } from "./routing";
+import { update } from "./services";
+
+import EditSecrets from "./EditSecrets.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface Props {
+    instanceId: number | string;
+}
+
+const props = defineProps<Props>();
+const { instance, template } = useInstanceAndTemplate(ref(props.instanceId));
+
+const inputs = computed(() => {
+    template.value;
+    instance.value;
+    if (template.value && instance.value) {
+        return editTemplateForm(template.value, "storage location", instance.value);
+    }
+    return null;
+});
+
+const title = computed(() => `Edit File Source ${instance.value?.name} Settings`);
+const hasSecrets = computed(() => instance.value?.secrets && instance.value?.secrets.length > 0);
+const submitTitle = "Update Settings";
+const loadingMessage = "Loading file source template and instance information";
+
+async function onSubmit(formData: any) {
+    if (template.value) {
+        const payload = editFormDataToPayload(template.value, formData);
+        const args = { user_file_source_id: String(instance?.value?.id) };
+        const { data: fileSource } = await update({ ...args, ...payload });
+        await onUpdate(fileSource);
+    }
+}
+
+const { goToIndex } = useInstanceRouting();
+
+async function onUpdate(instance: UserFileSourceModel) {
+    const message = `Updated file source ${instance.name}`;
+    goToIndex({ message });
+}
+</script>
+<template>
+    <div>
+        <BTabs v-if="hasSecrets">
+            <BTab title="Settings" active>
+                <InstanceForm
+                    :inputs="inputs"
+                    :title="title"
+                    :submit-title="submitTitle"
+                    :loading-message="loadingMessage"
+                    @onSubmit="onSubmit" />
+            </BTab>
+            <BTab title="Secrets">
+                <div v-if="instance && template">
+                    <EditSecrets :file-source="instance" :template="template" />
+                </div>
+            </BTab>
+        </BTabs>
+        <InstanceForm
+            v-else
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/EditSecrets.vue b/client/src/components/FileSources/Instances/EditSecrets.vue
new file mode 100644
index 000000000000..dd14126a1242
--- /dev/null
+++ b/client/src/components/FileSources/Instances/EditSecrets.vue
@@ -0,0 +1,28 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+
+import { update } from "./services";
+
+import EditSecretsForm from "@/components/ConfigTemplates/EditSecretsForm.vue";
+
+interface Props {
+    fileSource: UserFileSourceModel;
+    template: FileSourceTemplateSummary;
+}
+const props = defineProps<Props>();
+const title = computed(() => `Update File Source ${props.fileSource?.name} Secrets`);
+
+async function onUpdate(secretName: string, secretValue: string) {
+    const payload = {
+        secret_name: secretName,
+        secret_value: secretValue,
+    };
+    const args = { user_file_source_id: String(props.fileSource.id) };
+    await update({ ...args, ...payload });
+}
+</script>
+<template>
+    <EditSecretsForm :title="title" :template="template" @update="onUpdate" />
+</template>
diff --git a/client/src/components/FileSources/Instances/InstanceDropdown.vue b/client/src/components/FileSources/Instances/InstanceDropdown.vue
new file mode 100644
index 000000000000..f71e3fd23022
--- /dev/null
+++ b/client/src/components/FileSources/Instances/InstanceDropdown.vue
@@ -0,0 +1,30 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import InstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+interface Props {
+    fileSource: UserFileSourceModel;
+}
+
+const props = defineProps<Props>();
+const routeEdit = computed(() => `/file_source_instances/${props.fileSource.id}/edit`);
+const routeUpgrade = computed(() => `/file_source_instances/${props.fileSource.id}/upgrade`);
+const isUpgradable = computed(() =>
+    fileSourceTemplatesStore.canUpgrade(props.fileSource.template_id, props.fileSource.template_version)
+);
+</script>
+
+<template>
+    <InstanceDropdown
+        prefix="file-source"
+        :name="fileSource.name || ''"
+        :is-upgradable="isUpgradable"
+        :route-upgrade="routeUpgrade"
+        :route-edit="routeEdit" />
+</template>
diff --git a/client/src/components/FileSources/Instances/ManageIndex.vue b/client/src/components/FileSources/Instances/ManageIndex.vue
new file mode 100644
index 000000000000..e064a873a991
--- /dev/null
+++ b/client/src/components/FileSources/Instances/ManageIndex.vue
@@ -0,0 +1,69 @@
+<script setup lang="ts">
+import "@/components/ConfigTemplates/icons";
+
+import { BTable } from "bootstrap-vue";
+import { computed } from "vue";
+
+import { DESCRIPTION_FIELD, NAME_FIELD, TEMPLATE_FIELD, TYPE_FIELD } from "@/components/ConfigTemplates/fields";
+import { useFileSourceInstancesStore } from "@/stores/fileSourceInstancesStore";
+
+import InstanceDropdown from "./InstanceDropdown.vue";
+import ManageIndexHeader from "@/components/ConfigTemplates/ManageIndexHeader.vue";
+import FileSourceTypeSpan from "@/components/FileSources/FileSourceTypeSpan.vue";
+import TemplateSummarySpan from "@/components/FileSources/Templates/TemplateSummarySpan.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+const fileSourceInstancesStore = useFileSourceInstancesStore();
+
+interface Props {
+    message: String | undefined | null;
+}
+
+defineProps<Props>();
+
+const fields = [NAME_FIELD, DESCRIPTION_FIELD, TYPE_FIELD, TEMPLATE_FIELD];
+
+const items = computed(() => fileSourceInstancesStore.getInstances);
+const loading = computed(() => fileSourceInstancesStore.loading);
+fileSourceInstancesStore.fetchInstances();
+</script>
+
+<template>
+    <div>
+        <ManageIndexHeader
+            :message="message"
+            create-button-id="file-source-create"
+            create-route="/file_source_instances/create">
+        </ManageIndexHeader>
+        <BTable
+            id="user-file-sources-index"
+            no-sort-reset
+            :fields="fields"
+            :items="items"
+            :hover="true"
+            :striped="true"
+            :caption-top="true"
+            :fixed="true"
+            :show-empty="true">
+            <template v-slot:empty>
+                <LoadingSpan v-if="loading" message="Loading your user's file source instances" />
+                <b-alert v-else id="no-file-source-instances" variant="info" show>
+                    <div>
+                        No file source instances found for your users, click the create button to configure a new one.
+                    </div>
+                </b-alert>
+            </template>
+            <template v-slot:cell(name)="row">
+                <InstanceDropdown :file-source="row.item" />
+            </template>
+            <template v-slot:cell(type)="row">
+                <FileSourceTypeSpan :type="row.item.type" />
+            </template>
+            <template v-slot:cell(template)="row">
+                <TemplateSummarySpan
+                    :template-version="row.item.template_version ?? 0"
+                    :template-id="row.item.template_id" />
+            </template>
+        </BTable>
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/UpgradeForm.vue b/client/src/components/FileSources/Instances/UpgradeForm.vue
new file mode 100644
index 000000000000..4ca85e7caf67
--- /dev/null
+++ b/client/src/components/FileSources/Instances/UpgradeForm.vue
@@ -0,0 +1,63 @@
+<script setup lang="ts">
+import { BAlert } from "bootstrap-vue";
+import { computed, ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { upgradeForm, upgradeFormDataToPayload } from "@/components/ConfigTemplates/formUtil";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { useInstanceRouting } from "./routing";
+import { update } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
+
+interface Props {
+    instance: UserFileSourceModel;
+    latestTemplate: FileSourceTemplateSummary;
+}
+
+const error = ref<string | null>(null);
+const props = defineProps<Props>();
+
+const inputs = computed<Array<any> | null>(() => {
+    const realizedInstance: UserFileSourceModel = props.instance;
+    const realizedLatestTemplate = props.latestTemplate;
+    const form = upgradeForm(realizedLatestTemplate, realizedInstance);
+    return form;
+});
+const title = computed(() => `Upgrade File Source ${props.instance.name}`);
+const submitTitle = "Update Settings";
+const loadingMessage = "Loading file source template and instance information";
+
+async function onSubmit(formData: any) {
+    const payload = upgradeFormDataToPayload(props.latestTemplate, formData);
+    const args = { user_file_source_id: String(props.instance.id) };
+    try {
+        const { data: fileSource } = await update({ ...args, ...payload });
+        await onUpgrade(fileSource);
+    } catch (e) {
+        error.value = errorMessageAsString(e);
+        return;
+    }
+}
+
+const { goToIndex } = useInstanceRouting();
+
+async function onUpgrade(fileSource: UserFileSourceModel) {
+    const message = `Upgraded file source ${fileSource.name}`;
+    goToIndex({ message });
+}
+</script>
+<template>
+    <div>
+        <BAlert v-if="error" variant="danger" class="file-source-instance-upgrade-error" show>
+            {{ error }}
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Instances/UpgradeInstance.vue b/client/src/components/FileSources/Instances/UpgradeInstance.vue
new file mode 100644
index 000000000000..a2aa1ed672f4
--- /dev/null
+++ b/client/src/components/FileSources/Instances/UpgradeInstance.vue
@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { computed, ref } from "vue";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import { useInstanceAndTemplate } from "./instance";
+
+import UpgradeForm from "./UpgradeForm.vue";
+import LoadingSpan from "@/components/LoadingSpan.vue";
+
+interface Props {
+    instanceId: number | string;
+}
+
+const props = defineProps<Props>();
+const { instance } = useInstanceAndTemplate(ref(props.instanceId));
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+const latestTemplate = computed(
+    () => instance.value && fileSourceTemplatesStore.getLatestTemplate(instance.value?.template_id)
+);
+</script>
+<template>
+    <LoadingSpan v-if="!instance || !latestTemplate" message="Loading file source instance and templates" />
+    <UpgradeForm v-else :instance="instance" :latest-template="latestTemplate" />
+</template>
diff --git a/client/src/components/FileSources/Instances/instance.ts b/client/src/components/FileSources/Instances/instance.ts
new file mode 100644
index 000000000000..f45fd6bf76dd
--- /dev/null
+++ b/client/src/components/FileSources/Instances/instance.ts
@@ -0,0 +1,23 @@
+import { computed, type Ref } from "vue";
+
+import type { FileSourceTemplateSummary, UserFileSourceModel } from "@/api/fileSources";
+import { useFileSourceInstancesStore } from "@/stores/fileSourceInstancesStore";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+export function useInstanceAndTemplate(instanceIdRef: Ref<string | number>) {
+    const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+    const fileSourceInstancesStore = useFileSourceInstancesStore();
+    fileSourceInstancesStore.fetchInstances();
+    fileSourceTemplatesStore.fetchTemplates();
+
+    const instance = computed<UserFileSourceModel | null>(
+        () => fileSourceInstancesStore.getInstance(instanceIdRef.value) || null
+    );
+    const template = computed<FileSourceTemplateSummary | null>(() =>
+        instance.value
+            ? fileSourceTemplatesStore.getTemplate(instance.value?.template_id, instance.value?.template_version)
+            : null
+    );
+
+    return { instance, template };
+}
diff --git a/client/src/components/FileSources/Instances/routing.ts b/client/src/components/FileSources/Instances/routing.ts
new file mode 100644
index 000000000000..6d2ed12bae6e
--- /dev/null
+++ b/client/src/components/FileSources/Instances/routing.ts
@@ -0,0 +1,16 @@
+import { useRouter } from "vue-router/composables";
+
+export function useInstanceRouting() {
+    const router = useRouter();
+
+    async function goToIndex(query: Record<"message", string>) {
+        router.push({
+            path: "/file_source_instances/index",
+            query: query,
+        });
+    }
+
+    return {
+        goToIndex,
+    };
+}
diff --git a/client/src/components/FileSources/Instances/services.ts b/client/src/components/FileSources/Instances/services.ts
new file mode 100644
index 000000000000..d5d4b8553826
--- /dev/null
+++ b/client/src/components/FileSources/Instances/services.ts
@@ -0,0 +1,4 @@
+import { fetcher } from "@/api/schema/fetcher";
+
+export const create = fetcher.path("/api/file_source_instances").method("post").create();
+export const update = fetcher.path("/api/file_source_instances/{user_file_source_id}").method("put").create();
diff --git a/client/src/components/FileSources/Templates/CreateUserFileSource.vue b/client/src/components/FileSources/Templates/CreateUserFileSource.vue
new file mode 100644
index 000000000000..5cc4a9f8e3aa
--- /dev/null
+++ b/client/src/components/FileSources/Templates/CreateUserFileSource.vue
@@ -0,0 +1,30 @@
+<script lang="ts" setup>
+import { computed } from "vue";
+import { useRouter } from "vue-router/composables";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import SelectTemplate from "./SelectTemplate.vue";
+import CreateInstance from "@/components/ConfigTemplates/CreateInstance.vue";
+
+const loadingTemplatesInfoMessage = "Loading file source templates";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+fileSourceTemplatesStore.ensureTemplates();
+
+const templates = computed(() => fileSourceTemplatesStore.latestTemplates);
+const loading = computed(() => fileSourceTemplatesStore.loading);
+
+const router = useRouter();
+
+async function chooseTemplate(selectTemplateId: string) {
+    router.push({
+        path: `/file_source_templates/${selectTemplateId}/new`,
+    });
+}
+</script>
+<template>
+    <CreateInstance :loading-message="loadingTemplatesInfoMessage" :loading="loading" prefix="file-source">
+        <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
+    </CreateInstance>
+</template>
diff --git a/client/src/components/FileSources/Templates/SelectTemplate.vue b/client/src/components/FileSources/Templates/SelectTemplate.vue
new file mode 100644
index 000000000000..6e45ab9f8d3d
--- /dev/null
+++ b/client/src/components/FileSources/Templates/SelectTemplate.vue
@@ -0,0 +1,39 @@
+<script lang="ts" setup>
+import type { FileSourceTemplateSummaries } from "@/api/fileSources";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+import SelectTemplate from "@/components/ConfigTemplates/SelectTemplate.vue";
+
+interface Props {
+    templates: FileSourceTemplateSummaries;
+}
+
+defineProps<Props>();
+
+const selectText =
+    "Select file source template to create new file sources with. These templates are configured by your Galaxy administrator.";
+
+const emit = defineEmits<{
+    (e: "onSubmit", id: string): void;
+}>();
+
+async function handleSubmit(templateId: string) {
+    emit("onSubmit", templateId);
+}
+</script>
+
+<template>
+    <div>
+        <SelectTemplate
+            :templates="templates"
+            :select-text="selectText"
+            id-prefix="file-source"
+            @onSubmit="handleSubmit">
+        </SelectTemplate>
+        <TemplateSummaryPopover
+            v-for="template in templates"
+            :key="template.id"
+            :target="`file-source-template-button-${template.id}`"
+            :template="template" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummary.vue b/client/src/components/FileSources/Templates/TemplateSummary.vue
new file mode 100644
index 000000000000..6cef09f37ed1
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummary.vue
@@ -0,0 +1,22 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+
+import FileSourceTypeSpan from "@/components/FileSources/FileSourceTypeSpan.vue";
+import ConfigurationMarkdown from "@/components/ObjectStore/ConfigurationMarkdown.vue";
+
+interface Props {
+    template: FileSourceTemplateSummary;
+}
+
+const props = defineProps<Props>();
+const fileSourceType = computed(() => props.template.type);
+</script>
+
+<template>
+    <div>
+        <div>This template produces file sources of type <FileSourceTypeSpan :type="fileSourceType" />.</div>
+        <ConfigurationMarkdown :markdown="template.description || ''" :admin="true" />
+    </div>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue b/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue
new file mode 100644
index 000000000000..c056e03d9b72
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummaryPopover.vue
@@ -0,0 +1,19 @@
+<script lang="ts" setup>
+import type { FileSourceTemplateSummary } from "@/api/fileSources";
+
+import TemplateSummary from "./TemplateSummary.vue";
+import TemplateSummaryPopover from "@/components/ConfigTemplates/TemplateSummaryPopover.vue";
+
+interface Props {
+    target: String;
+    template: FileSourceTemplateSummary;
+}
+
+defineProps<Props>();
+</script>
+
+<template>
+    <TemplateSummaryPopover :target="target" :template="template">
+        <TemplateSummary :template="template" />
+    </TemplateSummaryPopover>
+</template>
diff --git a/client/src/components/FileSources/Templates/TemplateSummarySpan.vue b/client/src/components/FileSources/Templates/TemplateSummarySpan.vue
new file mode 100644
index 000000000000..1c4291dc3aad
--- /dev/null
+++ b/client/src/components/FileSources/Templates/TemplateSummarySpan.vue
@@ -0,0 +1,32 @@
+<script setup lang="ts">
+import { computed } from "vue";
+
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const fileSourceTemplatesStore = useFileSourceTemplatesStore();
+
+interface Props {
+    templateId: string;
+    templateVersion: number;
+}
+
+const props = defineProps<Props>();
+
+const template = computed(() => fileSourceTemplatesStore.getTemplate(props.templateId, props.templateVersion));
+const target = `template-summary-span-${crypto.randomUUID()}`;
+fileSourceTemplatesStore.ensureTemplates();
+</script>
+
+<template>
+    <span>
+        <span v-if="template">
+            <span :id="target">
+                {{ template.name }}
+            </span>
+            <TemplateSummaryPopover :template="template" :target="target" />
+        </span>
+        <span v-else> Loading template information for {{ templateId }} {{ templateVersion }} </span>
+    </span>
+</template>
diff --git a/client/src/components/FileSources/style.css b/client/src/components/FileSources/style.css
new file mode 100644
index 000000000000..c2962e44de2e
--- /dev/null
+++ b/client/src/components/FileSources/style.css
@@ -0,0 +1,4 @@
+.file-source-help-on-hover {
+    text-decoration-line: underline;
+    text-decoration-style: dashed;
+}
diff --git a/client/src/components/ObjectStore/Instances/CreateForm.test.ts b/client/src/components/ObjectStore/Instances/CreateForm.test.ts
index 381817bc8d5f..0c631d31c0a8 100644
--- a/client/src/components/ObjectStore/Instances/CreateForm.test.ts
+++ b/client/src/components/ObjectStore/Instances/CreateForm.test.ts
@@ -14,7 +14,7 @@ const FAKE_OBJECT_STORE = "A fake object store";
 const localVue = getLocalVue(true);
 
 const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
@@ -36,7 +36,7 @@ const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
 };
 
 const SIMPLE_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
diff --git a/client/src/components/ObjectStore/Instances/CreateForm.vue b/client/src/components/ObjectStore/Instances/CreateForm.vue
index e82f0f1c484a..ddadbfccda65 100644
--- a/client/src/components/ObjectStore/Instances/CreateForm.vue
+++ b/client/src/components/ObjectStore/Instances/CreateForm.vue
@@ -1,18 +1,15 @@
 <script lang="ts" setup>
+import { BAlert } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
-import { create } from "@/components/ObjectStore/Instances/services";
-import type { SecretData, UserConcreteObjectStore, VariableData } from "@/components/ObjectStore/Instances/types";
-import {
-    metadataFormEntryDescription,
-    metadataFormEntryName,
-    templateSecretFormEntry,
-    templateVariableFormEntry,
-} from "@/components/ObjectStore/Instances/util";
+import { createFormDataToPayload, createTemplateForm } from "@/components/ConfigTemplates/formUtil";
+import type { UserConcreteObjectStore } from "@/components/ObjectStore/Instances/types";
 import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templates/types";
 import { errorMessageAsString } from "@/utils/simple-error";
 
-import InstanceForm from "./InstanceForm.vue";
+import { create } from "./services";
+
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface CreateFormProps {
     template: ObjectStoreTemplateSummary;
@@ -21,43 +18,14 @@ const error = ref<string | null>(null);
 const props = defineProps<CreateFormProps>();
 const title = "Create a new storage location for your data";
 const submitTitle = "Submit";
+const loadingMessage = "Loading storage location template and instance information";
 
 const inputs = computed(() => {
-    const form = [];
-    const variables = props.template.variables ?? [];
-    const secrets = props.template.secrets ?? [];
-    form.push(metadataFormEntryName());
-    form.push(metadataFormEntryDescription());
-    for (const variable of variables) {
-        form.push(templateVariableFormEntry(variable, undefined));
-    }
-    for (const secret of secrets) {
-        form.push(templateSecretFormEntry(secret));
-    }
-    return form;
+    return createTemplateForm(props.template, "storage location");
 });
 
 async function onSubmit(formData: any) {
-    const variables = props.template.variables ?? [];
-    const secrets = props.template.secrets ?? [];
-    const variableData: VariableData = {};
-    const secretData: SecretData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
-    }
-    for (const secret of secrets) {
-        secretData[secret.name] = formData[secret.name];
-    }
-    const name: string = formData._meta_name;
-    const description: string = formData._meta_description;
-    const payload = {
-        name: name,
-        description: description,
-        secrets: secretData,
-        variables: variableData,
-        template_id: props.template.id,
-        template_version: props.template.version ?? 0,
-    };
+    const payload = createFormDataToPayload(props.template, formData);
     try {
         const { data: objectStore } = await create(payload);
         emit("created", objectStore);
@@ -72,10 +40,15 @@ const emit = defineEmits<{
 }>();
 </script>
 <template>
-    <div>
-        <b-alert v-if="error" variant="danger" class="object-store-instance-creation-error" show>
+    <div id="create-object-store-landing">
+        <BAlert v-if="error" variant="danger" class="object-store-instance-creation-error" show>
             {{ error }}
-        </b-alert>
-        <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/EditInstance.vue b/client/src/components/ObjectStore/Instances/EditInstance.vue
index 16e4dd9c4631..2569be940178 100644
--- a/client/src/components/ObjectStore/Instances/EditInstance.vue
+++ b/client/src/components/ObjectStore/Instances/EditInstance.vue
@@ -1,19 +1,16 @@
 <script setup lang="ts">
+import { BTab, BTabs } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
-import {
-    metadataFormEntryDescription,
-    metadataFormEntryName,
-    templateVariableFormEntry,
-} from "@/components/ObjectStore/Instances/util";
+import { editFormDataToPayload, editTemplateForm } from "@/components/ConfigTemplates/formUtil";
 
 import { useInstanceAndTemplate } from "./instance";
 import { useInstanceRouting } from "./routing";
 import { update } from "./services";
-import type { UserConcreteObjectStore, VariableData } from "./types";
+import type { UserConcreteObjectStore } from "./types";
 
 import EditSecrets from "./EditSecrets.vue";
-import InstanceForm from "./InstanceForm.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface Props {
     instanceId: number | string;
@@ -23,47 +20,26 @@ const props = defineProps<Props>();
 const { instance, template } = useInstanceAndTemplate(ref(props.instanceId));
 
 const inputs = computed(() => {
-    if (!template.value || !instance.value) {
-        return null;
-    }
-    const form = [];
-    const nameInput = metadataFormEntryName();
-    form.push({ value: instance?.value?.name ?? "", ...nameInput });
-
-    const descriptionInput = metadataFormEntryDescription();
-    form.push({ value: instance?.value?.description ?? "", ...descriptionInput });
-
+    template.value;
+    instance.value;
     if (template.value && instance.value) {
-        const realizedInstance: UserConcreteObjectStore = instance.value;
-        const variables = template.value?.variables ?? [];
-        const variableValues: VariableData = realizedInstance.variables || {};
-        for (const variable of variables) {
-            form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
-        }
+        return editTemplateForm(template.value, "storage location", instance.value);
     }
-    return form;
+    return null;
 });
 
 const title = computed(() => `Edit Storage Location ${instance.value?.name} Settings`);
 const hasSecrets = computed(() => instance.value?.secrets && instance.value?.secrets.length > 0);
 const submitTitle = "Update Settings";
+const loadingMessage = "Loading storage location template and instance information";
 
 async function onSubmit(formData: any) {
-    const variables = template?.value?.variables ?? [];
-    const name = formData["_meta_name"];
-    const description = formData["_meta_description"];
-    const variableData: VariableData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
+    if (template.value) {
+        const payload = editFormDataToPayload(template.value, formData);
+        const args = { user_object_store_id: String(instance?.value?.id) };
+        const { data: objectStore } = await update({ ...args, ...payload });
+        await onUpdate(objectStore);
     }
-    const payload = {
-        name: name,
-        description: description,
-        variables: variableData,
-    };
-    const args = { user_object_store_id: String(instance?.value?.id) };
-    const { data: objectStore } = await update({ ...args, ...payload });
-    await onUpdate(objectStore);
 }
 
 const { goToIndex } = useInstanceRouting();
@@ -75,16 +51,27 @@ async function onUpdate(objectStore: UserConcreteObjectStore) {
 </script>
 <template>
     <div>
-        <b-tabs v-if="hasSecrets">
-            <b-tab title="Settings" active>
-                <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
-            </b-tab>
-            <b-tab title="Secrets">
+        <BTabs v-if="hasSecrets">
+            <BTab title="Settings" active>
+                <InstanceForm
+                    :inputs="inputs"
+                    :title="title"
+                    :submit-title="submitTitle"
+                    :loading-message="loadingMessage"
+                    @onSubmit="onSubmit" />
+            </BTab>
+            <BTab title="Secrets">
                 <div v-if="instance && template">
                     <EditSecrets :object-store="instance" :template="template" />
                 </div>
-            </b-tab>
-        </b-tabs>
-        <InstanceForm v-else :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+            </BTab>
+        </BTabs>
+        <InstanceForm
+            v-else
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/EditSecrets.vue b/client/src/components/ObjectStore/Instances/EditSecrets.vue
index 42038241d42d..56c1e7cd9641 100644
--- a/client/src/components/ObjectStore/Instances/EditSecrets.vue
+++ b/client/src/components/ObjectStore/Instances/EditSecrets.vue
@@ -6,8 +6,7 @@ import type { ObjectStoreTemplateSummary } from "@/components/ObjectStore/Templa
 import { update } from "./services";
 import type { UserConcreteObjectStore } from "./types";
 
-import VaultSecret from "./VaultSecret.vue";
-import FormCard from "@/components/Form/FormCard.vue";
+import EditSecretsForm from "@/components/ConfigTemplates/EditSecretsForm.vue";
 
 interface Props {
     objectStore: UserConcreteObjectStore;
@@ -26,14 +25,5 @@ async function onUpdate(secretName: string, secretValue: string) {
 }
 </script>
 <template>
-    <FormCard :title="title">
-        <template v-slot:body>
-            <div>
-                <div v-for="secret in template.secrets" :key="secret.name">
-                    <VaultSecret :name="secret.name" :help="secret.help || ''" :is-set="true" @update="onUpdate">
-                    </VaultSecret>
-                </div>
-            </div>
-        </template>
-    </FormCard>
+    <EditSecretsForm :title="title" :template="template" @update="onUpdate" />
 </template>
diff --git a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
index aaa2836c8289..475d802d391b 100644
--- a/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
+++ b/client/src/components/ObjectStore/Instances/InstanceDropdown.vue
@@ -1,19 +1,13 @@
 <script setup lang="ts">
-import "./icons";
-
-import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { computed } from "vue";
-import { useRouter } from "vue-router/composables";
 
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 
 import type { UserConcreteObjectStore } from "./types";
 
-const objectStoreTemplatesStore = useObjectStoreTemplatesStore();
-const router = useRouter();
+import InstanceDropdown from "@/components/ConfigTemplates/InstanceDropdown.vue";
 
-// TODO?
-const title = "";
+const objectStoreTemplatesStore = useObjectStoreTemplatesStore();
 
 interface Props {
     objectStore: UserConcreteObjectStore;
@@ -28,30 +22,10 @@ const isUpgradable = computed(() =>
 </script>
 
 <template>
-    <div>
-        <b-link
-            v-b-tooltip.hover
-            class="object-store-instance-dropdown font-weight-bold"
-            data-toggle="dropdown"
-            :title="title"
-            aria-haspopup="true"
-            aria-expanded="false">
-            <FontAwesomeIcon icon="caret-down" />
-            <span class="instance-dropdown-name">{{ props.objectStore.name }}</span>
-        </b-link>
-        <div class="dropdown-menu" aria-labelledby="object-store-instance-dropdown">
-            <a
-                v-if="isUpgradable"
-                class="dropdown-item"
-                @keypress="router.push(routeUpgrade)"
-                @click.prevent="router.push(routeUpgrade)">
-                <span class="fa fa-edit fa-fw mr-1" />
-                <span v-localize>Upgrade</span>
-            </a>
-            <a class="dropdown-item" @keypress="router.push(routeEdit)" @click.prevent="router.push(routeEdit)">
-                <span class="fa fa-edit fa-fw mr-1" />
-                <span v-localize>Edit configuration</span>
-            </a>
-        </div>
-    </div>
+    <InstanceDropdown
+        prefix="object-store"
+        :name="objectStore.name || ''"
+        :is-upgradable="isUpgradable"
+        :route-upgrade="routeUpgrade"
+        :route-edit="routeEdit" />
 </template>
diff --git a/client/src/components/ObjectStore/Instances/ManageIndex.vue b/client/src/components/ObjectStore/Instances/ManageIndex.vue
index 9695f492dad2..62da3e4a6aeb 100644
--- a/client/src/components/ObjectStore/Instances/ManageIndex.vue
+++ b/client/src/components/ObjectStore/Instances/ManageIndex.vue
@@ -1,20 +1,20 @@
 <script setup lang="ts">
-import "./icons";
+import "@/components/ConfigTemplates/icons";
 
-import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
+import { BTable } from "bootstrap-vue";
 import { computed } from "vue";
-import { useRouter } from "vue-router/composables";
 
+import { DESCRIPTION_FIELD, NAME_FIELD, TEMPLATE_FIELD, TYPE_FIELD } from "@/components/ConfigTemplates/fields";
 import { useObjectStoreInstancesStore } from "@/stores/objectStoreInstancesStore";
 import _l from "@/utils/localization";
 
 import InstanceDropdown from "./InstanceDropdown.vue";
+import ManageIndexHeader from "@/components/ConfigTemplates/ManageIndexHeader.vue";
 import LoadingSpan from "@/components/LoadingSpan.vue";
 import ObjectStoreBadges from "@/components/ObjectStore/ObjectStoreBadges.vue";
 import ObjectStoreTypeSpan from "@/components/ObjectStore/ObjectStoreTypeSpan.vue";
 import TemplateSummarySpan from "@/components/ObjectStore/Templates/TemplateSummarySpan.vue";
 
-const router = useRouter();
 const objectStoreInstancesStore = useObjectStoreInstancesStore();
 
 interface Props {
@@ -23,33 +23,13 @@ interface Props {
 
 defineProps<Props>();
 
-const fields = [
-    {
-        key: "name",
-        label: _l("Name"),
-        sortable: true,
-    },
-    {
-        key: "description",
-        label: _l("Description"),
-        sortable: true,
-    },
-    {
-        key: "type",
-        label: _l("Type"),
-        sortable: true,
-    },
-    {
-        key: "template",
-        label: _l("From Template"),
-        sortable: true,
-    },
-    {
-        key: "badges",
-        label: _l(" "),
-        sortable: false,
-    },
-];
+const BADGE_FIELD = {
+    key: "badges",
+    label: _l(" "),
+    sortable: false,
+};
+
+const fields = [NAME_FIELD, DESCRIPTION_FIELD, TYPE_FIELD, TEMPLATE_FIELD, BADGE_FIELD];
 
 const items = computed(() => objectStoreInstancesStore.getInstances);
 const loading = computed(() => objectStoreInstancesStore.loading);
@@ -58,21 +38,13 @@ objectStoreInstancesStore.fetchInstances();
 
 <template>
     <div>
-        <p>
-            {{ message || "" }}
-        </p>
-        <b-row class="mb-3">
-            <b-col>
-                <b-button
-                    id="object-store-create"
-                    class="m-1 float-right"
-                    @click="router.push('/object_store_instances/create')">
-                    <FontAwesomeIcon icon="plus" />
-                    {{ _l("Create") }}
-                </b-button>
-            </b-col>
-        </b-row>
-        <b-table
+        <ManageIndexHeader
+            :message="message"
+            create-button-id="object-store-create"
+            create-route="/object_store_instances/create">
+        </ManageIndexHeader>
+        <BTable
+            id="user-object-stores-index"
             no-sort-reset
             :fields="fields"
             :items="items"
@@ -101,6 +73,6 @@ objectStoreInstancesStore.fetchInstances();
                     :template-version="row.item.template_version ?? 0"
                     :template-id="row.item.template_id" />
             </template>
-        </b-table>
+        </BTable>
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts b/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
index e15a005edb49..5ff29a9a64d2 100644
--- a/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
+++ b/client/src/components/ObjectStore/Instances/UpgradeForm.test.ts
@@ -15,7 +15,7 @@ const localVue = getLocalVue(true);
 const router = injectTestRouter(localVue);
 
 const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: null,
     variables: [
@@ -46,7 +46,7 @@ const STANDARD_TEMPLATE: ObjectStoreTemplateSummary = {
 };
 
 const INSTANCE: UserConcreteObjectStore = {
-    type: "s3",
+    type: "aws_s3",
     name: "moo",
     description: undefined,
     template_id: "moo",
diff --git a/client/src/components/ObjectStore/Instances/UpgradeForm.vue b/client/src/components/ObjectStore/Instances/UpgradeForm.vue
index 3b405cc3660b..c3285eda662a 100644
--- a/client/src/components/ObjectStore/Instances/UpgradeForm.vue
+++ b/client/src/components/ObjectStore/Instances/UpgradeForm.vue
@@ -1,15 +1,16 @@
 <script setup lang="ts">
+import { BAlert } from "bootstrap-vue";
 import { computed, ref } from "vue";
 
+import { upgradeForm, upgradeFormDataToPayload } from "@/components/ConfigTemplates/formUtil";
 import { errorMessageAsString } from "@/utils/simple-error";
 
 import type { ObjectStoreTemplateSummary } from "../Templates/types";
 import { useInstanceRouting } from "./routing";
 import { update } from "./services";
-import type { UserConcreteObjectStore, VariableData } from "./types";
-import { templateSecretFormEntry, templateVariableFormEntry } from "./util";
+import type { UserConcreteObjectStore } from "./types";
 
-import InstanceForm from "./InstanceForm.vue";
+import InstanceForm from "@/components/ConfigTemplates/InstanceForm.vue";
 
 interface Props {
     instance: UserConcreteObjectStore;
@@ -20,45 +21,17 @@ const error = ref<string | null>(null);
 const props = defineProps<Props>();
 
 const inputs = computed<Array<any> | null>(() => {
-    const form = [];
     const realizedInstance: UserConcreteObjectStore = props.instance;
     const realizedLatestTemplate = props.latestTemplate;
-    const variables = realizedLatestTemplate.variables ?? [];
-    const secrets = realizedLatestTemplate.secrets ?? [];
-    const variableValues: VariableData = realizedInstance.variables || {};
-    const secretsSet = realizedInstance.secrets || [];
-    for (const variable of variables) {
-        form.push(templateVariableFormEntry(variable, variableValues[variable.name]));
-    }
-    for (const secret of secrets) {
-        const secretName = secret.name;
-        if (secretsSet.indexOf(secretName) >= 0) {
-            console.log("skipping...");
-        } else {
-            form.push(templateSecretFormEntry(secret));
-        }
-    }
+    const form = upgradeForm(realizedLatestTemplate, realizedInstance);
     return form;
 });
 const title = computed(() => `Upgrade Object Store ${props.instance.name}`);
 const submitTitle = "Update Settings";
+const loadingMessage = "Loading storage location template and instance information";
 
 async function onSubmit(formData: any) {
-    const variables = props.latestTemplate.variables ?? [];
-    const variableData: VariableData = {};
-    for (const variable of variables) {
-        variableData[variable.name] = formData[variable.name];
-    }
-    const secrets = {};
-    // ideally we would be able to force a template version here,
-    // maybe rework backend types to force this in the API response
-    // even if we don't need it in the config files
-    const templateVersion: number = props.latestTemplate.version || 0;
-    const payload = {
-        template_version: templateVersion,
-        variables: variableData,
-        secrets: secrets,
-    };
+    const payload = upgradeFormDataToPayload(props.latestTemplate, formData);
     const args = { user_object_store_id: String(props.instance.id) };
     try {
         const { data: objectStore } = await update({ ...args, ...payload });
@@ -78,9 +51,14 @@ async function onUpgrade(objectStore: UserConcreteObjectStore) {
 </script>
 <template>
     <div>
-        <b-alert v-if="error" variant="danger" class="object-store-instance-upgrade-error" show>
+        <BAlert v-if="error" variant="danger" class="object-store-instance-upgrade-error" show>
             {{ error }}
-        </b-alert>
-        <InstanceForm :inputs="inputs" :title="title" :submit-title="submitTitle" @onSubmit="onSubmit" />
+        </BAlert>
+        <InstanceForm
+            :inputs="inputs"
+            :title="title"
+            :submit-title="submitTitle"
+            :loading-message="loadingMessage"
+            @onSubmit="onSubmit" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Instances/types.ts b/client/src/components/ObjectStore/Instances/types.ts
index bd956468c7b8..0176eaec757a 100644
--- a/client/src/components/ObjectStore/Instances/types.ts
+++ b/client/src/components/ObjectStore/Instances/types.ts
@@ -2,8 +2,3 @@ import type { components } from "@/api/schema/schema";
 
 export type UserConcreteObjectStore = components["schemas"]["UserConcreteObjectStoreModel"];
 export type CreateInstancePayload = components["schemas"]["CreateInstancePayload"];
-export type ObjectStoreTemplateVariable = components["schemas"]["ObjectStoreTemplateVariable"];
-export type ObjectStoreTemplateSecret = components["schemas"]["ObjectStoreTemplateSecret"];
-export type VariableValueType = (string | boolean | number) | undefined;
-export type VariableData = { [key: string]: VariableValueType };
-export type SecretData = { [key: string]: string };
diff --git a/client/src/components/ObjectStore/Instances/util.ts b/client/src/components/ObjectStore/Instances/util.ts
deleted file mode 100644
index 77b99b11d73f..000000000000
--- a/client/src/components/ObjectStore/Instances/util.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-import { markup } from "@/components/ObjectStore/configurationMarkdown";
-
-import type { ObjectStoreTemplateSecret, ObjectStoreTemplateVariable, VariableValueType } from "./types";
-
-export function metadataFormEntryName() {
-    return {
-        name: "_meta_name",
-        label: "Name",
-        type: "text",
-        optional: false,
-        help: "Label this new object store a name.",
-    };
-}
-
-export function metadataFormEntryDescription() {
-    return {
-        name: "_meta_description",
-        label: "Description",
-        optional: true,
-        type: "textarea",
-        help: "Provide some notes to yourself about this object store - perhaps to remind you how it is configured, where it stores the data, etc..",
-    };
-}
-
-export function templateVariableFormEntry(variable: ObjectStoreTemplateVariable, variableValue: VariableValueType) {
-    return {
-        name: variable.name,
-        type: "text",
-        help: markup(variable.help || "", true),
-        value: variableValue,
-    };
-}
-
-export function templateSecretFormEntry(secret: ObjectStoreTemplateSecret) {
-    return {
-        name: secret.name,
-        type: "password",
-        help: markup(secret.help || "", true),
-        value: "",
-    };
-}
diff --git a/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue b/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
index 7ed555be53dc..f783b34b4f82 100644
--- a/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
+++ b/client/src/components/ObjectStore/Templates/CreateUserObjectStore.vue
@@ -1,11 +1,11 @@
 <script lang="ts" setup>
-import { computed, ref } from "vue";
+import { computed } from "vue";
 import { useRouter } from "vue-router/composables";
 
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 
 import SelectTemplate from "./SelectTemplate.vue";
-import LoadingSpan from "@/components/LoadingSpan.vue";
+import CreateInstance from "@/components/ConfigTemplates/CreateInstance.vue";
 
 const loadingTemplatesInfoMessage = "Loading storage location templates";
 
@@ -17,8 +17,6 @@ const loading = computed(() => objectStoreTemplatesStore.loading);
 
 const router = useRouter();
 
-const error = ref<string | null>(null);
-
 async function chooseTemplate(selectTemplateId: string) {
     router.push({
         path: `/object_store_templates/${selectTemplateId}/new`,
@@ -26,14 +24,7 @@ async function chooseTemplate(selectTemplateId: string) {
 }
 </script>
 <template>
-    <b-container fluid class="p-0">
-        <LoadingSpan v-if="loading" :message="loadingTemplatesInfoMessage" />
-        <div v-else>
-            <b-alert v-if="error" variant="danger" class="object-store-selection-error" show>
-                {{ error }}
-            </b-alert>
-
-            <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
-        </div>
-    </b-container>
+    <CreateInstance :loading-message="loadingTemplatesInfoMessage" :loading="loading" prefix="object-store">
+        <SelectTemplate :templates="templates" @onSubmit="chooseTemplate" />
+    </CreateInstance>
 </template>
diff --git a/client/src/components/ObjectStore/Templates/SelectTemplate.vue b/client/src/components/ObjectStore/Templates/SelectTemplate.vue
index 5e99fbb0807c..a8e8362eb83a 100644
--- a/client/src/components/ObjectStore/Templates/SelectTemplate.vue
+++ b/client/src/components/ObjectStore/Templates/SelectTemplate.vue
@@ -2,6 +2,7 @@
 import type { ObjectStoreTemplateSummaries } from "./types";
 
 import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+import SelectTemplate from "@/components/ConfigTemplates/SelectTemplate.vue";
 
 interface SelectTemplateProps {
     templates: ObjectStoreTemplateSummaries;
@@ -23,26 +24,12 @@ async function handleSubmit(templateId: string) {
 
 <template>
     <div>
-        <b-row>
-            <b-col cols="7">
-                <b-button-group vertical size="lg" style="width: 100%">
-                    <b-button
-                        v-for="template in templates"
-                        :id="`object-store-template-button-${template.id}`"
-                        :key="template.id"
-                        class="object-store-template-select-button"
-                        :data-template-id="template.id"
-                        @click="handleSubmit(template.id)"
-                        >{{ template.name }}
-                    </b-button>
-                </b-button-group>
-            </b-col>
-            <b-col cols="5">
-                <p v-localize style="float: right">
-                    {{ selectText }}
-                </p>
-            </b-col>
-        </b-row>
+        <SelectTemplate
+            :templates="templates"
+            :select-text="selectText"
+            id-prefix="object-store"
+            @onSubmit="handleSubmit">
+        </SelectTemplate>
         <TemplateSummaryPopover
             v-for="template in templates"
             :key="template.id"
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummary.vue b/client/src/components/ObjectStore/Templates/TemplateSummary.vue
index c970cb707ac2..ddb84e9527f9 100644
--- a/client/src/components/ObjectStore/Templates/TemplateSummary.vue
+++ b/client/src/components/ObjectStore/Templates/TemplateSummary.vue
@@ -22,7 +22,7 @@ const objectStoreType = computed(() => props.template.type);
 <template>
     <div>
         <ObjectStoreBadges :badges="badges" size="lg" />
-        <div>This template produces object stores of type <ObjectStoreTypeSpan :type="objectStoreType" />.</div>
+        <div>This template produces storage locations of type <ObjectStoreTypeSpan :type="objectStoreType" />.</div>
         <ConfigurationMarkdown :markdown="template.description || ''" :admin="true" />
     </div>
 </template>
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts
new file mode 100644
index 000000000000..42dc20584874
--- /dev/null
+++ b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.test.ts
@@ -0,0 +1,22 @@
+import { shallowMount } from "@vue/test-utils";
+import { getLocalVue } from "tests/jest/helpers";
+
+import { STANDARD_OBJECT_STORE_TEMPLATE } from "@/components/ConfigTemplates/test_fixtures";
+
+import TemplateSummaryPopover from "./TemplateSummaryPopover.vue";
+
+const localVue = getLocalVue(true);
+
+describe("TemplateSummaryPopover", () => {
+    it("should render a popover", async () => {
+        const wrapper = shallowMount(TemplateSummaryPopover, {
+            propsData: {
+                target: "test-target-1",
+                template: STANDARD_OBJECT_STORE_TEMPLATE,
+            },
+            localVue,
+        });
+        const configPopover = wrapper.find("[target='test-target-1']");
+        expect(configPopover.exists()).toBeTruthy();
+    });
+});
diff --git a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
index 868dca4ff83b..df9f9b5f05f1 100644
--- a/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
+++ b/client/src/components/ObjectStore/Templates/TemplateSummaryPopover.vue
@@ -2,20 +2,18 @@
 import type { ObjectStoreTemplateSummary } from "./types";
 
 import TemplateSummary from "./TemplateSummary.vue";
+import TemplateSummaryPopover from "@/components/ConfigTemplates/TemplateSummaryPopover.vue";
 
 interface Props {
     target: String;
     template: ObjectStoreTemplateSummary;
 }
 
-const props = defineProps<Props>();
-
-const popoverPlacement = "rightbottom";
+defineProps<Props>();
 </script>
 
 <template>
-    <b-popover :target="target" triggers="hover" boundary="window" :placement="popoverPlacement">
-        <template v-slot:title>{{ props.template.name }}</template>
-        <TemplateSummary :template="props.template" />
-    </b-popover>
+    <TemplateSummaryPopover :target="target" :template="template">
+        <TemplateSummary :template="template" />
+    </TemplateSummaryPopover>
 </template>
diff --git a/client/src/components/User/UserPreferences.vue b/client/src/components/User/UserPreferences.vue
index 6807bda7f47a..47197e0ad92e 100644
--- a/client/src/components/User/UserPreferences.vue
+++ b/client/src/components/User/UserPreferences.vue
@@ -93,13 +93,21 @@
             :user-id="userId">
         </UserPreferredObjectStore>
         <UserPreferencesElement
-            v-if="hasTemplates"
+            v-if="hasObjectStoreTemplates"
             id="manage-object-stores"
             class="manage-object-stores"
             icon="fa-hdd"
             title="Manage Your Storage Locations"
             description="Add, remove, or update your personally configured storage locations."
             to="/object_store_instances/index" />
+        <UserPreferencesElement
+            v-if="hasFileSourceTemplates"
+            id="manage-file-sources"
+            class="manage-file-sources"
+            icon="fa-file"
+            title="Manage Your Remote File Sources"
+            description="Add, remove, or update your personally configured location to find files from and write files to."
+            to="/file_source_instances/index" />
         <UserDeletion
             v-if="isConfigLoaded && !config.single_user && config.enable_account_interface"
             :email="email"
@@ -144,6 +152,7 @@ import { withPrefix } from "utils/redirect";
 import Vue from "vue";
 
 import { useConfig } from "@/composables/config";
+import { useFileSourceTemplatesStore } from "@/stores/fileSourceTemplatesStore";
 import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore";
 import { useUserStore } from "@/stores/userStore";
 
@@ -192,7 +201,12 @@ export default {
     },
     computed: {
         ...mapState(useUserStore, ["currentUser"]),
-        ...mapState(useObjectStoreTemplatesStore, ["hasTemplates"]),
+        ...mapState(useObjectStoreTemplatesStore, {
+            hasObjectStoreTemplates: "hasTemplates",
+        }),
+        ...mapState(useFileSourceTemplatesStore, {
+            hasFileSourceTemplates: "hasTemplates",
+        }),
         activePreferences() {
             const userPreferencesEntries = Object.entries(getUserPreferencesModel());
             // Object.entries returns an array of arrays, where the first element
@@ -232,10 +246,16 @@ export default {
             this.diskUsage = response.data.nice_total_disk_usage;
             this.diskQuota = response.data.quota;
         });
-        this.ensureTemplates();
+        this.ensureObjectStoreTemplates();
+        this.ensureFileSourceTemplates();
     },
     methods: {
-        ...mapActions(useObjectStoreTemplatesStore, ["ensureTemplates"]),
+        ...mapActions(useObjectStoreTemplatesStore, {
+            ensureObjectStoreTemplates: "ensureTemplates",
+        }),
+        ...mapActions(useFileSourceTemplatesStore, {
+            ensureFileSourceTemplates: "ensureTemplates",
+        }),
         toggleNotifications() {
             if (window.Notification) {
                 Notification.requestPermission().then(function (permission) {
diff --git a/client/src/entry/analysis/router.js b/client/src/entry/analysis/router.js
index 03cd5a170145..8a21b77e6a82 100644
--- a/client/src/entry/analysis/router.js
+++ b/client/src/entry/analysis/router.js
@@ -56,21 +56,26 @@ import Vue from "vue";
 import VueRouter from "vue-router";
 
 import AvailableDatatypes from "@/components/AvailableDatatypes/AvailableDatatypes";
+import CreateFileSourceInstance from "@/components/FileSources/Instances/CreateInstance";
 import GridHistory from "@/components/Grid/GridHistory";
 import GridPage from "@/components/Grid/GridPage";
-import CreateInstance from "@/components/ObjectStore/Instances/CreateInstance";
+import CreateObjectStoreInstance from "@/components/ObjectStore/Instances/CreateInstance";
 import { parseBool } from "@/utils/utils";
 
 import { patchRouterPush } from "./router-push";
 
 import AboutGalaxy from "@/components/AboutGalaxy.vue";
+import EditFileSourceInstance from "@/components/FileSources/Instances/EditInstance.vue";
+import ManageFileSourceIndex from "@/components/FileSources/Instances/ManageIndex.vue";
+import UpgradeFileSourceInstance from "@/components/FileSources/Instances/UpgradeInstance.vue";
+import CreateUserFileSource from "@/components/FileSources/Templates/CreateUserFileSource.vue";
 import GridVisualization from "@/components/Grid/GridVisualization.vue";
 import HistoryArchiveWizard from "@/components/History/Archiving/HistoryArchiveWizard.vue";
 import HistoryDatasetPermissions from "@/components/History/HistoryDatasetPermissions.vue";
 import NotificationsList from "@/components/Notifications/NotificationsList.vue";
-import EditInstance from "@/components/ObjectStore/Instances/EditInstance.vue";
-import ManageIndex from "@/components/ObjectStore/Instances/ManageIndex.vue";
-import UpgradeInstance from "@/components/ObjectStore/Instances/UpgradeInstance.vue";
+import EditObjectStoreInstance from "@/components/ObjectStore/Instances/EditInstance.vue";
+import ManageObjectStoreIndex from "@/components/ObjectStore/Instances/ManageIndex.vue";
+import UpgradeObjectStoreInstance from "@/components/ObjectStore/Instances/UpgradeInstance.vue";
 import CreateUserObjectStore from "@/components/ObjectStore/Templates/CreateUserObjectStore.vue";
 import Sharing from "@/components/Sharing/SharingPage.vue";
 import HistoryStorageOverview from "@/components/User/DiskUsage/Visualizations/HistoryStorageOverview.vue";
@@ -356,24 +361,50 @@ export function getRouter(Galaxy) {
                     },
                     {
                         path: "object_store_instances/index",
-                        component: ManageIndex,
+                        component: ManageObjectStoreIndex,
                         props: (route) => {
                             return { message: route.query["message"] };
                         },
                     },
                     {
                         path: "object_store_instances/:instanceId/edit",
-                        component: EditInstance,
+                        component: EditObjectStoreInstance,
                         props: true,
                     },
                     {
                         path: "object_store_instances/:instanceId/upgrade",
-                        component: UpgradeInstance,
+                        component: UpgradeObjectStoreInstance,
                         props: true,
                     },
                     {
                         path: "object_store_templates/:templateId/new",
-                        component: CreateInstance,
+                        component: CreateObjectStoreInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_instances/create",
+                        component: CreateUserFileSource,
+                    },
+                    {
+                        path: "file_source_instances/index",
+                        component: ManageFileSourceIndex,
+                        props: (route) => {
+                            return { message: route.query["message"] };
+                        },
+                    },
+                    {
+                        path: "file_source_instances/:instanceId/edit",
+                        component: EditFileSourceInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_instances/:instanceId/upgrade",
+                        component: UpgradeFileSourceInstance,
+                        props: true,
+                    },
+                    {
+                        path: "file_source_templates/:templateId/new",
+                        component: CreateFileSourceInstance,
                         props: true,
                     },
                     {
diff --git a/client/src/stores/configTemplatesUtil.ts b/client/src/stores/configTemplatesUtil.ts
new file mode 100644
index 000000000000..2baeab3acb58
--- /dev/null
+++ b/client/src/stores/configTemplatesUtil.ts
@@ -0,0 +1,56 @@
+import type { TemplateSummary } from "@/api/configTemplates";
+
+export function findTemplate<T extends TemplateSummary>(
+    templates: T[],
+    templateId: string,
+    templateVersion: number
+): T | null {
+    for (const template of templates) {
+        if (template.id == templateId && template.version == templateVersion) {
+            return template;
+        }
+    }
+    return null;
+}
+
+export function getLatestVersionMap<T extends TemplateSummary>(templates: T[]): { [key: string]: number } {
+    const latestVersions: { [key: string]: number } = {};
+    templates.forEach((i: T) => {
+        const templateId = i.id;
+        const templateVersion = i.version || 0;
+        if ((latestVersions[templateId] ?? -1) < templateVersion) {
+            latestVersions[templateId] = templateVersion;
+        }
+    });
+    return latestVersions;
+}
+
+export function canUpgrade<T extends TemplateSummary>(
+    templates: T[],
+    templateId: string,
+    templateVersion: number
+): boolean {
+    let can = false;
+    templates.forEach((i: T) => {
+        if (i.id == templateId && i.version && i.version > templateVersion) {
+            can = true;
+        }
+    });
+    return can;
+}
+
+export function getLatestVersion<T extends TemplateSummary>(templates: T[], id: string): T | null {
+    let latestVersion = -1;
+    let latestTemplate = null as T | null;
+    templates.forEach((i: T) => {
+        const templateId = i.id;
+        if (templateId == id) {
+            const templateVersion = i.version || 0;
+            if (templateVersion > latestVersion) {
+                latestTemplate = i;
+                latestVersion = templateVersion;
+            }
+        }
+    });
+    return latestTemplate;
+}
diff --git a/client/src/stores/fileSourceInstancesStore.ts b/client/src/stores/fileSourceInstancesStore.ts
new file mode 100644
index 000000000000..5b2bcf97b821
--- /dev/null
+++ b/client/src/stores/fileSourceInstancesStore.ts
@@ -0,0 +1,51 @@
+import { defineStore } from "pinia";
+
+import { fetcher } from "@/api/schema/fetcher";
+import type { components } from "@/api/schema/schema";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+const getFileSourceInstances = fetcher.path("/api/file_source_instances").method("get").create();
+
+type UserFileSourceModel = components["schemas"]["UserFileSourceModel"];
+
+export const useFileSourceInstancesStore = defineStore("fileSourceInstances", {
+    state: () => ({
+        instances: [] as UserFileSourceModel[],
+        fetched: false,
+        error: null as string | null,
+    }),
+    getters: {
+        getInstances: (state) => {
+            return state.instances;
+        },
+        loading: (state) => {
+            return !state.fetched;
+        },
+        getInstance: (state) => {
+            return (id: number | string) => state.instances.find((i) => i.id.toString() == id.toString());
+        },
+    },
+    actions: {
+        async handleInit(instances: UserFileSourceModel[]) {
+            this.instances = instances;
+            this.fetched = true;
+            this.error = null;
+        },
+        async handleError(err: unknown) {
+            this.error = errorMessageAsString(err);
+        },
+        async fetchInstances() {
+            try {
+                const { data: instances } = await getFileSourceInstances({});
+                this.handleInit(instances);
+            } catch (err) {
+                this.handleError(err);
+            }
+        },
+        async ensureTemplates() {
+            if (!this.fetched || this.error != null) {
+                await this.fetchInstances();
+            }
+        },
+    },
+});
diff --git a/client/src/stores/fileSourceTemplatesStore.ts b/client/src/stores/fileSourceTemplatesStore.ts
new file mode 100644
index 000000000000..1efd7e67bfe0
--- /dev/null
+++ b/client/src/stores/fileSourceTemplatesStore.ts
@@ -0,0 +1,70 @@
+import { defineStore } from "pinia";
+
+import { fetcher } from "@/api/schema/fetcher";
+import type { components } from "@/api/schema/schema";
+import { errorMessageAsString } from "@/utils/simple-error";
+
+import { canUpgrade, findTemplate, getLatestVersion, getLatestVersionMap } from "./configTemplatesUtil";
+
+const getFileSourceTemplates = fetcher.path("/api/file_source_templates").method("get").create();
+
+type FileSourceTemplateSummary = components["schemas"]["FileSourceTemplateSummary"];
+type FileSourceTemplateSummaries = FileSourceTemplateSummary[];
+
+export const useFileSourceTemplatesStore = defineStore("fileSourceTemplatesStore", {
+    state: () => ({
+        templates: [] as FileSourceTemplateSummaries,
+        fetched: false,
+        error: null as string | null,
+    }),
+    getters: {
+        latestTemplates: (state) => {
+            // only expose latest instance by template_version for each template_id
+            const latestVersions = getLatestVersionMap(state.templates);
+            return state.templates.filter((i: FileSourceTemplateSummary) => latestVersions[i.id] == (i.version || 0));
+        },
+        canUpgrade: (state) => {
+            return (templateId: string, templateVersion: number) =>
+                canUpgrade(state.templates, templateId, templateVersion);
+        },
+        getTemplates: (state) => {
+            return state.templates;
+        },
+        getTemplate: (state) => {
+            return (templateId: string, templateVersion: number) =>
+                findTemplate(state.templates, templateId, templateVersion);
+        },
+        getLatestTemplate: (state) => {
+            return (templateId: string) => getLatestVersion(state.templates, templateId);
+        },
+        hasTemplates: (state) => {
+            return state.templates.length > 0;
+        },
+        loading: (state) => {
+            return !state.fetched;
+        },
+    },
+    actions: {
+        async handleInit(templates: FileSourceTemplateSummaries) {
+            this.templates = templates;
+            this.fetched = true;
+        },
+        async handleError(err: unknown) {
+            this.fetched = true;
+            this.error = errorMessageAsString(err);
+        },
+        async fetchTemplates() {
+            try {
+                const { data: templates } = await getFileSourceTemplates({});
+                this.handleInit(templates);
+            } catch (err) {
+                this.handleError(err);
+            }
+        },
+        async ensureTemplates() {
+            if (!this.fetched || this.error != null) {
+                await this.fetchTemplates();
+            }
+        },
+    },
+});
diff --git a/client/src/stores/objectStoreInstancesStore.test.ts b/client/src/stores/objectStoreInstancesStore.test.ts
index a99670369acd..b23c24baba51 100644
--- a/client/src/stores/objectStoreInstancesStore.test.ts
+++ b/client/src/stores/objectStoreInstancesStore.test.ts
@@ -2,7 +2,7 @@ import { useObjectStoreInstancesStore } from "@/stores/objectStoreInstancesStore
 
 import { setupTestPinia } from "./testUtils";
 
-const type = "s3" as "s3" | "azure_blob" | "disk" | "generic_s3";
+const type = "aws_s3" as "aws_s3" | "azure_blob" | "disk" | "generic_s3";
 const TEST_INSTANCE = {
     type: type,
     name: "moo",
diff --git a/client/src/stores/objectStoreTemplatesStore.test.ts b/client/src/stores/objectStoreTemplatesStore.test.ts
index 2206712b212f..377bbe54267c 100644
--- a/client/src/stores/objectStoreTemplatesStore.test.ts
+++ b/client/src/stores/objectStoreTemplatesStore.test.ts
@@ -2,7 +2,7 @@ import { useObjectStoreTemplatesStore } from "@/stores/objectStoreTemplatesStore
 
 import { setupTestPinia } from "./testUtils";
 
-const s3 = "s3" as "s3" | "azure_blob" | "disk" | "generic_s3";
+const s3 = "aws_s3" as "aws_s3" | "azure_blob" | "disk" | "generic_s3";
 const TEMPLATES_BASIC = [
     {
         type: s3,
diff --git a/client/src/stores/objectStoreTemplatesStore.ts b/client/src/stores/objectStoreTemplatesStore.ts
index c7c340a50f08..4b9c852d494f 100644
--- a/client/src/stores/objectStoreTemplatesStore.ts
+++ b/client/src/stores/objectStoreTemplatesStore.ts
@@ -4,58 +4,13 @@ import { fetcher } from "@/api/schema/fetcher";
 import type { components } from "@/api/schema/schema";
 import { errorMessageAsString } from "@/utils/simple-error";
 
+import { canUpgrade, findTemplate, getLatestVersion, getLatestVersionMap } from "./configTemplatesUtil";
+
 const getObjectStoreTemplates = fetcher.path("/api/object_store_templates").method("get").create();
 
 type ObjectStoreTemplateSummary = components["schemas"]["ObjectStoreTemplateSummary"];
 type ObjectStoreTemplateSummaries = ObjectStoreTemplateSummary[];
 
-function findTemplate(templates: ObjectStoreTemplateSummaries, templateId: string, templateVersion: number) {
-    for (const template of templates) {
-        if (template.id == templateId && template.version == templateVersion) {
-            return template;
-        }
-    }
-    return null;
-}
-
-function getLatestVersionMap(templates: ObjectStoreTemplateSummaries): { [key: string]: number } {
-    const latestVersions: { [key: string]: number } = {};
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        const templateId = i.id;
-        const templateVersion = i.version || 0;
-        if ((latestVersions[templateId] ?? -1) < templateVersion) {
-            latestVersions[templateId] = templateVersion;
-        }
-    });
-    return latestVersions;
-}
-
-function canUpgrade(templates: ObjectStoreTemplateSummaries, templateId: string, templateVersion: number): boolean {
-    let can = false;
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        if (i.id == templateId && i.version && i.version > templateVersion) {
-            can = true;
-        }
-    });
-    return can;
-}
-
-function getLatestVersion(templates: ObjectStoreTemplateSummaries, id: string): ObjectStoreTemplateSummary | null {
-    let latestVersion = -1;
-    let latestTemplate = null as ObjectStoreTemplateSummary | null;
-    templates.forEach((i: ObjectStoreTemplateSummary) => {
-        const templateId = i.id;
-        if (templateId == id) {
-            const templateVersion = i.version || 0;
-            if (templateVersion > latestVersion) {
-                latestTemplate = i;
-                latestVersion = templateVersion;
-            }
-        }
-    });
-    return latestTemplate;
-}
-
 export const useObjectStoreTemplatesStore = defineStore("objectStoreTemplatesStore", {
     state: () => ({
         templates: [] as ObjectStoreTemplateSummaries,
diff --git a/client/src/utils/navigation/navigation.yml b/client/src/utils/navigation/navigation.yml
index c9a225296f24..f28f4151660c 100644
--- a/client/src/utils/navigation/navigation.yml
+++ b/client/src/utils/navigation/navigation.yml
@@ -94,7 +94,8 @@ preferences:
     email_input: "input[id='email']"
     username_input: "input[id='username']"
     preferred_storage: '.preferred-storage'
-    manage_object_stores: '.manage-object-stores'
+    manage_object_stores: '#manage-object-stores'
+    manage_file_sources: '#manage-file-sources'
 
   object_store_selection:
     selectors:
@@ -104,8 +105,26 @@ preferences:
 object_store_instances:
   index:
     selectors:
-      create_button: object-store-create
+      create_button: '#object-store-create'
+      _: '#user-object-stores-index'
 
+  create: 
+    selectors:
+      select: '.object-store-template-select-button[data-template-id="${template_id}"]'
+      _: '#create-object-store-landing'      
+      submit: '#submit'
+
+file_source_instances:
+  index:
+    selectors:
+      create_button: '#file-source-create'
+      _: '#user-file-sources-index'
+
+  create: 
+    selectors:
+      select: '.file-source-template-select-button[data-template-id="${template_id}"]'
+      _: '#create-file-source-landing'      
+      submit: '#submit'
 
 toolbox_filters:
   selectors:
diff --git a/client/src/utils/upload-payload.js b/client/src/utils/upload-payload.js
index 2ff3395828e3..2fbca26c06da 100644
--- a/client/src/utils/upload-payload.js
+++ b/client/src/utils/upload-payload.js
@@ -7,6 +7,7 @@ export const URI_PREFIXES = [
     "gxfiles://",
     "gximport://",
     "gxuserimport://",
+    "gxuserfiles://",
     "gxftp://",
     "drs://",
     "invenio://",
diff --git a/doc/source/admin/data.md b/doc/source/admin/data.md
new file mode 100644
index 000000000000..7684207387d3
--- /dev/null
+++ b/doc/source/admin/data.md
@@ -0,0 +1,469 @@
+# Connecting Users and Data
+
+Galaxy has countless ways for users to connect with things that might be considered their "data" - 
+file sources (aka "remote files"), object stores (aka "storage locations"), data libraries, the 
+upload API, visualizations, display applications, custom tools, etc...
+
+This document is going to discuss two of these (file sources and object stores) that are most 
+important Galaxy administrators and how to build Galaxy configuration that allow administrators
+to let users tie into various pieces of infrastructure.
+
+```{contents} Table of Contents
+:depth: 4
+```
+
+## Datasets vs Files
+
+File sources in Galaxy are a sprawling concept but essentially they provide users access to simple 
+files (stored hierarchically into folders) that can be navigated and imported into Galaxy.
+Importing a "file" into Galaxy generally
+creates a copy of that file into a Galaxy "object store". Once these files are stored in Galaxy,
+they become "datasets".
+A Galaxy dataset is much more than a simple file - Galaxy datasets include various generic metadata
+a datatype, datatype specific metadata, and ownership and sharing rules managed by Galaxy.
+
+Galaxy object stores (called storage locations in the UI) store datasets and global (accessible to
+all users) object stores
+are configured with the ``galaxy.yml`` property ``object_store_config_file`` (or 
+``object_store_config`` for a configuration embedded right in ``galaxy.yml``) that defaults to
+``object_store_conf.xml`` or ``object_store_conf.yml`` if either is present in Galaxy's configuration
+directory. Galaxy file sources provide users access to raw files and global files sources are configured with the ``galaxy.yml`` property ``file_sources_config_file`` (or ``file_sources`` for embedded configurations) that defaults to ``file_sources_conf.yml`` if that file is present in Galaxy's configuration directory.
+
+Some of Galaxy's most updated and complete administrator documentation can be found in configuration
+sample files - this is definitely the case for object stores and file sources. The relevant sample
+configuration files include 
+[file_sources_conf.yml.sample](https://github.com/galaxyproject/galaxy/blob/dev/lib/galaxy/config/sample/file_sources_conf.yml.sample) and
+[object_store_conf.sample.yml](https://github.com/galaxyproject/galaxy/blob/dev/lib/galaxy/config/sample/object_store_conf.sample.yml).
+
+File sources and object stores configured with the above files essentially are available to all users
+of your Galaxy instance - hence this document describes them as "global" file sources and object 
+stores. File source configurations do allow some templating that does allow the a global file source
+to be materialized differently for different users. For instance, you as an admin may setup a Dropbox
+file source and may explicitly add custom user properties that allow that single Dropbox file source
+to read from a user's preferences. Since there is just one Dropbox service and most people only have
+a single Dropbox account, this use case can be somewhat adequately addressed by the global file source
+and the global user preferences file. For a use case like Amazon S3 buckets though for instance,
+a single bucket file source that is parameterized one way is probably more clearly inadequate. For
+instance, users would very likely want to attach different buckets for different projects. 
+Additionally, the Galaxy user interface doesn't tie the user preferences to the particular file
+source and so this method introduces a huge education burden on your Galaxy instance. Finally,
+the templating available to file sources are not available for object stores - and allowing users
+to describe how they would like datasets stored and to pay for their own dataset storage are important
+use cases.
+
+This document is going to describe Galaxy configuration template libraries that allow the 
+administrator to setup templates for file sources and object stores that your users may instantiate
+as they see fit. User's can instantiate multiple instances of any template, the template concept
+can apply to both file source and object store plugins, and the user interface is unified from the
+template configuration file (you as the admin do not need to explicitly declare user preferences and
+your users do not need to navigate seemingly unrelated preferences to get plugins to work).
+
+## Object Store Templates
+
+Galaxy's object store templates are configured as a YAML list of template objects. This list
+can be placed ``object_store_templates.yml`` in Galaxy configuration directory (or any path
+pointed to by the configuration option ``object_store_templates_config_file`` in ``galaxy.yml``).
+Alternatively, the  configuration can be placed directly into ``galaxy.yml`` using the
+``object_store_templates`` configuration option.
+
+A minimal object store template might look something like:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### Object Store Types
+
+#### ``disk``
+
+This is the most basic sort of object store template that just makes disk paths available to users
+for storing data. Paths can be built up from the user supplied variables, user details, supplied
+environment variables, etc.. The simple example used to demonstrate these concepts just uses
+a user supplied project name and the user's username to produce a unique path for each user
+defined object store.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+These sorts of object stores have no quota so be careful.
+
+The syntax for the ``configuration`` section of ``disk`` templates looks like this.
+
+![](object_store_disk_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_disk_configuration.png)
+
+#### ``azure_blob``
+
+Here is a "production grade" Azure template that can be essentially used to connect to any
+Azure storage container.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
+:language: yaml
+```
+
+This template might be adapted to hide connection details from say users of a individual lab
+and just expose what container they should use. That might look something like:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/azure_just_container.yml
+:language: yaml
+```
+
+This example is a little contrived though, if a small lab or institution has just a few containers
+it would likely be a much easier user experience to just wrap them all in a Galaxy hierarchical
+object store, document them there, and make them available to your whole Galaxy instance.
+
+The syntax for the ``configuration`` section of ``azure_blob`` templates looks like this.
+
+![](object_store_azure_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_azure_configuration.png)
+
+#### ``aws_s3``
+
+The syntax for the ``configuration`` section of ``aws_s3`` templates looks like this.
+
+![](object_store_aws_s3_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_aws_s3_configuration.png)
+
+#### ``generic_s3``
+
+Object stores of the type ``generic_s3`` can be used to access a wide variety of S3
+compatible storage services. How you template them can result in widely different
+experiences for your users and can result in addressing a wide variety of use cases.
+
+Here is an example that is tailored for a specific storage service (e.g. CloudFlare R2)
+and exposes just the pieces of data CloudFlare users would need.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/cloudflare.yml
+:language: yaml
+```
+
+Templates can be much more generic or much less generic than this.
+
+In one direction, all the bells and whistles could be exposed to your Galaxy users to allow
+them to connect to any S3 compatible storage. This requires a lot more sophistication from
+your users but also allows them to connect to many more services. This template is available
+here:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
+:language: yaml
+```
+
+On the other hand, you might run a small lab with a dedicate MinIO storage service and just trust
+your user's to define individual buckets by name:
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
+:language: yaml
+```
+
+The syntax for the ``configuration`` section of ``generic_s3`` templates looks like this.
+
+![](object_store_generic_s3_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's object store infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``object_store_conf.yml`` (Galaxy's global object
+store configuration).
+
+![](object_store_generic_s3_configuration.png)
+
+### YAML Syntax
+
+![galaxy.objectstore.templates.models](object_store_templates.png)
+
+### Ready To Use Production Object Store Templates
+
+The templates have been tested by a Galaxy developer and are sufficiently generic that
+they may make sense for a variety of Galaxy instances, address a variety of potential use
+cases, and do not have need any additional tailoring, parameterization, or other
+customization. These assume your Galaxy instance has a Vault configured and you're
+comfortable with it storing your user's secrets.
+
+#### Allow Users to Define Azure Blob Storage as Object Stores
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
+:language: yaml
+```
+
+#### Allow Users to Define Generic S3 Compatible Storage Services as Object Stores
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
+:language: yaml
+```
+
+
+## File Source Templates
+
+Galaxy's file source templates are configured as a YAML list of template objects. This list
+can be placed ``file_source_templates.yml`` in Galaxy configuration directory (or any path
+pointed to by the configuration option ``file_source_templates_config_file`` in ``galaxy.yml``).
+Alternatively, the  configuration can be placed directly into ``galaxy.yml`` using the
+``file_source_templates`` configuration option.
+
+
+### File Source Types
+
+#### ``posix``
+
+The syntax for the ``configuration`` section of ``posix`` templates looks like this.
+
+![](file_source_posix_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_posix_configuration.png)
+
+#### ``s3fs``
+
+![](file_source_s3fs_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_s3fs_configuration.png)
+
+#### ``ftp``
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_ftp.yml
+:language: yaml
+```
+
+The syntax for the ``configuration`` section of ``ftp`` templates looks like this.
+
+![](file_source_ftp_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+
+![](file_source_ftp_configuration.png)
+
+#### ``azure``
+
+The syntax for the ``configuration`` section of ``azure`` templates looks like this.
+
+![](file_source_azure_configuration_template.png)
+
+At runtime, after the ``configuration`` template is expanded, the resulting dictionary
+passed to Galaxy's file source plugin infrastructure looks like this and should match a subset
+of what you'd be able to add directly to ``file_sources_conf.yml`` (Galaxy's global file source
+configuration).
+
+![](file_source_azure_configuration.png)
+
+### YAML Syntax
+
+![galaxy.files.templates.models](file_source_templates.png)
+
+### Ready To Use Production File Source Templates
+
+The templates have been tested by a Galaxy developer and are sufficiently generic that
+they may make sense for a variety of Galaxy instances, address a variety of potential use
+cases, and do not have need any additional tailoring, parameterization, or other
+customization. These assume your Galaxy instance has a Vault configured and you're
+comfortable with it storing your user's secrets.
+
+#### Allow Users to Define Generic FTP Servers as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_ftp.yml
+:language: yaml
+```
+
+#### Allow Users to Define Azure Blob Storage as File Sources
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/production_azure.yml
+:language: yaml
+```
+
+## Playing Nicer with Ansible
+
+Many large instances of Galaxy are configured with Ansible and much of the existing administrator
+documentation leverages Ansible. The configuration template files using Jinja templating and so
+does Ansible by default. This might result in a lack of clarity of when templates (strings 
+starting with ``{{`` and ending with ``}}``) are being evaluated. Ansible templates are evaluated
+at deploy time and the configuration objects describing plugins are evaluated at Galaxy runtime.
+
+The easiest way to fix this is probably to store these templates files in your Ansible as plain files
+and not templates. If you'd like to use Ansible templating to build up these files you'll very
+likely need to tell either Galaxy or Ansible to use something other than ``{{`` and ``}}`` for 
+templating variables. This can be done by placing a directive at the top of your template that
+is consumed by Ansible. For instance, to have ``[%`` and ``%]`` used instead of ``{{`` and ``}}``
+by Ansible at deploy time, the file could start with:
+
+```
+#jinja2:variable_start_string:'[%' , variable_end_string:'%]'
+```
+
+In this case, variables wrapped by ``[%`` and ``%]`` are expanded by Ansible and use the Ansible
+environment and ``{`` and ``}`` are reserved for Galaxy templating.
+
+Alternatively, Galaxy can be configured to use a custom template on a per-configuration
+object basis by setting the ``template_start`` and/or ``template_end`` variables.
+
+The following template chunk shows how to override the templating Galaxy does for a
+particular object store configuration. Similar templating overrides work for file source
+plugin templates.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/templating_override.yml
+:language: yaml
+```
+
+- https://github.com/ansible/ansible/pull/75306
+- https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+
+## Jinja Template Reference
+
+Galaxy configuration file templating uses [Jinja](https://jinja.palletsprojects.com/en/3.0.x/templates/) to template values and connect inputs, configuration, and the runtime environment
+into concrete configuration YAML blocks.
+
+Jinja is fairly straight forward to learn but this document provides tons of examples and
+one can probably adapt them to whatever you're interested in building without really needing
+to dig deeply into Jinja. However, this section does outline what Galaxy does inject into the
+Jinja environment to serve as a reference.
+
+Even the most exotic configurations will likely only scratch the surface of what Jinja
+allows and implements. The only relevant Jinja documentation you'll need in these cases
+is probably just those documents on [variables](https://jinja.palletsprojects.com/en/3.0.x/templates/#variables), [filters](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters),
+and the [list of builtin filters](https://jinja.palletsprojects.com/en/3.0.x/templates/#list-of-builtin-filters).
+
+### ``variables``
+
+This is a typed dictionary object is populated with user supplied values defined via the the ``variables`` section of the configuration template and filled in by the user when they
+created a new object store or file source.
+
+### ``secrets``
+
+This is a dictionary of strings populated with user supplied secrets defined via the the ``secrets`` section of the configuration template and filled in by the user when they
+created a new object store or file source.
+
+A deep dive into these can be found in the [User Secrets](#user-secrets) section of this document.
+
+### ``environment``
+
+This dictionary object is populated with admin-supplied values defined via the the ``environment``
+section of the configuration template.
+
+A deep dive into these can be found in the [Admin Secrets](#admin-secrets) section of this document.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
+:language: yaml
+```
+
+### ``user``
+
+This dictionary object exposes information about user configuring and using a target template
+configuration. These values are populated from the ``galaxy_user`` table of the Galaxy database.
+The current properties exposed include:
+
+| Key          | Description                                               | 
+|--------------|-----------------------------------------------------------|
+| ``username`` | string corresponding the username of the Galaxy user      |
+| ``email``    | string corresponding the email of the Galaxy user         |
+| ``id``       | integer primary key of user object in the Galaxy database |
+
+
+The simple example of project scratch storage used to describe these concepts made
+use the Galaxy user's username to generate unique paths.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### ``ensure_path_component``
+
+This [Jinja filter](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters)
+will fail template evaluation if the value it is applies to is not
+a simple directory name. If it contain ``..`` or ``/`` or in some other way might
+be used to attempt path exploitation of cause odd path-related bugs. This is
+useful when producing paths for ``disk`` object stores or ``posix`` file sources.
+
+When taking inputs from users, setting the type of ``path_component`` instead of
+``string`` allows the client to validate potential issues way before this point,
+but many path components might be built from environment variables or usernames
+or sources like this that are not explicitly user inputs.
+
+An example of an object store template that uses this is the simple scratch example
+that was used to introduce concepts at the start of the object store template
+documentation above.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/simple_example.yml
+:language: yaml
+```
+
+### ``asbool``
+
+This [Jinja filter](https://jinja.palletsprojects.com/en/3.0.x/templates/#filters)
+will use Galaxy configuration style logic to convert string values into boolean ones.
+
+When taking inputs from users, setting the type of ``boolean`` is sufficient to ensure
+a variable is boolean, but "secrets" and environment variables and many other things
+are likely to be of type string but should be used in a template that expects boolean
+values.
+
+An example of an object store template that uses this is ``secure`` environment parameter
+on the simple minio example.
+
+```{literalinclude} ../../../lib/galaxy/objectstore/templates/examples/minio_example.yml
+:language: yaml
+```
+
+
+## Connecting Configuration Templates to Secrets
+
+(user-secrets)=
+### User Secrets
+
+(admin-secrets)=
+### Admin Secrets
+
+Administrators may define secrets that are available to all users and aren't parameterized
+on a per-instance basis. These secrets can be injected into template instances through Vault
+keys or through environment variables.
+
+Each template may optionally define an ``environment`` key where these can be defined. The
+following template entry describes a file source that injects the environment variable
+``GALAXY_SECRET_HOME_VAR`` into the template as ``environment.var`` and injects the Vault
+key ``secret_directory_file_source/my_secret`` into the template as ``environment.var``.
+This template uses these variables to construct a root path for a ``posix`` file source
+but the same secrets could just as easily store cloud keys and configure an S3 object store.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets.yml
+:language: yaml
+```
+
+If you'd like to make the target secrets optional, default values can also be setup.
+The following block demonstrates the same configuration but with default values of
+``default_var`` for the default ``var`` value and ``default_sec`` for the default ``sec``
+value. These will be used in the target Vault keys are absent or the target environment
+variable is not defined at runtime.
+
+```{literalinclude} ../../../lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
+:language: yaml
+```
+
+## Versioning Templates
diff --git a/doc/source/admin/file_source_azure_configuration.png b/doc/source/admin/file_source_azure_configuration.png
new file mode 100644
index 000000000000..99aa460e639a
Binary files /dev/null and b/doc/source/admin/file_source_azure_configuration.png differ
diff --git a/doc/source/admin/file_source_azure_configuration_template.png b/doc/source/admin/file_source_azure_configuration_template.png
new file mode 100644
index 000000000000..dbc8844ac193
Binary files /dev/null and b/doc/source/admin/file_source_azure_configuration_template.png differ
diff --git a/doc/source/admin/file_source_ftp_configuration.png b/doc/source/admin/file_source_ftp_configuration.png
new file mode 100644
index 000000000000..72f93e280fd7
Binary files /dev/null and b/doc/source/admin/file_source_ftp_configuration.png differ
diff --git a/doc/source/admin/file_source_ftp_configuration_template.png b/doc/source/admin/file_source_ftp_configuration_template.png
new file mode 100644
index 000000000000..ad8bc5553461
Binary files /dev/null and b/doc/source/admin/file_source_ftp_configuration_template.png differ
diff --git a/doc/source/admin/file_source_posix_configuration.png b/doc/source/admin/file_source_posix_configuration.png
new file mode 100644
index 000000000000..4fcd0a0e7f5a
Binary files /dev/null and b/doc/source/admin/file_source_posix_configuration.png differ
diff --git a/doc/source/admin/file_source_posix_configuration_template.png b/doc/source/admin/file_source_posix_configuration_template.png
new file mode 100644
index 000000000000..6559a0f8ac13
Binary files /dev/null and b/doc/source/admin/file_source_posix_configuration_template.png differ
diff --git a/doc/source/admin/file_source_s3fs_configuration.png b/doc/source/admin/file_source_s3fs_configuration.png
new file mode 100644
index 000000000000..bc3df24731c6
Binary files /dev/null and b/doc/source/admin/file_source_s3fs_configuration.png differ
diff --git a/doc/source/admin/file_source_s3fs_configuration_template.png b/doc/source/admin/file_source_s3fs_configuration_template.png
new file mode 100644
index 000000000000..f940d5485e91
Binary files /dev/null and b/doc/source/admin/file_source_s3fs_configuration_template.png differ
diff --git a/doc/source/admin/file_source_templates.png b/doc/source/admin/file_source_templates.png
new file mode 100644
index 000000000000..5d1556b69269
Binary files /dev/null and b/doc/source/admin/file_source_templates.png differ
diff --git a/doc/source/admin/gen_diagrams.py b/doc/source/admin/gen_diagrams.py
new file mode 100644
index 000000000000..207965faaf9e
--- /dev/null
+++ b/doc/source/admin/gen_diagrams.py
@@ -0,0 +1,55 @@
+import os
+import sys
+
+import erdantic as erd
+
+sys.path.insert(1, os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir, os.pardir, os.pardir, "lib")))
+
+from galaxy.files.templates.models import (
+    AzureFileSourceConfiguration,
+    AzureFileSourceTemplateConfiguration,
+    FileSourceTemplate,
+    FtpFileSourceConfiguration,
+    FtpFileSourceTemplateConfiguration,
+    PosixFileSourceConfiguration,
+    PosixFileSourceTemplateConfiguration,
+    S3FSFileSourceConfiguration,
+    S3FSFileSourceTemplateConfiguration,
+)
+from galaxy.objectstore.templates.models import (
+    AwsS3ObjectStoreConfiguration,
+    AwsS3ObjectStoreTemplateConfiguration,
+    AzureObjectStoreConfiguration,
+    AzureObjectStoreTemplateConfiguration,
+    DiskObjectStoreConfiguration,
+    DiskObjectStoreTemplateConfiguration,
+    GenericS3ObjectStoreConfiguration,
+    GenericS3ObjectStoreTemplateConfiguration,
+    ObjectStoreTemplate,
+)
+
+DOC_SOURCE_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__)))
+
+class_to_diagram = {
+    ObjectStoreTemplate: "object_store_templates",
+    AzureObjectStoreConfiguration: "object_store_azure_configuration",
+    AzureObjectStoreTemplateConfiguration: "object_store_azure_configuration_template",
+    DiskObjectStoreConfiguration: "object_store_disk_configuration",
+    DiskObjectStoreTemplateConfiguration: "object_store_disk_configuration_template",
+    AwsS3ObjectStoreTemplateConfiguration: "object_store_aws_s3_configuration_template",
+    AwsS3ObjectStoreConfiguration: "object_store_aws_s3_configuration",
+    GenericS3ObjectStoreTemplateConfiguration: "object_store_generic_s3_configuration_template",
+    GenericS3ObjectStoreConfiguration: "object_store_generic_s3_configuration",
+    FileSourceTemplate: "file_source_templates",
+    AzureFileSourceTemplateConfiguration: "file_source_azure_configuration_template",
+    AzureFileSourceConfiguration: "file_source_azure_configuration",
+    PosixFileSourceTemplateConfiguration: "file_source_posix_configuration_template",
+    PosixFileSourceConfiguration: "file_source_posix_configuration",
+    S3FSFileSourceTemplateConfiguration: "file_source_s3fs_configuration_template",
+    S3FSFileSourceConfiguration: "file_source_s3fs_configuration",
+    FtpFileSourceTemplateConfiguration: "file_source_ftp_configuration_template",
+    FtpFileSourceConfiguration: "file_source_ftp_configuration",
+}
+
+for clazz, diagram_name in class_to_diagram.items():
+    erd.draw(clazz, out=f"{DOC_SOURCE_DIR}/{diagram_name}.png")
diff --git a/doc/source/admin/index.rst b/doc/source/admin/index.rst
index 61ed7db63ba4..f7853a895a0b 100644
--- a/doc/source/admin/index.rst
+++ b/doc/source/admin/index.rst
@@ -11,6 +11,7 @@ This documentation is in the midst of being ported and unified based on resource
    config
    config_logging
    production
+   data
    security
    nginx
    apache
diff --git a/doc/source/admin/object_store_aws_s3_configuration.png b/doc/source/admin/object_store_aws_s3_configuration.png
new file mode 100644
index 000000000000..a9ae47e10ba6
Binary files /dev/null and b/doc/source/admin/object_store_aws_s3_configuration.png differ
diff --git a/doc/source/admin/object_store_aws_s3_configuration_template.png b/doc/source/admin/object_store_aws_s3_configuration_template.png
new file mode 100644
index 000000000000..f93317fcad2c
Binary files /dev/null and b/doc/source/admin/object_store_aws_s3_configuration_template.png differ
diff --git a/doc/source/admin/object_store_azure_configuration.png b/doc/source/admin/object_store_azure_configuration.png
new file mode 100644
index 000000000000..d64732389152
Binary files /dev/null and b/doc/source/admin/object_store_azure_configuration.png differ
diff --git a/doc/source/admin/object_store_azure_configuration_template.png b/doc/source/admin/object_store_azure_configuration_template.png
new file mode 100644
index 000000000000..0c47fe4e439b
Binary files /dev/null and b/doc/source/admin/object_store_azure_configuration_template.png differ
diff --git a/doc/source/admin/object_store_disk_configuration.png b/doc/source/admin/object_store_disk_configuration.png
new file mode 100644
index 000000000000..836e13d6f59a
Binary files /dev/null and b/doc/source/admin/object_store_disk_configuration.png differ
diff --git a/doc/source/admin/object_store_disk_configuration_template.png b/doc/source/admin/object_store_disk_configuration_template.png
new file mode 100644
index 000000000000..d851772ed422
Binary files /dev/null and b/doc/source/admin/object_store_disk_configuration_template.png differ
diff --git a/doc/source/admin/object_store_generic_s3_configuration.png b/doc/source/admin/object_store_generic_s3_configuration.png
new file mode 100644
index 000000000000..7e545feda792
Binary files /dev/null and b/doc/source/admin/object_store_generic_s3_configuration.png differ
diff --git a/doc/source/admin/object_store_generic_s3_configuration_template.png b/doc/source/admin/object_store_generic_s3_configuration_template.png
new file mode 100644
index 000000000000..04b50dd5049e
Binary files /dev/null and b/doc/source/admin/object_store_generic_s3_configuration_template.png differ
diff --git a/doc/source/admin/object_store_templates.png b/doc/source/admin/object_store_templates.png
new file mode 100644
index 000000000000..31af83aea54f
Binary files /dev/null and b/doc/source/admin/object_store_templates.png differ
diff --git a/doc/source/admin/s3_configuration.png b/doc/source/admin/s3_configuration.png
new file mode 100644
index 000000000000..cead1584ddbf
Binary files /dev/null and b/doc/source/admin/s3_configuration.png differ
diff --git a/doc/source/admin/s3_configuration_template.png b/doc/source/admin/s3_configuration_template.png
new file mode 100644
index 000000000000..9a104c85df55
Binary files /dev/null and b/doc/source/admin/s3_configuration_template.png differ
diff --git a/doc/source/admin/search_for_new_screenshots.py b/doc/source/admin/search_for_new_screenshots.py
new file mode 100644
index 000000000000..d59c88ef09f0
--- /dev/null
+++ b/doc/source/admin/search_for_new_screenshots.py
@@ -0,0 +1,30 @@
+import argparse
+import os
+import shutil
+import sys
+
+THIS_DIRECTORY = os.path.dirname(__file__)
+
+parser = argparse.ArgumentParser(
+    prog="search_for_new_screenshots",
+    description="Searches a Selenium screenshot directory for screenshots used in the admin docs and grabs new ones if available",
+)
+
+SEARCH_FOR = [
+    "user_object_store_form_empty_azure.png",
+    "user_object_store_form_full_azure.png",
+]
+
+
+def main(argv):
+    parser.add_argument("screenshot_directory")
+    args = parser.parse_args(argv[1:])
+    screenshot_directory = args.screenshot_directory
+    for filename in os.listdir(screenshot_directory):
+        if filename in SEARCH_FOR:
+            print(f"Found useful screenshot {filename}, copying to {THIS_DIRECTORY}")
+            shutil.copy(os.path.join(screenshot_directory, filename), os.path.join(THIS_DIRECTORY, filename))
+
+
+if __name__ == "__main__":
+    main(sys.argv)
diff --git a/lib/galaxy/app.py b/lib/galaxy/app.py
index 682b85fc751b..f42de0599fc7 100644
--- a/lib/galaxy/app.py
+++ b/lib/galaxy/app.py
@@ -35,13 +35,27 @@
 )
 from galaxy.config_watchers import ConfigWatchers
 from galaxy.datatypes.registry import Registry
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+    UserDefinedFileSources,
+)
+from galaxy.files.plugins import (
+    FileSourcePluginLoader,
+    FileSourcePluginsConfig,
+)
+from galaxy.files.templates import ConfiguredFileSourceTemplates
 from galaxy.job_metrics import JobMetrics
 from galaxy.jobs.manager import JobManager
 from galaxy.managers.api_keys import ApiKeyManager
 from galaxy.managers.citations import CitationsManager
 from galaxy.managers.collections import DatasetCollectionManager
 from galaxy.managers.dbkeys import GenomeBuilds
+from galaxy.managers.file_source_instances import (
+    FileSourceInstancesManager,
+    UserDefinedFileSourcesConfig,
+    UserDefinedFileSourcesImpl,
+)
 from galaxy.managers.folders import FolderManager
 from galaxy.managers.hdas import HDAManager
 from galaxy.managers.histories import HistoryManager
@@ -416,6 +430,7 @@ def _configure_object_store(self, **kwds):
             jobs_directory=self.config.jobs_directory,
             new_file_path=self.config.new_file_path,
             umask=self.config.umask,
+            gid=self.config.gid,
             object_store_cache_size=self.config.object_store_cache_size,
             object_store_cache_path=self.config.object_store_cache_path,
             user_object_store_index_by=self.config.user_object_store_index_by,
@@ -585,9 +600,29 @@ def __init__(self, configure_logging=True, use_converters=True, use_display_appl
         )
 
         # ConfiguredFileSources
-        self.file_sources = self._register_singleton(
-            ConfiguredFileSources, ConfiguredFileSources.from_app_config(self.config)
+        vault_configured = is_vault_configured(self.vault)
+        file_sources_config: FileSourcePluginsConfig = FileSourcePluginsConfig.from_app_config(self.config)
+        self._register_singleton(FileSourcePluginsConfig, file_sources_config)
+        file_source_plugin_loader = FileSourcePluginLoader()
+        self._register_singleton(FileSourcePluginLoader, file_source_plugin_loader)
+        self._register_singleton(
+            UserDefinedFileSourcesConfig, UserDefinedFileSourcesConfig.from_app_config(self.config)
+        )
+        user_defined_file_sources = self._register_abstract_singleton(
+            UserDefinedFileSources, UserDefinedFileSourcesImpl  # type: ignore[type-abstract]  # https://github.com/python/mypy/issues/4717
+        )
+        templates = ConfiguredFileSourceTemplates.from_app_config(self.config, vault_configured=vault_configured)
+        self.file_source_templates = self._register_singleton(ConfiguredFileSourceTemplates, templates)
+        configured_file_source_conf: ConfiguredFileSourcesConf = ConfiguredFileSourcesConf.from_app_config(self.config)
+        file_sources = ConfiguredFileSources(
+            file_sources_config,
+            configured_file_source_conf,
+            load_stock_plugins=True,
+            plugin_loader=file_source_plugin_loader,
+            user_defined_file_sources=user_defined_file_sources,
         )
+        self.file_sources = self._register_singleton(ConfiguredFileSources, file_sources)
+        self._register_singleton(FileSourceInstancesManager)
 
         # Load security policy.
         self.security_agent = self.model.security_agent
diff --git a/lib/galaxy/app_unittest_utils/galaxy_mock.py b/lib/galaxy/app_unittest_utils/galaxy_mock.py
index d50842158020..0930a3ebbe18 100644
--- a/lib/galaxy/app_unittest_utils/galaxy_mock.py
+++ b/lib/galaxy/app_unittest_utils/galaxy_mock.py
@@ -42,6 +42,11 @@
     GalaxyDataTestConfig,
 )
 from galaxy.security import idencoding
+from galaxy.security.vault import (
+    UserVaultWrapper,
+    Vault,
+    VaultFactory,
+)
 from galaxy.short_term_storage import (
     ShortTermStorageAllocator,
     ShortTermStorageConfiguration,
@@ -171,6 +176,19 @@ def wait_for_toolbox_reload(self, toolbox):
     def reindex_tool_search(self) -> None:
         raise NotImplementedError
 
+    def setup_test_vault(self):
+        config = {
+            "encryption_keys": [
+                "5RrT94ji178vQwha7TAmEix7DojtsLlxVz8Ef17KWgg=",
+                "iNdXd7tRjLnSqRHxuhqQ98GTLU8HUbd5_Xx38iF8nZ0=",
+                "IK83IXhE4_7W7xCFEtD9op0BAs11pJqYN236Spppp7g=",
+            ],
+        }
+        vault = VaultFactory.from_vault_type(self, "database", config)
+        # Ignored because of https://github.com/python/mypy/issues/4717
+        self[Vault] = vault  # type: ignore[type-abstract]
+        self.vault = vault
+
 
 class MockLock:
     def __enter__(self):
@@ -352,6 +370,11 @@ def fill_template(self, filename, template_lookup=None, **kwargs):
         kwargs.update(h=MockTemplateHelpers())
         return template.render(**kwargs)
 
+    @property
+    def user_vault(self):
+        """Provide access to a user's personal vault."""
+        return UserVaultWrapper(self.app.vault, self.user)
+
 
 class MockVisualizationsRegistry:
     BUILT_IN_VISUALIZATIONS = ["trackster"]
diff --git a/lib/galaxy/config/schemas/config_schema.yml b/lib/galaxy/config/schemas/config_schema.yml
index cdb8b47151de..5c147c02a9c8 100644
--- a/lib/galaxy/config/schemas/config_schema.yml
+++ b/lib/galaxy/config/schemas/config_schema.yml
@@ -566,6 +566,21 @@ mapping:
         desc: |
           Configured Object Store templates embedded into Galaxy's config.
 
+      file_source_templates_config_file:
+        type: str
+        default: file_source_templates.yml
+        path_resolves_to: config_dir
+        required: false
+        desc: |
+          Configured user file source templates configuration file.
+
+      file_source_templates:
+        type: seq
+        sequence:
+          - type: any
+        desc: |
+          Configured user file source templates embedded into Galaxy's config.
+
       user_object_store_index_by:
         type: str
         default: 'uuid'
diff --git a/lib/galaxy/files/__init__.py b/lib/galaxy/files/__init__.py
index 6ddf924f4089..58aea54181be 100644
--- a/lib/galaxy/files/__init__.py
+++ b/lib/galaxy/files/__init__.py
@@ -23,6 +23,7 @@
     plugin_source_from_dict,
     plugin_source_from_path,
     PluginConfigSource,
+    PluginConfigsT,
 )
 from .plugins import (
     FileSourcePluginLoader,
@@ -46,29 +47,111 @@ class NoMatchingFileSource(Exception):
     pass
 
 
+class UserDefinedFileSources(Protocol):
+    """Entry-point for Galaxy to inject user-defined object stores.
+
+    Supplied object of this class is used to write out concrete
+    description of file sources when serializing all file sources
+    available to a user.
+    """
+
+    def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext") -> None:
+        pass
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        pass
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: "FileSourcesUserContext",
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        """Write out user file sources as list of config dictionaries."""
+        # config_dicts: List[FilesSourceProperties] = []
+        # for file_source in self.user_file_sources():
+        #     as_dict = file_source.to_dict(for_serialization=for_serialization, user_context=user_context)
+        #     config_dicts.append(as_dict)
+        # return config_dicts
+
+
+class NullUserDefinedFileSources(UserDefinedFileSources):
+
+    def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext") -> None:
+        return None
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        return None
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: "FileSourcesUserContext",
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        return []
+
+
+def _ensure_user_defined_file_sources(
+    user_defined_file_sources: Optional[UserDefinedFileSources] = None,
+) -> UserDefinedFileSources:
+    if user_defined_file_sources is not None:
+        return user_defined_file_sources
+    else:
+        return NullUserDefinedFileSources()
+
+
+class ConfiguredFileSourcesConf:
+    conf_dict: Optional[PluginConfigsT]
+    conf_file: Optional[str]
+
+    def __init__(self, conf_dict: Optional[PluginConfigsT] = None, conf_file: Optional[str] = None):
+        self.conf_dict = conf_dict
+        self.conf_file = conf_file
+
+    @staticmethod
+    def from_app_config(config):
+        config_file = config.file_sources_config_file
+        config_dict = None
+        if not config_file or not os.path.exists(config_file):
+            config_file = None
+            config_dict = config.file_sources
+        return ConfiguredFileSourcesConf(config_dict, config_file)
+
+
 class ConfiguredFileSources:
     """Load plugins and resolve Galaxy URIs to FileSource objects."""
 
     _file_sources: List[BaseFilesSource]
+    _plugin_loader: FileSourcePluginLoader
+    _user_defined_file_sources: UserDefinedFileSources
 
     def __init__(
         self,
         file_sources_config: FileSourcePluginsConfig,
-        conf_file=None,
-        conf_dict=None,
-        load_stock_plugins=False,
+        configured_file_source_conf: Optional[ConfiguredFileSourcesConf] = None,
+        load_stock_plugins: bool = False,
+        plugin_loader: Optional[FileSourcePluginLoader] = None,
+        user_defined_file_sources: Optional[UserDefinedFileSources] = None,
     ):
         self._file_sources_config = file_sources_config
-        self._plugin_loader = FileSourcePluginLoader()
+        self._plugin_loader = plugin_loader or FileSourcePluginLoader()
+        self._user_defined_file_sources = _ensure_user_defined_file_sources(user_defined_file_sources)
         file_sources: List[BaseFilesSource] = []
-        if conf_file is not None:
-            file_sources = self._load_plugins_from_file(conf_file)
-        elif conf_dict is not None:
-            plugin_source = plugin_source_from_dict(conf_dict)
+        if configured_file_source_conf is None:
+            configured_file_source_conf = ConfiguredFileSourcesConf(conf_dict=[])
+        if configured_file_source_conf.conf_file is not None:
+            file_sources = self._load_plugins_from_file(configured_file_source_conf.conf_file)
+        elif configured_file_source_conf.conf_dict is not None:
+            plugin_source = plugin_source_from_dict(configured_file_source_conf.conf_dict)
             file_sources = self._parse_plugin_source(plugin_source)
         else:
             file_sources = []
-        custom_sources_configured = len(file_sources) > 0
+        custom_sources_configured = len(file_sources) > 0 or (user_defined_file_sources is not None)
         if load_stock_plugins:
             stock_file_source_conf_dict = []
 
@@ -110,6 +193,9 @@ def find_best_match(self, url: str) -> Optional[BaseFilesSource]:
         """Returns the best matching file source for handling a particular url. Each filesource scores its own
         ability to match a particular url, and the highest scorer with a score > 0 is selected."""
         scores = [FileSourceScore(file_source, file_source.score_url_match(url)) for file_source in self._file_sources]
+        user_best_score = self._user_defined_file_sources.find_best_match(url)
+        if user_best_score is not None:
+            scores.append(user_best_score)
         scores.sort(key=lambda f: f.score, reverse=True)
         return next((fsscore.file_source for fsscore in scores if fsscore.score > 0), None)
 
@@ -134,6 +220,8 @@ def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext"):
                 raise exceptions.ConfigDoesNotAllowException(
                     "The configuration of this Galaxy instance does not allow upload from user directories."
                 )
+            if user_login is None:
+                raise exceptions.AuthenticationRequired("Must be logged in to use this feature.")
             full_import_dir = os.path.join(user_base_dir, user_login)
             if not os.path.exists(full_import_dir):
                 raise exceptions.ObjectNotFound("Your user import directory does not exist.")
@@ -154,6 +242,7 @@ def validate_uri_root(self, uri: str, user_context: "FileSourcesUserContext"):
                 raise exceptions.ObjectNotFound(
                     "Your FTP directory does not exist, attempting to upload files to it may cause it to be created."
                 )
+        self._user_defined_file_sources.validate_uri_root(uri, user_context)
 
     def looks_like_uri(self, path_or_uri):
         # is this string a URI this object understands how to realize
@@ -183,6 +272,16 @@ def plugins_to_dict(
                 continue
             el = file_source.to_dict(for_serialization=for_serialization, user_context=user_context)
             rval.append(el)
+        if user_context:
+            rval.extend(
+                self._user_defined_file_sources.user_file_sources_to_dicts(
+                    for_serialization,
+                    user_context,
+                    browsable_only=browsable_only,
+                    include_kind=include_kind,
+                    exclude_kind=exclude_kind,
+                )
+            )
         return rval
 
     def to_dict(self, for_serialization: bool = False, user_context: "OptionalUserContext" = None) -> Dict[str, Any]:
@@ -191,18 +290,6 @@ def to_dict(self, for_serialization: bool = False, user_context: "OptionalUserCo
             "config": self._file_sources_config.to_dict(),
         }
 
-    @staticmethod
-    def from_app_config(config):
-        config_file = config.file_sources_config_file
-        config_dict = None
-        if not config_file or not os.path.exists(config_file):
-            config_file = None
-            config_dict = config.file_sources
-        file_sources_config = FileSourcePluginsConfig.from_app_config(config)
-        return ConfiguredFileSources(
-            file_sources_config, conf_file=config_file, conf_dict=config_dict, load_stock_plugins=True
-        )
-
     @staticmethod
     def from_dict(as_dict, load_stock_plugins=False):
         if as_dict is not None:
@@ -212,8 +299,9 @@ def from_dict(as_dict, load_stock_plugins=False):
         else:
             sources_as_dict = []
             file_sources_config = FileSourcePluginsConfig()
+        configured_file_sources_conf = ConfiguredFileSourcesConf(conf_dict=sources_as_dict)
         return ConfiguredFileSources(
-            file_sources_config, conf_dict=sources_as_dict, load_stock_plugins=load_stock_plugins
+            file_sources_config, configured_file_sources_conf, load_stock_plugins=load_stock_plugins
         )
 
 
@@ -221,7 +309,7 @@ class NullConfiguredFileSources(ConfiguredFileSources):
     def __init__(
         self,
     ):
-        super().__init__(FileSourcePluginsConfig())
+        super().__init__(FileSourcePluginsConfig(), ConfiguredFileSourcesConf(conf_dict=[]))
 
 
 class DictifiableFilesSourceContext(Protocol):
@@ -252,13 +340,13 @@ def to_dict(self, view="collection", value_mapper: Optional[Dict[str, Callable]]
 class FileSourcesUserContext(DictifiableFilesSourceContext, Protocol):
 
     @property
-    def email(self) -> str: ...
+    def email(self) -> Optional[str]: ...
 
     @property
-    def username(self) -> str: ...
+    def username(self) -> Optional[str]: ...
 
     @property
-    def ftp_dir(self) -> str: ...
+    def ftp_dir(self) -> Optional[str]: ...
 
     @property
     def preferences(self) -> Dict[str, Any]: ...
@@ -283,12 +371,12 @@ def __init__(self, trans, **kwargs):
         self.trans = trans
 
     @property
-    def email(self):
+    def email(self) -> Optional[str]:
         user = self.trans.user
         return user and user.email
 
     @property
-    def username(self):
+    def username(self) -> Optional[str]:
         user = self.trans.user
         return user and user.username
 
@@ -344,7 +432,7 @@ def email(self):
         return self._kwd.get("email")
 
     @property
-    def username(self):
+    def username(self) -> Optional[str]:
         return self._kwd.get("username")
 
     @property
diff --git a/lib/galaxy/files/plugins.py b/lib/galaxy/files/plugins.py
index 27f5f2de96d2..4f9c182f846a 100644
--- a/lib/galaxy/files/plugins.py
+++ b/lib/galaxy/files/plugins.py
@@ -1,6 +1,8 @@
 from typing import (
+    cast,
     List,
     Optional,
+    Type,
     TYPE_CHECKING,
 )
 
@@ -86,6 +88,9 @@ def _file_source_plugins_dict(self):
 
         return plugins_dict(galaxy.files.sources, "plugin_type")
 
+    def get_plugin_type_class(self, plugin_type: str) -> Type["BaseFilesSource"]:
+        return cast(Type["BaseFilesSource"], self._plugin_classes[plugin_type])
+
     def load_plugins(
         self, plugin_source: PluginConfigSource, file_source_plugin_config: FileSourcePluginsConfig
     ) -> List["BaseFilesSource"]:
diff --git a/lib/galaxy/files/sources/__init__.py b/lib/galaxy/files/sources/__init__.py
index ae5a59299d78..37a6a33d6d91 100644
--- a/lib/galaxy/files/sources/__init__.py
+++ b/lib/galaxy/files/sources/__init__.py
@@ -12,6 +12,7 @@
     List,
     Optional,
     Set,
+    Type,
     TYPE_CHECKING,
     Union,
 )
@@ -297,18 +298,22 @@ def get_browsable(self) -> bool:
         """Return true if the filesource implements the SupportsBrowsing interface."""
 
 
+def file_source_type_is_browsable(target_type: Type["BaseFilesSource"]) -> bool:
+    # Check whether the list method has been overridden
+    return target_type.list != BaseFilesSource.list or target_type._list != BaseFilesSource._list
+
+
 class BaseFilesSource(FilesSource):
     plugin_kind: ClassVar[PluginKind] = PluginKind.rfs  # Remote File Source by default, override in subclasses
 
     def get_browsable(self) -> bool:
-        # Check whether the list method has been overridden
-        return type(self).list != BaseFilesSource.list or type(self)._list != BaseFilesSource._list
+        return file_source_type_is_browsable(type(self))
 
     def get_prefix(self) -> Optional[str]:
         return self.id
 
     def get_scheme(self) -> str:
-        return "gxfiles"
+        return self.scheme or "gxfiles"
 
     def get_writable(self) -> bool:
         return self.writable
@@ -371,6 +376,7 @@ def to_dict(self, for_serialization=False, user_context: "OptionalUserContext" =
             "browsable": self.get_browsable(),
             "requires_roles": self.requires_roles,
             "requires_groups": self.requires_groups,
+            "scheme": self.get_scheme(),
         }
         if self.get_browsable():
             rval["uri_root"] = self.get_uri_root()
diff --git a/lib/galaxy/files/sources/azure.py b/lib/galaxy/files/sources/azure.py
index 519c3354ed5f..125bbc291919 100644
--- a/lib/galaxy/files/sources/azure.py
+++ b/lib/galaxy/files/sources/azure.py
@@ -32,6 +32,7 @@ def _open_fs(self, user_context=None, opts: Optional[FilesSourceOptions] = None)
         account_name = all_props["account_name"]
         account_key = all_props["account_key"]
         container = all_props["container_name"]
+        handle: Union[BlobFSV2, BlobFS]
         if namespace_type == "flat":
             handle = BlobFS(account_name, container, account_key)
         else:
diff --git a/lib/galaxy/files/templates/__init__.py b/lib/galaxy/files/templates/__init__.py
new file mode 100644
index 000000000000..aa8faf85fd30
--- /dev/null
+++ b/lib/galaxy/files/templates/__init__.py
@@ -0,0 +1,17 @@
+from .manager import ConfiguredFileSourceTemplates
+from .models import (
+    FileSourceConfiguration,
+    FileSourceTemplate,
+    FileSourceTemplateSummaries,
+    FileSourceTemplateType,
+    template_to_configuration,
+)
+
+__all__ = (
+    "ConfiguredFileSourceTemplates",
+    "FileSourceConfiguration",
+    "FileSourceTemplate",
+    "FileSourceTemplateSummaries",
+    "FileSourceTemplateType",
+    "template_to_configuration",
+)
diff --git a/lib/galaxy/files/templates/examples/__init__.py b/lib/galaxy/files/templates/examples/__init__.py
new file mode 100644
index 000000000000..3220cb7423f2
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/__init__.py
@@ -0,0 +1,5 @@
+from galaxy.util.resources import resource_string
+
+
+def get_example(filename) -> str:
+    return resource_string("galaxy.files.templates.examples", filename)
diff --git a/lib/galaxy/files/templates/examples/admin_secrets.yml b/lib/galaxy/files/templates/examples/admin_secrets.yml
new file mode 100644
index 000000000000..5c421b2278e2
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/admin_secrets.yml
@@ -0,0 +1,13 @@
+- id: admin_secret_directory
+  name: Secret Directory
+  description: An directory constructed from admin secrets.
+  configuration:
+    type: posix
+    root: /path/to/data/{{ environment.var }}/{{ environment.sec }}
+  environment:
+    var:
+      type: variable
+      variable: GALAXY_SECRET_HOME_VAR
+    sec:
+      type: secret
+      vault_key: "secret_directory_file_source/my_secret"
diff --git a/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml b/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
new file mode 100644
index 000000000000..2cbec347ce8c
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/admin_secrets_with_defaults.yml
@@ -0,0 +1,15 @@
+- id: admin_secret_directory
+  name: Secret Directory with Defaults
+  description: An directory constructed from admin secrets or defaults.
+  configuration:
+    type: posix
+    root: /path/to/data/{{ environment.var }}/{{ environment.sec }}
+  environment:
+    var:
+      type: variable
+      variable: GALAXY_SECRET_HOME_VAR
+      default: default_var
+    sec:
+      type: secret
+      vault_key: "secret_directory_file_source/my_secret"
+      default: default_sec
diff --git a/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
new file mode 100644
index 000000000000..81e62afa16ad
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
@@ -0,0 +1,30 @@
+- id: aws_private
+  name: Amazon Web Services Private Bucket
+  description: Setup access to a private AWS bucket using a secret access key. 
+  configuration:
+    type: s3fs
+    bucket: "{{ bucket }}"
+    writable: "{{ writable }}"
+    secret: "{{ secret_key }}"
+    key: "{{ access_key }}"
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The "access key ID" as defined in the [Amazon Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [Amazon Web Services Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        access. This should be a bucket the user described by the Access Key ID has access to.
+    writable:
+      label: Writable?
+      type: boolean
+      help: Is this a bucket you have permission to write to?
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |        
+        The "secret access key" as defined in the [Amazon Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
diff --git a/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml b/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
new file mode 100644
index 000000000000..66cb2aff6550
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_aws_public_bucket.yml
@@ -0,0 +1,15 @@
+- id: aws_public
+  name: Amazon Web Services Public Bucket
+  description: Setup anonymous access to a public AWS bucket. 
+  configuration:
+    type: s3fs
+    bucket: "{{ bucket }}"
+    writable: false
+    anon: true
+  variables:
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [Amazon Web Services Bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        anonymously access.
diff --git a/lib/galaxy/files/templates/examples/production_azure.yml b/lib/galaxy/files/templates/examples/production_azure.yml
new file mode 100644
index 000000000000..0f0090f3711e
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_azure.yml
@@ -0,0 +1,44 @@
+- id: azure
+  version: 0
+  name: Azure Blob Storage
+  description: |
+    This template allows connecting to [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure
+    container_name: "{{ variables.container_name }}"
+    account_name: "{{ variables.account_name }}"
+    account_key: "{{ secrets.account_key }}"
+    namespace_type: "{{ 'hierarchical' if variables.hierarchical else 'flat' }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container. More information on containers can be found
+        in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction#containers).
+    account_name:
+      label: Storage Account Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage account. More information on containers can be found in the
+        [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview).
+    hierarchical:
+      label: Hierarchical?
+      type: boolean
+      default: true
+      help: |
+        Is this storage hierarchical (e.g. does it use a Azure Data Lake Storage Gen2 hierarchical namespace)?
+        More information on Data Lake Storage namespaces can be found in the
+        [Azure Blob Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-namespace).
+    writable:
+      label: Writable?
+      type: boolean
+      default: true
+      help: Allow Galaxy to write data to this Azure Blob Storage container.
+  secrets:
+    account_key:
+      label: Account Key
+      help: |
+        The Azure Blob Storage account key to use to access your Azure Blob Storage data. More information
+        on account keys can be found in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage).
diff --git a/lib/galaxy/files/templates/examples/production_ftp.yml b/lib/galaxy/files/templates/examples/production_ftp.yml
new file mode 100644
index 000000000000..2f3d44d7c524
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/production_ftp.yml
@@ -0,0 +1,39 @@
+- id: ftp
+  version: 0
+  name: An FTP Server
+  description: |
+    This template allows connecting to FTP servers. This file source plugin should
+    support FTP and FTPS servers.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      label: FTP Host
+      type: string
+      help: Host of FTP Server to connect to.
+    user:
+      label: FTP User
+      type: string
+      help: |
+        Username to connect with. Leave this blank to connect to the server
+        anonymously (if allowed by target server).
+    writable:
+      label: Writable?
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+    port:
+      label: FTP Port
+      type: integer
+      help: Port used to connect to the FTP server.
+      default: 21
+  secrets:
+    password:
+      label: FTP Password
+      help: |
+        Password to connect to FTP server with. Leave this blank to connect
+        to the server anonymously (if allowed by target server).
diff --git a/lib/galaxy/files/templates/examples/templating_override.yml b/lib/galaxy/files/templates/examples/templating_override.yml
new file mode 100644
index 000000000000..ad11b3265ebf
--- /dev/null
+++ b/lib/galaxy/files/templates/examples/templating_override.yml
@@ -0,0 +1,13 @@
+- id: project_disk
+  name: Project Disk
+  description: |
+    Disk in our institutional ``/data`` directory for you user's project.""
+  configuration:
+    type: posix
+    root: '/data/projects/@= user.username | ensure_path_component =@/@= variables.project_name | ensure_path_component =@'
+    template_start: '@='
+    template_end: '=@'
+  variables:
+    project_name:
+      type: path_component
+      help: Project name used in path.
diff --git a/lib/galaxy/files/templates/manager.py b/lib/galaxy/files/templates/manager.py
new file mode 100644
index 000000000000..79a649093999
--- /dev/null
+++ b/lib/galaxy/files/templates/manager.py
@@ -0,0 +1,86 @@
+import os
+from typing import (
+    List,
+    Optional,
+    Protocol,
+)
+
+from yaml import safe_load
+
+from galaxy.util.config_templates import (
+    apply_syntactic_sugar,
+    find_template,
+    find_template_by,
+    InstanceDefinition,
+    RawTemplateConfig,
+    TemplateReference,
+    validate_secrets_and_variables,
+    verify_vault_configured_if_uses_secrets,
+)
+from .models import (
+    FileSourceTemplate,
+    FileSourceTemplateCatalog,
+    FileSourceTemplateSummaries,
+)
+
+SECRETS_NEED_VAULT_MESSAGE = "The file source templates configuration can not be used - a Galaxy vault must be configured for templates that use secrets - please set the vault_config_file configuration option to point at a valid vault configuration."
+
+
+class AppConfigProtocol(Protocol):
+    file_source_templates: Optional[List[RawTemplateConfig]]
+    file_source_templates_config_file: Optional[str]
+
+
+class ConfiguredFileSourceTemplates:
+    catalog: FileSourceTemplateCatalog
+
+    def __init__(self, catalog: FileSourceTemplateCatalog):
+        self.catalog = catalog
+
+    @staticmethod
+    def from_app_config(config: AppConfigProtocol, vault_configured=None) -> "ConfiguredFileSourceTemplates":
+        raw_config = config.file_source_templates
+        if raw_config is None:
+            config_file = config.file_source_templates_config_file
+            if config_file and os.path.exists(config_file):
+                with open(config_file) as f:
+                    raw_config = safe_load(f)
+        if raw_config is None:
+            raw_config = []
+        catalog = raw_config_to_catalog(raw_config)
+        verify_vault_configured_if_uses_secrets(
+            catalog,
+            vault_configured,
+            SECRETS_NEED_VAULT_MESSAGE,
+        )
+        templates = ConfiguredFileSourceTemplates(catalog)
+        return templates
+
+    @property
+    def summaries(self) -> FileSourceTemplateSummaries:
+        templates = self.catalog.root
+        summaries = []
+        for template in templates:
+            template_dict = template.model_dump()
+            configuration = template_dict.pop("configuration")
+            template_dict.pop("environment")
+            object_store_type = configuration["type"]
+            template_dict["type"] = object_store_type
+            summaries.append(template_dict)
+        return FileSourceTemplateSummaries.model_validate(summaries)
+
+    def find_template(self, instance_reference: TemplateReference) -> FileSourceTemplate:
+        """Find the corresponding template and throw ObjectNotFound if not available."""
+        return find_template(self.catalog.root, instance_reference, "file source")
+
+    def find_template_by(self, template_id: str, template_version: int) -> FileSourceTemplate:
+        return find_template_by(self.catalog.root, template_id, template_version, "file source")
+
+    def validate(self, instance: InstanceDefinition):
+        template = self.find_template(instance)
+        validate_secrets_and_variables(instance, template)
+
+
+def raw_config_to_catalog(raw_config: List[RawTemplateConfig]) -> FileSourceTemplateCatalog:
+    effective_root = apply_syntactic_sugar(raw_config)
+    return FileSourceTemplateCatalog.model_validate(effective_root)
diff --git a/lib/galaxy/files/templates/models.py b/lib/galaxy/files/templates/models.py
new file mode 100644
index 000000000000..1e26d1d244ba
--- /dev/null
+++ b/lib/galaxy/files/templates/models.py
@@ -0,0 +1,189 @@
+from typing import (
+    Any,
+    Dict,
+    List,
+    Literal,
+    Optional,
+    Type,
+    Union,
+)
+
+from pydantic import RootModel
+
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    expand_raw_config,
+    MarkdownContent,
+    populate_default_variables,
+    SecretsDict,
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateExpansion,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableValueType,
+    UserDetailsDict,
+)
+
+FileSourceTemplateType = Literal["ftp", "posix", "s3fs", "azure"]
+
+
+class PosixFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["posix"]
+    root: Union[str, TemplateExpansion]
+    writable: Union[bool, TemplateExpansion] = False
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class PosixFileSourceConfiguration(StrictModel):
+    type: Literal["posix"]
+    root: str
+    writable: bool = False
+
+
+class S3FSFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["s3fs"]
+    endpoint_url: Optional[Union[str, TemplateExpansion]] = None
+    anon: Optional[Union[bool, TemplateExpansion]] = False
+    secret: Optional[Union[str, TemplateExpansion]] = None
+    key: Optional[Union[str, TemplateExpansion]] = None
+    bucket: Optional[Union[str, TemplateExpansion]] = None
+    writable: Union[bool, TemplateExpansion] = False
+    anon: Optional[Union[bool, TemplateExpansion]] = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class S3FSFileSourceConfiguration(StrictModel):
+    type: Literal["s3fs"]
+    endpoint_url: Optional[str] = None
+    anon: Optional[bool] = False
+    secret: Optional[str] = None
+    key: Optional[str] = None
+    bucket: Optional[str] = None
+    writable: bool = False
+    anon: Optional[bool] = None
+
+
+class FtpFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["ftp"]
+    host: Union[str, TemplateExpansion]
+    port: Union[int, TemplateExpansion] = 21
+    user: Optional[Union[str, TemplateExpansion]] = None
+    passwd: Optional[Union[str, TemplateExpansion]] = None
+    writable: Union[bool, TemplateExpansion] = False
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class FtpFileSourceConfiguration(StrictModel):
+    type: Literal["ftp"]
+    host: str
+    port: int = 21
+    user: Optional[str] = None
+    passwd: Optional[str] = None
+    writable: bool = False
+
+
+class AzureFileSourceTemplateConfiguration(StrictModel):
+    type: Literal["azure"]
+    account_name: Union[str, TemplateExpansion]
+    container_name: Union[str, TemplateExpansion]
+    account_key: Union[str, TemplateExpansion]
+    writable: Union[bool, TemplateExpansion] = False
+    namespace_type: Union[str, TemplateExpansion] = "hierarchical"
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
+
+
+class AzureFileSourceConfiguration(StrictModel):
+    type: Literal["azure"]
+    account_name: str
+    container_name: str
+    account_key: str
+    namespace_type: str = "hierarchical"
+    writable: bool = False
+
+
+FileSourceTemplateConfiguration = Union[
+    PosixFileSourceTemplateConfiguration,
+    S3FSFileSourceTemplateConfiguration,
+    FtpFileSourceTemplateConfiguration,
+    AzureFileSourceTemplateConfiguration,
+]
+FileSourceConfiguration = Union[
+    PosixFileSourceConfiguration,
+    S3FSFileSourceConfiguration,
+    FtpFileSourceConfiguration,
+    AzureFileSourceConfiguration,
+]
+
+
+class FileSourceTemplateBase(StrictModel):
+    """Version of FileSourceTemplate we can send to the UI/API.
+
+    The configuration key in the child type may have secretes
+    and shouldn't be exposed over the API - at least to non-admins.
+    """
+
+    id: str
+    name: Optional[str]
+    description: Optional[MarkdownContent]
+    # The UI should just show the most recent version but allow
+    # admins to define newer versions with new parameterizations
+    # and keep old versions in template catalog for backward compatibility
+    # for users with existing stores of that template.
+    version: int = 0
+    # Like with multiple versions, allow admins to deprecate a
+    # template by hiding but keep it in the catalog for backward
+    # compatibility for users with existing stores of that template.
+    hidden: bool = False
+    variables: Optional[List[TemplateVariable]] = None
+    secrets: Optional[List[TemplateSecret]] = None
+
+
+class FileSourceTemplateSummary(FileSourceTemplateBase):
+    type: FileSourceTemplateType
+
+
+class FileSourceTemplate(FileSourceTemplateBase):
+    configuration: FileSourceTemplateConfiguration
+    environment: Optional[List[TemplateEnvironmentEntry]] = None
+
+
+FileSourceTemplateCatalog = RootModel[List[FileSourceTemplate]]
+
+
+class FileSourceTemplateSummaries(RootModel):
+    root: List[FileSourceTemplateSummary]
+
+
+def template_to_configuration(
+    template: FileSourceTemplate,
+    variables: Dict[str, TemplateVariableValueType],
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
+) -> FileSourceConfiguration:
+    configuration_template = template.configuration
+    populate_default_variables(template.variables, variables)
+    raw_config = expand_raw_config(configuration_template, variables, secrets, user_details, environment)
+    return to_configuration_object(raw_config)
+
+
+TypesToConfigurationClasses: Dict[FileSourceTemplateType, Type[FileSourceConfiguration]] = {
+    "ftp": FtpFileSourceConfiguration,
+    "posix": PosixFileSourceConfiguration,
+    "s3fs": S3FSFileSourceConfiguration,
+    "azure": AzureFileSourceConfiguration,
+}
+
+
+def to_configuration_object(configuration_dict: Dict[str, Any]) -> FileSourceConfiguration:
+    if "type" not in configuration_dict:
+        raise KeyError("Configuration objects require a file source 'type' key, none found.")
+    object_store_type = configuration_dict["type"]
+    if object_store_type not in TypesToConfigurationClasses:
+        raise ValueError(f"Unknown file source type found in raw configuration dictionary ({object_store_type}).")
+    return TypesToConfigurationClasses[object_store_type](**configuration_dict)
diff --git a/lib/galaxy/files/unittest_utils/__init__.py b/lib/galaxy/files/unittest_utils/__init__.py
index c8ebbc13a5b3..e04da53aabd9 100644
--- a/lib/galaxy/files/unittest_utils/__init__.py
+++ b/lib/galaxy/files/unittest_utils/__init__.py
@@ -2,13 +2,16 @@
 import tempfile
 from typing import Tuple
 
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+)
 from galaxy.files.plugins import FileSourcePluginsConfig
 
 
 class TestConfiguredFileSources(ConfiguredFileSources):
     def __init__(self, file_sources_config: FileSourcePluginsConfig, conf_dict: dict, test_root: str):
-        super().__init__(file_sources_config, conf_dict=conf_dict)
+        super().__init__(file_sources_config, ConfiguredFileSourcesConf(conf_dict=conf_dict))
         self.test_root = test_root
 
 
diff --git a/lib/galaxy/managers/file_source_instances.py b/lib/galaxy/managers/file_source_instances.py
new file mode 100644
index 000000000000..98d6dcd051b4
--- /dev/null
+++ b/lib/galaxy/managers/file_source_instances.py
@@ -0,0 +1,436 @@
+import logging
+from typing import (
+    Any,
+    cast,
+    Dict,
+    List,
+    Literal,
+    Optional,
+    Set,
+    Union,
+)
+from uuid import uuid4
+
+from pydantic import (
+    BaseModel,
+    ValidationError,
+)
+
+from galaxy.exceptions import (
+    ItemOwnershipException,
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.files import (
+    FileSourceScore,
+    FileSourcesUserContext,
+    UserDefinedFileSources,
+)
+from galaxy.files.plugins import (
+    FileSourcePluginLoader,
+    FileSourcePluginsConfig,
+)
+from galaxy.files.sources import (
+    BaseFilesSource,
+    file_source_type_is_browsable,
+    FilesSourceProperties,
+    PluginKind,
+)
+from galaxy.files.templates import (
+    ConfiguredFileSourceTemplates,
+    FileSourceConfiguration,
+    FileSourceTemplateSummaries,
+    FileSourceTemplateType,
+)
+from galaxy.managers.context import ProvidesUserContext
+from galaxy.model import (
+    CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE,
+    User,
+    UserFileSource,
+)
+from galaxy.model.scoped_session import galaxy_scoped_session
+from galaxy.security.vault import Vault
+from galaxy.util.config_templates import TemplateVariableValueType
+from galaxy.util.plugin_config import plugin_source_from_dict
+from .object_store_instances import (
+    CreateInstancePayload,
+    ModifyInstancePayload,
+    prepare_environment,
+    recover_secrets,
+    UpdateInstancePayload,
+    UpdateInstanceSecretPayload,
+    UpgradeInstancePayload,
+)
+
+log = logging.getLogger(__name__)
+
+USER_FILE_SOURCES_SCHEME = "gxuserfiles"
+
+
+class UserFileSourceModel(BaseModel):
+    id: Union[str, int]
+    uuid: str
+    uri_root: str
+    name: str
+    description: Optional[str]
+    type: FileSourceTemplateType
+    template_id: str
+    template_version: int
+    variables: Optional[Dict[str, TemplateVariableValueType]]
+    secrets: List[str]
+
+
+class UserDefinedFileSourcesConfig(BaseModel):
+    user_object_store_index_by: Literal["uuid", "id"]
+
+    @staticmethod
+    def from_app_config(config) -> "UserDefinedFileSourcesConfig":
+        user_object_store_index_by = config.user_object_store_index_by
+        assert user_object_store_index_by in ["uuid", "id"]
+        return UserDefinedFileSourcesConfig(user_object_store_index_by=user_object_store_index_by)
+
+
+class FileSourceInstancesManager:
+    _catalog: ConfiguredFileSourceTemplates
+    _sa_session: galaxy_scoped_session
+    _app_vault: Vault
+    _app_config: UserDefinedFileSourcesConfig
+
+    def __init__(
+        self,
+        catalog: ConfiguredFileSourceTemplates,
+        sa_session: galaxy_scoped_session,
+        vault: Vault,
+        app_config: UserDefinedFileSourcesConfig,
+    ):
+        self._catalog = catalog
+        self._sa_session = sa_session
+        self._app_vault = vault
+        self._app_config = app_config
+
+    @property
+    def summaries(self) -> FileSourceTemplateSummaries:
+        return self._catalog.summaries
+
+    def index(self, trans: ProvidesUserContext) -> List[UserFileSourceModel]:
+        stores = self._sa_session.query(UserFileSource).filter(UserFileSource.user_id == trans.user.id).all()
+        return [self._to_model(trans, s) for s in stores]
+
+    def show(self, trans: ProvidesUserContext, id: Union[str, int]) -> UserFileSourceModel:
+        user_file_source = self._get(trans, id)
+        return self._to_model(trans, user_file_source)
+
+    def modify_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: ModifyInstancePayload
+    ) -> UserFileSourceModel:
+        if isinstance(payload, UpgradeInstancePayload):
+            return self._upgrade_instance(trans, id, payload)
+        elif isinstance(payload, UpdateInstanceSecretPayload):
+            return self._update_instance_secret(trans, id, payload)
+        else:
+            assert isinstance(payload, UpdateInstancePayload)
+            return self._update_instance(trans, id, payload)
+
+    def _upgrade_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpgradeInstancePayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        catalog = self._catalog
+        template = catalog.find_template_by(persisted_file_source.template_id, payload.template_version)
+        persisted_file_source.template_version = template.version
+        persisted_file_source.template_definition = template.model_dump()
+        old_variables = persisted_file_source.template_variables or {}
+        updated_variables = payload.variables
+        actual_variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = {}
+        for variable in template.variables or []:
+            variable_name = variable.name
+            old_value = old_variables.get(variable_name)
+            updated_value = updated_variables.get(variable_name, old_value)
+            if updated_value:
+                actual_variables[variable_name] = updated_value
+
+        persisted_file_source.template_variables = actual_variables
+        old_secrets = persisted_file_source.template_secrets or []
+        new_secrets = payload.secrets
+
+        recorded_secrets = persisted_file_source.template_secrets or []
+
+        user_vault = trans.user_vault
+        upgraded_template_secrets = []
+        for secret in template.secrets or []:
+            secret_name = secret.name
+            upgraded_template_secrets.append(secret_name)
+            if secret_name not in new_secrets and secret_name not in old_secrets:
+                raise RequestParameterMissingException(f"secret {secret_name} not set in supplied request")
+            if secret_name not in new_secrets:
+                # keep old value
+                continue
+
+            secret_value = new_secrets[secret_name]
+            key = persisted_file_source.vault_key(secret_name, self._app_config)
+            user_vault.write_secret(key, secret_value)
+            if secret_name not in recorded_secrets:
+                recorded_secrets.append(secret_name)
+
+        secrets_to_delete: List[str] = []
+        for recorded_secret in recorded_secrets:
+            if recorded_secret not in upgraded_template_secrets:
+                key = persisted_file_source.vault_key(recorded_secret, self._app_config)
+                log.info(f"deleting {key} from user vault")
+                user_vault.delete_secret(key)
+                secrets_to_delete.append(recorded_secret)
+
+        for secret_to_delete in secrets_to_delete:
+            recorded_secrets.remove(secret_to_delete)
+
+        persisted_file_source.template_secrets = recorded_secrets
+        self._save(persisted_file_source)
+        rval = self._to_model(trans, persisted_file_source)
+        return rval
+
+    def _update_instance(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstancePayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        if payload.name is not None:
+            persisted_file_source.name = payload.name
+        if payload.description is not None:
+            persisted_file_source.description = payload.description
+        if payload.variables is not None:
+            # maybe just record the valid variables according to template like in upgrade
+            persisted_file_source.template_variables = payload.variables
+        self._save(persisted_file_source)
+        return self._to_model(trans, persisted_file_source)
+
+    def _update_instance_secret(
+        self, trans: ProvidesUserContext, id: Union[str, int], payload: UpdateInstanceSecretPayload
+    ) -> UserFileSourceModel:
+        persisted_file_source = self._get(trans, id)
+        user_vault = trans.user_vault
+        key = persisted_file_source.vault_key(payload.secret_name, self._app_config)
+        user_vault.write_secret(key, payload.secret_value)
+        return self._to_model(trans, persisted_file_source)
+
+    def create_instance(self, trans: ProvidesUserContext, payload: CreateInstancePayload) -> UserFileSourceModel:
+        catalog = self._catalog
+        catalog.validate(payload)
+        template = catalog.find_template(payload)
+        assert template
+        user_vault = trans.user_vault
+        persisted_file_source = UserFileSource()
+        persisted_file_source.user_id = trans.user.id
+        assert persisted_file_source.user_id
+        persisted_file_source.uuid = uuid4().hex
+        persisted_file_source.template_definition = template.model_dump()
+        persisted_file_source.template_id = template.id
+        persisted_file_source.template_version = template.version
+        persisted_file_source.template_variables = payload.variables
+        persisted_file_source.name = payload.name
+        persisted_file_source.description = payload.description
+        self._save(persisted_file_source)
+
+        # the exception handling below will cleanup object stores that cannot be
+        # finalized with a successful secret setting but it might be worth considering
+        # something more robust. Two ideas would be to set a uuid on the persisted_file_source
+        # and key the secrets on that instead of the of the ID (but this raises the question
+        # are unused secrets in the vault maybe even worse than broken db objects) or
+        # set a state on the DB objects and with INITIAL and ACTIVE states. State
+        # idea might be nice because then we could add INACTIVE state that would prevent
+        # new data from being added but still allow access.
+        recorded_secrets = []
+        try:
+            for secret, value in payload.secrets.items():
+                key = persisted_file_source.vault_key(secret, self._app_config)
+                user_vault.write_secret(key, value)
+                recorded_secrets.append(secret)
+        except Exception:
+            self._sa_session.delete(persisted_file_source)
+            raise
+        persisted_file_source.template_secrets = recorded_secrets
+        self._save(persisted_file_source)
+        return self._to_model(trans, persisted_file_source)
+
+    def _index_filter(self, id: Union[str, int]):
+        index_by = self._app_config.user_object_store_index_by
+        index_filter: Any
+        if index_by == "id":
+            id_as_int = int(id)
+            index_filter = UserFileSource.__table__.c.id == id_as_int
+        else:
+            id_as_str = str(id)
+            index_filter = UserFileSource.__table__.c.uuid == id_as_str
+        return index_filter
+
+    def _get(self, trans: ProvidesUserContext, id: Union[str, int]) -> UserFileSource:
+        filter = self._index_filter(id)
+        user_file_source = self._sa_session.query(UserFileSource).filter(filter).one_or_none()
+        if user_file_source is None:
+            raise RequestParameterInvalidException(f"Failed to fetch object store for id {id}")
+        if user_file_source.user != trans.user:
+            raise ItemOwnershipException()
+        return user_file_source
+
+    def _save(self, user_file_source: UserFileSource) -> None:
+        self._sa_session.add(user_file_source)
+        self._sa_session.flush([user_file_source])
+        self._sa_session.commit()
+
+    def _to_model(self, trans, persisted_file_source: UserFileSource) -> UserFileSourceModel:
+        file_source_type = persisted_file_source.template.configuration.type
+        # These shouldn't be null but sometimes can be?
+        secrets = persisted_file_source.template_secrets or []
+        index_by = self._app_config.user_object_store_index_by
+        response_id: Union[str, int]
+        if index_by == "id":
+            ufs_id = str(persisted_file_source.id)
+            response_id = persisted_file_source.id
+        else:
+            ufs_id = str(persisted_file_source.uuid)
+            response_id = ufs_id
+        uri_root = f"{USER_FILE_SOURCES_SCHEME}://{ufs_id}"
+        return UserFileSourceModel(
+            id=response_id,
+            uuid=str(persisted_file_source.uuid),
+            uri_root=uri_root,
+            type=file_source_type,
+            template_id=persisted_file_source.template_id,
+            template_version=persisted_file_source.template_version,
+            variables=persisted_file_source.template_variables,
+            secrets=secrets,
+            name=persisted_file_source.name,
+            description=persisted_file_source.description,
+        )
+
+
+class UserDefinedFileSourcesImpl(UserDefinedFileSources):
+    _sa_session: galaxy_scoped_session
+    _app_config: UserDefinedFileSourcesConfig
+    _file_sources_config: FileSourcePluginsConfig
+    _plugin_loader: FileSourcePluginLoader
+    _app_vault: Vault
+
+    def __init__(
+        self,
+        sa_session: galaxy_scoped_session,
+        app_config: UserDefinedFileSourcesConfig,
+        file_sources_config: FileSourcePluginsConfig,
+        plugin_loader: FileSourcePluginLoader,
+        vault: Vault,
+    ):
+        self._sa_session = sa_session
+        self._app_config = app_config
+        self._plugin_loader = plugin_loader
+        self._file_sources_config = file_sources_config
+        self._app_vault = vault
+
+    def _user_file_source(self, uri: str) -> Optional[UserFileSource]:
+        if "://" not in uri:
+            return None
+        uri_scheme, uri_rest = uri.split("://", 1)
+        if uri_scheme != USER_FILE_SOURCES_SCHEME:
+            return None
+        if "/" in uri_rest:
+            uri_root, _ = uri_rest.split("/", 1)
+        else:
+            uri_root = uri_rest
+        index_by = self._app_config.user_object_store_index_by
+        index_filter: Any
+        if index_by == "id":
+            index_filter = UserFileSource.__table__.c.id == uri_root
+        else:
+            index_filter = UserFileSource.__table__.c.uuid == uri_root
+
+        user_object_store: UserFileSource = self._sa_session.query(UserFileSource).filter(index_filter).one()
+        return user_object_store
+
+    def _file_source_properties_from_uri(self, uri: str) -> Optional[FilesSourceProperties]:
+        user_file_source = self._user_file_source(uri)
+        if not user_file_source:
+            return None
+        return self._file_source_properties(user_file_source)
+
+    def _file_source_properties(self, user_file_source: UserFileSource) -> FilesSourceProperties:
+        secrets = recover_secrets(user_file_source, self._app_vault, self._app_config)
+        environment = prepare_environment(user_file_source, self._app_vault, self._app_config)
+        file_source_configuration: FileSourceConfiguration = user_file_source.file_source_configuration(
+            secrets=secrets, environment=environment
+        )
+        file_source_properties = cast(FilesSourceProperties, file_source_configuration.model_dump())
+        file_source_properties["label"] = user_file_source.name
+        file_source_properties["doc"] = user_file_source.description
+        file_source_properties["id"] = f"{user_file_source.uuid}"
+        file_source_properties["scheme"] = USER_FILE_SOURCES_SCHEME
+        # when should this be false - I think it can depend on the plugin type
+        # no reason to prevent users from writing to their own file sources?
+        file_source_properties["writable"] = True
+        return file_source_properties
+
+    def validate_uri_root(self, uri: str, user_context: FileSourcesUserContext) -> None:
+        user_object_store = self._user_file_source(uri)
+        if not user_object_store:
+            return
+        if user_object_store.user.username != user_context.username:
+            raise ItemOwnershipException("Your Galaxy user does not have access to the requested resource.")
+
+    def find_best_match(self, url: str) -> Optional[FileSourceScore]:
+        files_source_properties = self._file_source_properties_from_uri(url)
+        if files_source_properties is None:
+            return None
+        file_source = self._file_source(files_source_properties)
+        return FileSourceScore(file_source, len(url))
+
+    def _file_source(self, files_source_properties: FilesSourceProperties) -> BaseFilesSource:
+        plugin_source = plugin_source_from_dict([cast(Dict[str, Any], files_source_properties)])
+        file_source = self._plugin_loader.load_plugins(
+            plugin_source,
+            self._file_sources_config,
+        )[0]
+        return file_source
+
+    def _all_user_file_source_properties(self, user_context: FileSourcesUserContext) -> List[FilesSourceProperties]:
+        username_filter = User.__table__.c.username == user_context.username
+        user: Optional[User] = self._sa_session.query(User).filter(username_filter).one_or_none()
+        if user is None:
+            return []
+        all_file_source_properties: List[FilesSourceProperties] = []
+        for user_file_source in user.file_sources:
+            try:
+                files_source_properties = self._file_source_properties(user_file_source)
+            except ValidationError:
+                log.warning(f"Problem validating user_file_source {user_file_source.uuid}, skipping load.")
+            all_file_source_properties.append(files_source_properties)
+        return all_file_source_properties
+
+    def user_file_sources_to_dicts(
+        self,
+        for_serialization: bool,
+        user_context: FileSourcesUserContext,
+        browsable_only: Optional[bool] = False,
+        include_kind: Optional[Set[PluginKind]] = None,
+        exclude_kind: Optional[Set[PluginKind]] = None,
+    ) -> List[FilesSourceProperties]:
+        """Write out user file sources as list of config dictionaries."""
+        as_dicts = []
+        for files_source_properties in self._all_user_file_source_properties(user_context):
+            plugin_kind = PluginKind.rfs
+            if include_kind and plugin_kind not in include_kind:
+                continue
+            if exclude_kind and plugin_kind in exclude_kind:
+                continue
+            files_source_type = files_source_properties["type"]
+            is_browsable = file_source_type_is_browsable(self._plugin_loader.get_plugin_type_class(files_source_type))
+            if browsable_only and not is_browsable:
+                continue
+            file_source = self._file_source(files_source_properties)
+            as_dicts.append(file_source.to_dict(for_serialization=for_serialization, user_context=user_context))
+        return as_dicts
+
+
+__all__ = (
+    "CreateInstancePayload",
+    "FileSourceInstancesManager",
+    "ModifyInstancePayload",
+    "UpdateInstancePayload",
+    "UpdateInstanceSecretPayload",
+    "UpgradeInstancePayload",
+)
diff --git a/lib/galaxy/managers/object_store_instances.py b/lib/galaxy/managers/object_store_instances.py
index ae1565e462ab..b2a0daf707eb 100644
--- a/lib/galaxy/managers/object_store_instances.py
+++ b/lib/galaxy/managers/object_store_instances.py
@@ -8,8 +8,10 @@
 """
 
 import logging
+import os
 from typing import (
     Any,
+    cast,
     Dict,
     List,
     Optional,
@@ -26,9 +28,12 @@
 )
 from galaxy.managers.context import ProvidesUserContext
 from galaxy.model import (
-    OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE,
+    CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE,
+    HasConfigEnvironment,
+    HasConfigSecrets,
     User,
     UserObjectStore,
+    UsesTemplatesAppConfig,
 )
 from galaxy.model.scoped_session import galaxy_scoped_session
 from galaxy.objectstore import (
@@ -44,11 +49,17 @@
     ObjectStoreTemplateSummaries,
     ObjectStoreTemplateType,
 )
-from galaxy.objectstore.templates.models import ObjectStoreTemplateVariableValueType
 from galaxy.security.vault import (
     UserVaultWrapper,
     Vault,
 )
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    SecretsDict,
+    TemplateEnvironmentSecret,
+    TemplateEnvironmentVariable,
+    TemplateVariableValueType,
+)
 
 log = logging.getLogger(__name__)
 
@@ -58,14 +69,14 @@ class CreateInstancePayload(BaseModel):
     description: Optional[str] = None
     template_id: str
     template_version: int
-    variables: Dict[str, ObjectStoreTemplateVariableValueType]
+    variables: Dict[str, TemplateVariableValueType]
     secrets: Dict[str, str]
 
 
 class UpdateInstancePayload(BaseModel):
     name: Optional[str] = None
     description: Optional[str] = None
-    variables: Optional[Dict[str, ObjectStoreTemplateVariableValueType]] = None
+    variables: Optional[Dict[str, TemplateVariableValueType]] = None
 
 
 class UpdateInstanceSecretPayload(BaseModel):
@@ -75,7 +86,7 @@ class UpdateInstanceSecretPayload(BaseModel):
 
 class UpgradeInstancePayload(BaseModel):
     template_version: int
-    variables: Dict[str, ObjectStoreTemplateVariableValueType]
+    variables: Dict[str, TemplateVariableValueType]
     secrets: Dict[str, str]
 
 
@@ -85,7 +96,7 @@ class UserConcreteObjectStoreModel(ConcreteObjectStoreModel):
     type: ObjectStoreTemplateType
     template_id: str
     template_version: int
-    variables: Optional[Dict[str, ObjectStoreTemplateVariableValueType]]
+    variables: Optional[Dict[str, TemplateVariableValueType]]
     secrets: List[str]
 
 
@@ -134,7 +145,7 @@ def _upgrade_instance(
         persisted_object_store.template_definition = template.model_dump()
         old_variables = persisted_object_store.template_variables or {}
         updated_variables = payload.variables
-        actual_variables: OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = {}
+        actual_variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = {}
         for variable in template.variables or []:
             variable_name = variable.name
             old_value = old_variables.get(variable_name)
@@ -160,7 +171,7 @@ def _upgrade_instance(
                 continue
 
             secret_value = new_secrets[secret_name]
-            key = user_vault_key(persisted_object_store, secret_name, self._app_config)
+            key = persisted_object_store.vault_key(secret_name, self._app_config)
             user_vault.write_secret(key, secret_value)
             if secret_name not in recorded_secrets:
                 recorded_secrets.append(secret_name)
@@ -168,7 +179,7 @@ def _upgrade_instance(
         secrets_to_delete: List[str] = []
         for recorded_secret in recorded_secrets:
             if recorded_secret not in upgraded_template_secrets:
-                key = user_vault_key(persisted_object_store, recorded_secret, self._app_config)
+                key = persisted_object_store.vault_key(recorded_secret, self._app_config)
                 log.info(f"deleting {key} from user vault")
                 user_vault.delete_secret(key)
                 secrets_to_delete.append(recorded_secret)
@@ -203,7 +214,7 @@ def _update_instance_secret(
     ) -> UserConcreteObjectStoreModel:
         persisted_object_store = self._get(trans, id)
         user_vault = trans.user_vault
-        key = user_vault_key(persisted_object_store, payload.secret_name, self._app_config)
+        key = persisted_object_store.vault_key(payload.secret_name, self._app_config)
         user_vault.write_secret(key, payload.secret_value)
         return self._to_model(trans, persisted_object_store)
 
@@ -238,7 +249,7 @@ def create_instance(
         recorded_secrets = []
         try:
             for secret, value in payload.secrets.items():
-                key = user_vault_key(persisted_object_store, secret, self._app_config)
+                key = persisted_object_store.vault_key(secret, self._app_config)
                 user_vault.write_secret(key, value)
                 recorded_secrets.append(secret)
         except Exception:
@@ -321,37 +332,50 @@ def _to_model(self, trans, persisted_object_store: UserObjectStore) -> UserConcr
         )
 
 
-def user_vault_key(user_object_store: UserObjectStore, secret: str, app_config: UserObjectStoresAppConfig) -> str:
-    if app_config.user_object_store_index_by == "id":
-        uos_id = str(user_object_store.id)
-    else:
-        uos_id = str(user_object_store.uuid)
-    assert uos_id
-    user_vault_id_prefix = f"object_store_config/{uos_id}"
-    key = f"{user_vault_id_prefix}/{secret}"
-    return key
-
-
 def recover_secrets(
-    user_object_store: UserObjectStore, vault: Vault, app_config: UserObjectStoresAppConfig
-) -> Dict[str, str]:
+    user_object_store: HasConfigSecrets, vault: Vault, app_config: UsesTemplatesAppConfig
+) -> SecretsDict:
     user: User = user_object_store.user
     user_vault = UserVaultWrapper(vault, user)
-    secrets: Dict[str, str] = {}
+    secrets: SecretsDict = {}
     # now we could recover the list of secrets to fetch from...
     # ones recorded as written in the persisted object, the ones
     # expected in the catalog, or the ones expected in the definition
     # persisted.
     persisted_secret_names = user_object_store.template_secrets or []
     for secret in persisted_secret_names:
-        vault_key = user_vault_key(user_object_store, secret, app_config)
+        vault_key = user_object_store.vault_key(secret, app_config)
         secret_value = user_vault.read_secret(vault_key)
-        # assert secret_value
         if secret_value is not None:
             secrets[secret] = secret_value
     return secrets
 
 
+def prepare_environment(
+    configuration_template: HasConfigEnvironment, vault: Vault, app_config: UsesTemplatesAppConfig
+) -> EnvironmentDict:
+    environment: EnvironmentDict = {}
+    for environment_entry in configuration_template.template_environment.root:
+        e_type = environment_entry.type
+        e_name = environment_entry.name
+        if e_type == "secret":
+            template_secret = cast(TemplateEnvironmentSecret, environment_entry)
+            secret_value = vault.read_secret(template_secret.vault_key) or template_secret.default
+            if secret_value:
+                environment[e_name] = secret_value
+        elif e_type == "variable":
+            template_variable = cast(TemplateEnvironmentVariable, environment_entry)
+            variable_value = os.environ.get(template_variable.variable)
+            if variable_value is None:
+                variable_value = template_variable.default
+            if variable_value:
+                environment[e_name] = variable_value
+        else:
+            raise Exception(f"Unknown environment entry type detected [{e_type}]")
+
+    return environment
+
+
 class UserObjectStoreResolverImpl(BaseUserObjectStoreResolver):
     def __init__(self, sa_session: galaxy_scoped_session, vault: Vault, app_config: UserObjectStoresAppConfig):
         self._sa_session = sa_session
@@ -368,5 +392,8 @@ def resolve_object_store_uri_config(self, uri: str) -> ObjectStoreConfiguration:
             index_filter = UserObjectStore.__table__.c.uuid == user_object_store_id
         user_object_store: UserObjectStore = self._sa_session.query(UserObjectStore).filter(index_filter).one()
         secrets = recover_secrets(user_object_store, self._vault, self._app_config)
-        object_store_configuration = user_object_store.object_store_configuration(secrets=secrets)
+        environment = prepare_environment(user_object_store, self._vault, self._app_config)
+        object_store_configuration = user_object_store.object_store_configuration(
+            secrets=secrets, environment=environment
+        )
         return object_store_configuration
diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py
index 44ddd576c6f9..79777782b039 100644
--- a/lib/galaxy/model/__init__.py
+++ b/lib/galaxy/model/__init__.py
@@ -133,6 +133,11 @@
 import galaxy.model.tags
 import galaxy.security.passwords
 import galaxy.util
+from galaxy.files.templates import (
+    FileSourceConfiguration,
+    FileSourceTemplate,
+    template_to_configuration as file_source_template_to_configuration,
+)
 from galaxy.model.base import (
     ensure_object_added_to_session,
     transaction,
@@ -155,7 +160,7 @@
 from galaxy.objectstore.templates import (
     ObjectStoreConfiguration,
     ObjectStoreTemplate,
-    template_to_configuration,
+    template_to_configuration as object_store_template_to_configuration,
 )
 from galaxy.schema.invocation import (
     InvocationCancellationUserRequest,
@@ -182,6 +187,11 @@
     unicodify,
     unique_id,
 )
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    SecretsDict,
+    TemplateEnvironment,
+)
 from galaxy.util.dictifiable import (
     dict_for,
     Dictifiable,
@@ -213,10 +223,27 @@
 
 STR_TO_STR_DICT = Dict[str, str]
 
-OBJECT_STORE_TEMPLATE_CONFIGURATION_VALUE_TYPE = Union[str, bool, int]
-OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = Dict[str, OBJECT_STORE_TEMPLATE_CONFIGURATION_VALUE_TYPE]
-OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE = List[str]
-OBJECT_STORE_TEMPLATE_DEFINITION_TYPE = Dict[str, Any]
+
+class ConfigurationTemplateEnvironmentSecret(TypedDict):
+    name: str
+    type: Literal["secret"]
+    vault_key: str
+
+
+class ConfigurationTemplateEnvironmentVariable(TypedDict):
+    name: str
+    type: Literal["variable"]
+    variable: str
+
+
+CONFIGURATION_TEMPLATE_ENVIRONMENT_ENTRY = Union[
+    ConfigurationTemplateEnvironmentSecret, ConfigurationTemplateEnvironmentVariable
+]
+CONFIGURATION_TEMPLATE_ENVIRONMENT = List[CONFIGURATION_TEMPLATE_ENVIRONMENT_ENTRY]
+CONFIGURATION_TEMPLATE_CONFIGURATION_VALUE_TYPE = Union[str, bool, int]
+CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = Dict[str, CONFIGURATION_TEMPLATE_CONFIGURATION_VALUE_TYPE]
+CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE = List[str]
+CONFIGURATION_TEMPLATE_DEFINITION_TYPE = Dict[str, Any]
 
 
 class TransformAction(TypedDict):
@@ -229,9 +256,10 @@ class TransformAction(TypedDict):
     type_annotation_map={
         Optional[STR_TO_STR_DICT]: JSONType,
         Optional[TRANSFORM_ACTIONS]: MutableJSONType,
-        Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]: JSONType,
-        Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]: JSONType,
-        Optional[OBJECT_STORE_TEMPLATE_DEFINITION_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]: JSONType,
+        Optional[CONFIGURATION_TEMPLATE_ENVIRONMENT]: JSONType,
     },
 )
 
@@ -777,6 +805,7 @@ class User(Base, Dictifiable, RepresentById):
         back_populates="user", order_by=lambda: desc(GalaxySession.update_time), cascade_backrefs=False
     )
     object_stores: Mapped[List["UserObjectStore"]] = relationship(back_populates="user")
+    file_sources: Mapped[List["UserFileSource"]] = relationship(back_populates="user")
     quotas: Mapped[List["UserQuotaAssociation"]] = relationship(back_populates="user")
     quota_source_usages: Mapped[List["UserQuotaSourceUsage"]] = relationship(back_populates="user")
     social_auth: Mapped[List["UserAuthnzToken"]] = relationship(back_populates="user")
@@ -10913,8 +10942,44 @@ def __init__(self, name=None, value=None):
         self.value = value
 
 
-class UserObjectStore(Base, RepresentById):
+class UsesTemplatesAppConfig(Protocol):
+    user_object_store_index_by: Literal["uuid", "id"]
+
+
+class HasConfigSecrets(RepresentById):
+    secret_config_type: str
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]]
+    uuid: Mapped[Union[UUID, str]]
+    user: Mapped["User"]
+
+    def vault_key(self, secret: str, app_config: UsesTemplatesAppConfig) -> str:
+        if app_config.user_object_store_index_by == "id":
+            id_str = str(self.id)
+        else:
+            id_str = str(self.uuid)
+        user_vault_id_prefix = f"{self.secret_config_type}/{id_str}"
+        key = f"{user_vault_id_prefix}/{secret}"
+        return key
+
+
+class HasConfigEnvironment(RepresentById):
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]]
+
+    @property
+    def template_environment(self) -> TemplateEnvironment:
+        definition = self.template_definition
+        if not definition:
+            return TemplateEnvironment.model_validate([])
+        environment = definition.get("environment")
+        if not environment:
+            return TemplateEnvironment.model_validate([])
+        else:
+            return TemplateEnvironment.model_validate(environment)
+
+
+class UserObjectStore(Base, HasConfigSecrets, HasConfigEnvironment, RepresentById):
     __tablename__ = "user_object_store"
+    secret_config_type = "object_store_config"
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
     user_id: Mapped[Optional[int]] = mapped_column(Integer, ForeignKey("galaxy_user.id"), index=True)
@@ -10934,32 +10999,87 @@ class UserObjectStore(Base, RepresentById):
     # the id/version and not record the definition... as the templates change
     # over time this choice has some big consequences despite being easy to swap
     # implementations.
-    template_definition: Mapped[Optional[OBJECT_STORE_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
     # Big JSON blob of the variable name -> value mapping defined for the store's
     # variables by the user.
-    template_variables: Mapped[Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
+    template_variables: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
     # Track a list of secrets that were defined for this object store at creation
-    template_secrets: Mapped[Optional[OBJECT_STORE_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
 
-    user = relationship("User", back_populates="object_stores")
+    user: Mapped["User"] = relationship("User", back_populates="object_stores")
 
     @property
     def template(self) -> ObjectStoreTemplate:
         return ObjectStoreTemplate(**self.template_definition or {})
 
-    def object_store_configuration(self, secrets: Dict[str, Any]) -> ObjectStoreConfiguration:
+    def object_store_configuration(
+        self, secrets: SecretsDict, environment: EnvironmentDict
+    ) -> ObjectStoreConfiguration:
         user = self.user
         user_details = {
             "username": user.username,
             "email": user.email,
             "id": user.id,
         }
-        variables: OBJECT_STORE_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
-        return template_to_configuration(
+        variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
+        return object_store_template_to_configuration(
             self.template,
             variables=variables,
             secrets=secrets,
             user_details=user_details,
+            environment=environment,
+        )
+
+
+class UserFileSource(Base, HasConfigSecrets, HasConfigEnvironment, RepresentById):
+    __tablename__ = "user_file_source"
+    secret_config_type = "file_source_config"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    user_id: Mapped[Optional[int]] = mapped_column(ForeignKey("galaxy_user.id"), index=True)
+    uuid: Mapped[Union[UUID, str]] = mapped_column(UUIDType(), index=True)
+    create_time: Mapped[datetime] = mapped_column(default=now)
+    update_time: Mapped[datetime] = mapped_column(default=now, onupdate=now, index=True)
+    # user specified name of the instance they've created
+    name: Mapped[str] = mapped_column(String(255), index=True)
+    # user specified description of the instance they've created
+    description: Mapped[Optional[str]] = mapped_column(Text)
+    # the template store id
+    template_id: Mapped[str] = mapped_column(String(255), index=True)
+    # the template store version (0, 1, ...)
+    template_version: Mapped[int] = mapped_column(index=True)
+    # Full template from file_sources_templates.yml catalog.
+    # For tools we just store references, so here we could easily just use
+    # the id/version and not record the definition... as the templates change
+    # over time this choice has some big consequences despite being easy to swap
+    # implementations.
+    template_definition: Mapped[Optional[CONFIGURATION_TEMPLATE_DEFINITION_TYPE]] = mapped_column(JSONType)
+    # Big JSON blob of the variable name -> value mapping defined for the store's
+    # variables by the user.
+    template_variables: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE]] = mapped_column(JSONType)
+    # Track a list of secrets that were defined for this object store at creation
+    template_secrets: Mapped[Optional[CONFIGURATION_TEMPLATE_CONFIGURATION_SECRET_NAMES_TYPE]] = mapped_column(JSONType)
+
+    user: Mapped["User"] = relationship("User", back_populates="file_sources")
+
+    @property
+    def template(self) -> FileSourceTemplate:
+        return FileSourceTemplate(**self.template_definition or {})
+
+    def file_source_configuration(self, secrets: SecretsDict, environment: EnvironmentDict) -> FileSourceConfiguration:
+        user = self.user
+        user_details = {
+            "username": user.username,
+            "email": user.email,
+            "id": user.id,
+        }
+        variables: CONFIGURATION_TEMPLATE_CONFIGURATION_VARIABLES_TYPE = self.template_variables or {}
+        return file_source_template_to_configuration(
+            template=self.template,
+            variables=variables,
+            secrets=secrets,
+            user_details=user_details,
+            environment=environment,
         )
 
 
diff --git a/lib/galaxy/model/migrations/alembic/versions_gxy/c14a3c93d66b_add_user_defined_file_sources.py b/lib/galaxy/model/migrations/alembic/versions_gxy/c14a3c93d66b_add_user_defined_file_sources.py
new file mode 100644
index 000000000000..8e0b57760820
--- /dev/null
+++ b/lib/galaxy/model/migrations/alembic/versions_gxy/c14a3c93d66b_add_user_defined_file_sources.py
@@ -0,0 +1,57 @@
+"""add user defined file sources
+
+Revision ID: c14a3c93d66b
+Revises: c14a3c93d66a
+Create Date: 2023-04-01 17:25:37.553039
+
+"""
+
+from sqlalchemy import (
+    Column,
+    DateTime,
+    ForeignKey,
+    Integer,
+    String,
+    Text,
+)
+
+from galaxy.model.custom_types import (
+    JSONType,
+    UUIDType,
+)
+from galaxy.model.migrations.util import (
+    create_table,
+    drop_table,
+)
+
+# revision identifiers, used by Alembic.
+revision = "c14a3c93d66b"
+down_revision = "c14a3c93d66a"
+branch_labels = None
+depends_on = None
+
+
+# database object names used in this revision
+table_name = "user_file_source"
+
+
+def upgrade():
+    create_table(
+        table_name,
+        Column("id", Integer, primary_key=True),
+        Column("user_id", Integer, ForeignKey("galaxy_user.id"), nullable=False, index=True),
+        Column("uuid", UUIDType, nullable=False, index=True),
+        Column("name", String(255), index=True),
+        Column("description", Text, index=True),
+        Column("create_time", DateTime),
+        Column("update_time", DateTime),
+        Column("template_id", String(255), index=True),
+        Column("template_version", Integer, index=True),
+        Column("template_definition", JSONType),
+        Column("template_variables", JSONType),
+        Column("template_secrets", JSONType),
+    )
+
+
+def downgrade():
+    drop_table(table_name)
diff --git a/lib/galaxy/objectstore/__init__.py b/lib/galaxy/objectstore/__init__.py
index 194a896d6832..3a60d879081a 100644
--- a/lib/galaxy/objectstore/__init__.py
+++ b/lib/galaxy/objectstore/__init__.py
@@ -1638,6 +1638,7 @@ class UserObjectStoresAppConfig(BaseModel):
     jobs_directory: str
     new_file_path: str
     umask: int
+    gid: int
 
 
 # TODO: this will need app details...
@@ -1659,6 +1660,7 @@ class GalaxyConfigAdapter:
         jobs_directory = app_config.jobs_directory
         new_file_path = app_config.new_file_path
         umask = app_config.umask
+        gid = app_config.gid
         object_store_cache_size = app_config.object_store_cache_size
         object_store_cache_path = app_config.object_store_cache_path
 
diff --git a/lib/galaxy/objectstore/azure_blob.py b/lib/galaxy/objectstore/azure_blob.py
index 2ae71a8cd933..f07b610ef279 100644
--- a/lib/galaxy/objectstore/azure_blob.py
+++ b/lib/galaxy/objectstore/azure_blob.py
@@ -75,7 +75,7 @@ def parse_config_xml(config_xml):
         if account_url:
             auth["account_url"] = account_url
 
-        return {
+        config_dict = {
             "auth": auth,
             "container": {
                 "name": container_name,
@@ -85,6 +85,12 @@ def parse_config_xml(config_xml):
             "extra_dirs": extra_dirs,
             "private": ConcreteObjectStore.parse_private_from_config_xml(config_xml),
         }
+        name = config_xml.attrib.get("name", None)
+        if name is not None:
+            config_dict["name"] = name
+        device = config_xml.attrib.get("device", None)
+        config_dict["device"] = device
+        return config_dict
     except Exception:
         # Toss it back up after logging, we can't continue loading at this point.
         log.exception("Malformed ObjectStore Configuration XML -- unable to continue")
diff --git a/lib/galaxy/objectstore/s3.py b/lib/galaxy/objectstore/s3.py
index af406f558b76..24e08d9652fd 100644
--- a/lib/galaxy/objectstore/s3.py
+++ b/lib/galaxy/objectstore/s3.py
@@ -98,7 +98,7 @@ def parse_config_xml(config_xml):
             raise Exception(msg)
         extra_dirs = [{k: e.get(k) for k in attrs} for e in extra_dirs]
 
-        return {
+        config_dict = {
             "auth": {
                 "access_key": access_key,
                 "secret_key": secret_key,
@@ -119,6 +119,12 @@ def parse_config_xml(config_xml):
             "extra_dirs": extra_dirs,
             "private": ConcreteObjectStore.parse_private_from_config_xml(config_xml),
         }
+        name = config_xml.attrib.get("name", None)
+        if name is not None:
+            config_dict["name"] = name
+        device = config_xml.attrib.get("device", None)
+        config_dict["device"] = device
+        return config_dict
     except Exception:
         # Toss it back up after logging, we can't continue loading at this point.
         log.exception("Malformed ObjectStore Configuration XML -- unable to continue")
diff --git a/lib/galaxy/objectstore/templates/examples/__init__.py b/lib/galaxy/objectstore/templates/examples/__init__.py
new file mode 100644
index 000000000000..2bcbd0645c79
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/__init__.py
@@ -0,0 +1,5 @@
+from galaxy.util.resources import resource_string
+
+
+def get_example(filename) -> str:
+    return resource_string("galaxy.objectstore.templates.examples", filename)
diff --git a/lib/galaxy/objectstore/templates/examples/azure_just_container.yml b/lib/galaxy/objectstore/templates/examples/azure_just_container.yml
new file mode 100644
index 000000000000..a47bd3e07479
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/azure_just_container.yml
@@ -0,0 +1,22 @@
+- id: lab_azure_storage
+  version: 0
+  name: Azure Blob Storage for our Lab
+  description: |
+    This template allows storing dataset in [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure_blob
+    auth:
+      account_name: 'XXXXXXXXfillinaccount'
+      account_key: 'XXXXXXXXXfillinkey'
+
+    container:
+      name: '{{ variables.container_name }}'
+
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container in our lab space. Contact
+        our lab Galaxy admin awesomelabsnate@ourawesomelab.org if you're unsure
+        what container you should store your data in. 
diff --git a/lib/galaxy/objectstore/templates/examples/cloudflare.yml b/lib/galaxy/objectstore/templates/examples/cloudflare.yml
new file mode 100644
index 000000000000..bf05dbab1685
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/cloudflare.yml
@@ -0,0 +1,48 @@
+# https://developers.cloudflare.com/r2/examples/aws/boto3/
+- id: cloudflare
+  name: CloudFlare R2
+  description: |
+    This template can be used to connect to your [CloudFlare R2](https://developers.cloudflare.com/r2/)
+    storage. To use these templates you will need to generate
+    [CloudFlare R2 access tokens] (https://developers.cloudflare.com/r2/api/s3/tokens/).
+    Following that tutorial, you should have an "Account ID", and "Access Key ID", and a
+    "Secret Access Key".
+
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        An Access Key ID generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+    account_id:
+      label: Account ID
+      type: string
+      help: |
+        Your account ID as available in the [CloudFlare dashboard](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/).
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The name of a bucket you've created to store your Galaxy data. Documentation for how to create buckets
+        can be found in [this part of the CloudFlare R2 documentation](https://developers.cloudflare.com/r2/buckets/create-buckets/).
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        A Secret Access Key generated according to the
+        [CloudFlare R2 access tokens documentation](https://developers.cloudflare.com/r2/api/s3/tokens/).
+
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: '{{ variables.account_id}}.r2.cloudflarestorage.com'
+      port: 443
+      is_secure: true
diff --git a/lib/galaxy/objectstore/templates/examples/minio_example.yml b/lib/galaxy/objectstore/templates/examples/minio_example.yml
new file mode 100644
index 000000000000..2694b4f8ed3b
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/minio_example.yml
@@ -0,0 +1,47 @@
+- id: minio
+  name: Institutional S3 Storage
+  description: Connect to our institutional MinIO storage service.
+  variables:
+    access_key:
+      type: string
+      help: A description of the user account used to connect to your storage.
+    bucket:
+      type: string
+      help: The bucket to connect to.
+  secrets:
+    secret_key:
+      help: The secret key used to connect to MinIO with for the given access key.
+  environment:
+    host:
+      type: variable
+      variable: GALAXY_MINIO_HOST
+      default: localhost
+    port:
+      type: variable
+      variable: GALAXY_MINIO_PORT
+      default: "9000"
+    secure:
+      type: variable
+      variable: GALAXY_MINIO_IS_SECURE
+      default: "true"
+    connection_path:
+      type: variable
+      variable: GALAXY_MINIO_CONNECTION_PATH
+      default: ""
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+      use_reduced_redundancy: false
+    connection:
+      host: '{{ environment.host }}'
+      port: '{{ environment.port | int  }}'
+      is_secure: '{{ environment.secure | asbool }}'
+      conn_path: '{{ environment.connection_path }}'
+    badges:
+    - type: slower
+    - type: less_secure
+    - type: less_stable
diff --git a/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml b/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
new file mode 100644
index 000000000000..0586e1662d0c
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/minio_just_buckets.yml
@@ -0,0 +1,22 @@
+- id: lab_minio_storage
+  name: Lab Storage
+  description: Connect to our lab's local MinIO storage service.
+  variables:
+    bucket:
+      type: string
+      help: The bucket to connect to.
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: 'XXXXXXXXfillinaccess'
+      secret_key: 'YYYYYYYYfillinsecret'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: 'storage.ourawesomelab.org'
+      port: 9000
+      is_secure: true
+    badges:
+    - type: slower
+    - type: less_secure
+    - type: less_stable
diff --git a/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml b/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
new file mode 100644
index 000000000000..f7afbe7ed52a
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_azure_blob.yml
@@ -0,0 +1,34 @@
+- id: azure
+  version: 0
+  name: Azure Blob Storage
+  description: |
+    This template allows storing dataset in [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction).
+  configuration:
+    type: azure_blob
+    auth:
+      account_name: '{{ variables.account_name }}'
+      account_key: '{{ secrets.account_key}}'
+
+    container:
+      name: '{{ variables.container_name }}'
+
+  variables:
+    container_name:
+      label: Container Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage container. More information on containers can be found
+        in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction#containers).
+    account_name:
+      label: Storage Account Name
+      type: string
+      help: |
+        The name of your Azure Blob Storage account. More information on containers can be found in the
+        [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview).
+
+  secrets:
+    account_key:
+      label: Account Key
+      help: |
+        The Azure Blob Storage account key to use to access your Azure Blob Storage data. More information
+        on account keys can be found in the [Azure Storage documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage).
diff --git a/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml b/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
new file mode 100644
index 000000000000..30a55d846bc8
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/production_generic_s3.yml
@@ -0,0 +1,98 @@
+- id: generic_s3
+  name: Any S3 Compatible Storage
+  description: |
+    The APIs used to connect to Amazon's S3 (Simple Storage Service) have become something
+    of an unofficial standard for cloud storage across a variety of vendors and services.
+    Many vendors offer storage APIs compatible with S3 - Galaxy calls these ``generic_s3``
+    storage locations. This template configuration allows using such service as a Galaxy storage
+    location as long as you are able to find the connection details and have the relevant credentials.
+
+    Given the amount of information needed to connect to such a service, this is a bit of an
+    advanced template and probably should not be used to connect to a service if a more
+    specific template is available.
+  variables:
+    access_key:
+      label: Access Key ID
+      type: string
+      help: |
+        The less secure part of your access tokens or access keys that describe the user
+        that is accessing the data. The [Amazon documentation] calls these an "access key ID",
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_access_key_id``. Internally to Galaxy, we often just call
+        this the ``access_key``.
+
+    bucket:
+      label: Bucket
+      type: string
+      help: |
+        The [bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html) to
+        store your datasets in. How to setup buckets for your storage will vary from service to service
+        but all S3 compatible storage services should have the concept of a bucket to namespace
+        a grouping of your data together with.
+    host:
+      label: Connection Host
+      type: string
+      help: |
+        The [hostname](https://en.wikipedia.org/wiki/Hostname) used to connect to the target
+        S3 compatible service.
+        
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. For instance, the CloudFlare documentation
+        describes its endpoints as ``https://<accountid>.r2.cloudflarestorage.com``. Here
+        you would substitute your CloudFlare account ID into the endpoint and shave off the ``https://``,
+        so if your account ID was ``galactian``, you would enter ``galactian.r2.cloudflarestorage.com``.
+
+    port:
+      label: Connection Port
+      type: integer
+      default: 443
+      help: |
+        The [port](https://en.wikipedia.org/wiki/Port_(computer_networking)) used to connect
+        to the target S3 compatible service. This might be ``443`` if you cannot find a relevant
+        port - this is the default for secure HTTP connections.
+
+        If the documentation for your storage service has something called an ``endpoint_url``,
+        this can be used to determine this value. The [MinIO](https://min.io/docs/minio/linux/integrations/aws-cli-with-minio.html)
+        documentation describes the endpoint URL for its Play service as ``https://play.min.io:9000``.
+        The ``:9000`` here indicates this port should be specified as ``9000``. Alternatively, the
+        CloudFlare documentation describes its endpoints ``https://<accountid>.r2.cloudflarestorage.com``.
+        Here there is no number at the end of the URL so the port is ``443`` as long the URL starts
+        with ``https``.
+    connection_path:
+      label: Connection Path
+      type: string
+      default: ""
+      help: |
+        This is an advanced configuration option and it is very likely best to just keep this empty
+        for most storage services. If specified, it will be the prefix in the URL for the S3 compatible
+        API after the host and port to reach the target API.
+    secure:
+      label: Use HTTPS?
+      type: boolean
+      default: true
+      help: |
+        This is an advanced configuration option and if this option is not checked, you should not assume
+        your data is secure at all. This should only ever be unchecked during testing new or experimental
+        services with data and keys you do not care about.
+  secrets:
+    secret_key:
+      label: Secret Access Key
+      help: |
+        The secret key used to connect to the S3 compatible storage with for the given access key.
+
+        The [Amazon documentation] calls these an "secret access key" and
+        the [CloudFlare documentation](https://developers.cloudflare.com/r2/examples/aws/boto3/)
+        describes these as ``aws_secret_access_key``. Internally to Galaxy, we often just call
+        this the ``secret_key``.
+  configuration:
+    type: generic_s3
+    auth:
+      access_key: '{{ variables.access_key }}'
+      secret_key: '{{ secrets.secret_key }}'
+    bucket:
+      name: '{{ variables.bucket }}'
+    connection:
+      host: '{{ variables.host }}'
+      port: '{{ variable.port  }}'
+      is_secure: '{{ variables.secure }}'
+      conn_path: '{{ variables.connection_path }}'
diff --git a/lib/galaxy/objectstore/templates/examples/simple_example.yml b/lib/galaxy/objectstore/templates/examples/simple_example.yml
new file mode 100644
index 000000000000..6f627c8cf46d
--- /dev/null
+++ b/lib/galaxy/objectstore/templates/examples/simple_example.yml
@@ -0,0 +1,15 @@
+- id: project_scratch
+  name: Project Scratch
+  version: 0
+  description: Folder on institutional scratch disk area bound to your user.
+  variables:
+    project_name:
+      type: path_component
+      help: The name of your project scratch.
+  configuration:
+    type: disk
+    files_dir: '/scratch/for_galaxy/{{ user.username | ensure_path_component }}/{{ variables.project_name | ensure_path_component }}'
+    badges:
+    - type: faster
+    - type: less_secure
+    - type: not_backed_up
diff --git a/lib/galaxy/objectstore/templates/manager.py b/lib/galaxy/objectstore/templates/manager.py
index 901931b956c2..bb5be1c722cc 100644
--- a/lib/galaxy/objectstore/templates/manager.py
+++ b/lib/galaxy/objectstore/templates/manager.py
@@ -1,7 +1,5 @@
 import os
 from typing import (
-    Any,
-    Dict,
     List,
     Optional,
 )
@@ -9,35 +7,29 @@
 from typing_extensions import Protocol
 from yaml import safe_load
 
-from galaxy.exceptions import (
-    ObjectNotFound,
-    RequestParameterMissingException,
-)
 from galaxy.objectstore.badges import serialize_badges
+from galaxy.util.config_templates import (
+    apply_syntactic_sugar,
+    find_template,
+    find_template_by,
+    InstanceDefinition,
+    RawTemplateConfig,
+    TemplateReference,
+    validate_secrets_and_variables,
+    verify_vault_configured_if_uses_secrets,
+)
 from .models import (
     ObjectStoreTemplate,
     ObjectStoreTemplateCatalog,
     ObjectStoreTemplateSummaries,
 )
 
-RawTemplateConfig = Dict[str, Any]
-
 
 class AppConfigProtocol(Protocol):
     object_store_templates: Optional[List[RawTemplateConfig]]
     object_store_templates_config_file: Optional[str]
 
 
-class TemplateReference(Protocol):
-    template_id: str
-    template_version: int
-
-
-class InstanceDefinition(TemplateReference, Protocol):
-    variables: Dict[str, Any]
-    secrets: Dict[str, str]
-
-
 SECRETS_NEED_VAULT_MESSAGE = "The object store templates configuration can not be used - a Galaxy vault must be configured for templates that use secrets - please set the vault_config_file configuration option to point at a valid vault configuration."
 
 
@@ -57,19 +49,15 @@ def from_app_config(config: AppConfigProtocol, vault_configured=None) -> "Config
                     raw_config = safe_load(f)
         if raw_config is None:
             raw_config = []
-        templates = ConfiguredObjectStoreTemplates(raw_config_to_catalog(raw_config))
-        if vault_configured is False and templates.configuration_uses_secrets:
-            raise Exception(SECRETS_NEED_VAULT_MESSAGE)
+        catalog = raw_config_to_catalog(raw_config)
+        verify_vault_configured_if_uses_secrets(
+            catalog,
+            vault_configured,
+            SECRETS_NEED_VAULT_MESSAGE,
+        )
+        templates = ConfiguredObjectStoreTemplates(catalog)
         return templates
 
-    @property
-    def configuration_uses_secrets(self) -> bool:
-        templates = self.catalog.root
-        for template in templates:
-            if template.secrets and len(template.secrets) > 0:
-                return True
-        return False
-
     @property
     def summaries(self) -> ObjectStoreTemplateSummaries:
         templates = self.catalog.root
@@ -77,6 +65,7 @@ def summaries(self) -> ObjectStoreTemplateSummaries:
         for template in templates:
             template_dict = template.model_dump()
             configuration = template_dict.pop("configuration")
+            template_dict.pop("environment")
             stored_badges = configuration["badges"] or []
             object_store_type = configuration["type"]
             badges = serialize_badges(stored_badges, False, True, True, object_store_type in ["azure", "s3"])
@@ -87,55 +76,16 @@ def summaries(self) -> ObjectStoreTemplateSummaries:
 
     def find_template(self, instance_reference: TemplateReference) -> ObjectStoreTemplate:
         """Find the corresponding template and throw ObjectNotFound if not available."""
-        template_id = instance_reference.template_id
-        template_version = instance_reference.template_version
-        return self.find_template_by(template_id, template_version)
+        return find_template(self.catalog.root, instance_reference, "object store")
 
     def find_template_by(self, template_id: str, template_version: int) -> ObjectStoreTemplate:
-        templates = self.catalog.root
-
-        for template in templates:
-            if template.id == template_id and template.version == template_version:
-                return template
-
-        raise ObjectNotFound(
-            f"Could not find a object store template with id {template_id} and version {template_version}"
-        )
+        return find_template_by(self.catalog.root, template_id, template_version, "object store")
 
     def validate(self, instance: InstanceDefinition):
         template = self.find_template(instance)
-        secrets = instance.secrets
-        for template_secret in template.secrets or []:
-            name = template_secret.name
-            if name not in secrets:
-                raise RequestParameterMissingException(f"Must define secret '{name}'")
-        variables = instance.variables
-        for template_variable in template.variables or []:
-            name = template_variable.name
-            if name not in variables:
-                raise RequestParameterMissingException(f"Must define variable '{name}'")
-        # TODO: validate no extra variables
+        validate_secrets_and_variables(instance, template)
 
 
 def raw_config_to_catalog(raw_config: List[RawTemplateConfig]) -> ObjectStoreTemplateCatalog:
-    effective_root = _apply_syntactic_sugar(raw_config)
+    effective_root = apply_syntactic_sugar(raw_config)
     return ObjectStoreTemplateCatalog.model_validate(effective_root)
-
-
-def _apply_syntactic_sugar(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
-    templates = []
-    for template in raw_templates:
-        _force_key_to_list(template, "variables")
-        _force_key_to_list(template, "secrets")
-        templates.append(template)
-    return templates
-
-
-def _force_key_to_list(template: RawTemplateConfig, key: str) -> None:
-    value = template.get(key, None)
-    if isinstance(value, dict):
-        value_as_list = []
-        for key_name, key_value in value.items():
-            key_value["name"] = key_name
-            value_as_list.append(key_value)
-        template[key] = value_as_list
diff --git a/lib/galaxy/objectstore/templates/models.py b/lib/galaxy/objectstore/templates/models.py
index 9f225786194a..252641c33b64 100644
--- a/lib/galaxy/objectstore/templates/models.py
+++ b/lib/galaxy/objectstore/templates/models.py
@@ -7,29 +7,32 @@
     Union,
 )
 
-from boltons.iterutils import remap
-from jinja2.nativetypes import NativeEnvironment
-from pydantic import (
-    BaseModel,
-    ConfigDict,
-    RootModel,
-)
+from pydantic import RootModel
 from typing_extensions import Literal
 
 from galaxy.objectstore.badges import (
     BadgeDict,
     StoredBadgeDict,
 )
+from galaxy.util.config_templates import (
+    EnvironmentDict,
+    expand_raw_config,
+    MarkdownContent,
+    populate_default_variables,
+    SecretsDict,
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateExpansion,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableType,
+    TemplateVariableValueType,
+    UserDetailsDict,
+)
 
-
-class StrictModel(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-
-ObjectStoreTemplateVariableType = Literal["string", "boolean", "integer"]
-ObjectStoreTemplateVariableValueType = Union[str, bool, int]
-TemplateExpansion = str
-ObjectStoreTemplateType = Literal["s3", "azure_blob", "disk", "generic_s3"]
+ObjectStoreTemplateVariableType = TemplateVariableType
+ObjectStoreTemplateVariableValueType = TemplateVariableValueType
+ObjectStoreTemplateType = Literal["aws_s3", "azure_blob", "disk", "generic_s3"]
 
 
 class S3AuthTemplate(StrictModel):
@@ -55,15 +58,17 @@ class S3Bucket(StrictModel):
 BadgeList = Optional[List[StoredBadgeDict]]
 
 
-class S3ObjectStoreTemplateConfiguration(StrictModel):
-    type: Literal["s3"]
+class AwsS3ObjectStoreTemplateConfiguration(StrictModel):
+    type: Literal["aws_s3"]
     auth: S3AuthTemplate
     bucket: S3BucketTemplate
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
-class S3ObjectStoreConfiguration(StrictModel):
-    type: Literal["s3"]
+class AwsS3ObjectStoreConfiguration(StrictModel):
+    type: Literal["aws_s3"]
     auth: S3Auth
     bucket: S3Bucket
     badges: BadgeList = None
@@ -92,6 +97,8 @@ class AzureObjectStoreTemplateConfiguration(StrictModel):
     auth: AzureAuthTemplate
     container: AzureContainerTemplate
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
 class AzureObjectStoreConfiguration(StrictModel):
@@ -105,6 +112,8 @@ class DiskObjectStoreTemplateConfiguration(StrictModel):
     type: Literal["disk"]
     files_dir: Union[str, TemplateExpansion]
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
 class DiskObjectStoreConfiguration(StrictModel):
@@ -133,6 +142,8 @@ class GenericS3ObjectStoreTemplateConfiguration(StrictModel):
     bucket: S3BucketTemplate
     connection: S3ConnectionTemplate
     badges: BadgeList = None
+    template_start: Optional[str] = None
+    template_end: Optional[str] = None
 
 
 class GenericS3ObjectStoreConfiguration(StrictModel):
@@ -144,29 +155,21 @@ class GenericS3ObjectStoreConfiguration(StrictModel):
 
 
 ObjectStoreTemplateConfiguration = Union[
-    S3ObjectStoreTemplateConfiguration,
+    AwsS3ObjectStoreTemplateConfiguration,
     GenericS3ObjectStoreTemplateConfiguration,
     DiskObjectStoreTemplateConfiguration,
     AzureObjectStoreTemplateConfiguration,
 ]
 ObjectStoreConfiguration = Union[
-    S3ObjectStoreConfiguration,
+    AwsS3ObjectStoreConfiguration,
     DiskObjectStoreConfiguration,
     AzureObjectStoreConfiguration,
     GenericS3ObjectStoreConfiguration,
 ]
-MarkdownContent = str
 
 
-class ObjectStoreTemplateVariable(StrictModel):
-    name: str
-    help: Optional[MarkdownContent]
-    type: ObjectStoreTemplateVariableType
-
-
-class ObjectStoreTemplateSecret(StrictModel):
-    name: str
-    help: Optional[MarkdownContent]
+ObjectStoreTemplateVariable = TemplateVariable
+ObjectStoreTemplateSecret = TemplateSecret
 
 
 class ObjectStoreTemplateBase(StrictModel):
@@ -188,8 +191,8 @@ class ObjectStoreTemplateBase(StrictModel):
     # template by hiding but keep it in the catalog for backward
     # compatibility for users with existing stores of that template.
     hidden: bool = False
-    variables: Optional[List[ObjectStoreTemplateVariable]] = None
-    secrets: Optional[List[ObjectStoreTemplateSecret]] = None
+    variables: Optional[List[TemplateVariable]] = None
+    secrets: Optional[List[TemplateSecret]] = None
 
 
 class ObjectStoreTemplateSummary(ObjectStoreTemplateBase):
@@ -199,6 +202,7 @@ class ObjectStoreTemplateSummary(ObjectStoreTemplateBase):
 
 class ObjectStoreTemplate(ObjectStoreTemplateBase):
     configuration: ObjectStoreTemplateConfiguration
+    environment: Optional[List[TemplateEnvironmentEntry]] = None
 
 
 ObjectStoreTemplateCatalog = RootModel[List[ObjectStoreTemplate]]
@@ -211,29 +215,18 @@ class ObjectStoreTemplateSummaries(RootModel):
 def template_to_configuration(
     template: ObjectStoreTemplate,
     variables: Dict[str, ObjectStoreTemplateVariableValueType],
-    secrets: Dict[str, str],
-    user_details: Dict[str, Any],
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
 ) -> ObjectStoreConfiguration:
     configuration_template = template.configuration
-    template_variables = {
-        "variables": variables,
-        "secrets": secrets,
-        "user": user_details,
-    }
-
-    def expand_template(_, key, value):
-        if isinstance(value, str) and "{{" in value and "}}" in value:
-            # NativeEnvironment preserves Python types
-            template = NativeEnvironment().from_string(value)
-            return key, template.render(**template_variables)
-        return key, value
-
-    raw_config = remap(configuration_template.model_dump(), visit=expand_template)
+    populate_default_variables(template.variables, variables)
+    raw_config = expand_raw_config(configuration_template, variables, secrets, user_details, environment)
     return to_configuration_object(raw_config)
 
 
 TypesToConfigurationClasses: Dict[ObjectStoreTemplateType, Type[ObjectStoreConfiguration]] = {
-    "s3": S3ObjectStoreConfiguration,
+    "aws_s3": AwsS3ObjectStoreConfiguration,
     "generic_s3": GenericS3ObjectStoreConfiguration,
     "azure_blob": AzureObjectStoreConfiguration,
     "disk": DiskObjectStoreConfiguration,
diff --git a/lib/galaxy/schema/__init__.py b/lib/galaxy/schema/__init__.py
index c83d22f4770c..9228622c8aca 100644
--- a/lib/galaxy/schema/__init__.py
+++ b/lib/galaxy/schema/__init__.py
@@ -25,6 +25,7 @@
 class BootstrapAdminUser(BaseModel):
     id: int = 0
     email: Optional[str] = None
+    username: Optional[str] = None
     preferences: Dict[str, str] = {}
     bootstrap_admin_user: bool = True
 
diff --git a/lib/galaxy/selenium/navigates_galaxy.py b/lib/galaxy/selenium/navigates_galaxy.py
index 3c24b10fd205..5315344a708e 100644
--- a/lib/galaxy/selenium/navigates_galaxy.py
+++ b/lib/galaxy/selenium/navigates_galaxy.py
@@ -9,6 +9,10 @@
 import string
 import time
 from abc import abstractmethod
+from dataclasses import (
+    dataclass,
+    field,
+)
 from functools import (
     partial,
     wraps,
@@ -18,6 +22,7 @@
     cast,
     Dict,
     List,
+    Literal,
     NamedTuple,
     Optional,
     Tuple,
@@ -178,6 +183,29 @@ def func_wrapper(self, *args, **kwds):
     return func_wrapper
 
 
+@dataclass
+class ConfigTemplateParameter:
+    form_element_type: Literal["string", "boolean"]
+    name: str
+    value: Any
+
+
+@dataclass
+class FileSourceInstance:
+    template_id: str
+    name: str
+    description: Optional[str]
+    parameters: List[ConfigTemplateParameter] = field(default_factory=list)
+
+
+@dataclass
+class ObjectStoreInstance:
+    template_id: str
+    name: str
+    description: Optional[str]
+    parameters: List[ConfigTemplateParameter] = field(default_factory=list)
+
+
 class NavigatesGalaxy(HasDriver):
     """Class with helpers methods for driving components of the Galaxy interface.
 
@@ -985,6 +1013,26 @@ def upload_paste_data(self, pasted_content, tab_id="regular"):
         textarea = self.wait_for_selector(f"{tab_locator} .upload-row:last-of-type .upload-text-content")
         textarea.send_keys(pasted_content)
 
+    def upload_uri(self, uri, wait=False):
+        upload = self.components.upload
+        upload.start.wait_for_and_click()
+        upload.file_dialog.wait_for_and_click()
+        scheme, uri_rest = uri.split("://", 1)
+        parts = uri_rest.split("/")
+
+        root = f"{scheme}://{parts[0]}"
+        upload.file_source_selector(path=root).wait_for_and_click()
+        rest_parts = parts[1:]
+        path = root
+        for part in rest_parts:
+            path = f"{path}/{part}"
+            upload.file_source_selector(path=path).wait_for_and_click()
+        upload.file_dialog_ok.wait_for_and_click()
+        self.upload_start()
+        if wait:
+            self.sleep_for(self.wait_types.UX_RENDER)
+            self.wait_for_history()
+
     def upload_rule_start(self):
         self.upload_start_click()
         self.upload_tab_click("rule-based")
@@ -2301,6 +2349,80 @@ def share_with_user(
             self.wait_for_xpath_visible(xpath)
         self.screenshot_if(screenshot_after_submit)
 
+    def create_file_source_template(self, instance: FileSourceInstance) -> str:
+        self.navigate_to_user_preferences()
+        template_id = instance.template_id
+        preferences = self.components.preferences
+        preferences.manage_file_sources.wait_for_and_click()
+        file_source_instances = self.components.file_source_instances
+        file_source_instances.index.create_button.wait_for_and_click()
+
+        select_ftp = file_source_instances.create.select(template_id=template_id)
+        select_ftp.wait_for_present()
+        self.screenshot(f"user_file_source_select_{template_id}")
+        select_ftp.wait_for_and_click()
+
+        file_source_instances.create._.wait_for_present()
+        self.screenshot(f"user_file_source_form_empty_{template_id}")
+        self.components.tool_form.parameter_input(parameter="_meta_name").wait_for_and_send_keys(
+            instance.name,
+        )
+        if instance.description:
+            self.components.tool_form.parameter_input(parameter="_meta_description").wait_for_and_send_keys(
+                instance.description,
+            )
+        for parameter in instance.parameters:
+            assert parameter.form_element_type == "string"
+            self.components.tool_form.parameter_input(parameter=parameter.name).wait_for_and_send_keys(
+                str(parameter.value),
+            )
+        self.screenshot(f"user_file_source_form_full_{template_id}")
+        file_source_instances.create.submit.wait_for_and_click()
+
+        file_source_instances = self.components.file_source_instances
+        file_source_instances.index._.wait_for_present()
+        self.screenshot(f"user_file_source_created_{template_id}")
+        instances = self.api_get("file_source_instances")
+        newest_instance = instances[-1]
+        uri_root = newest_instance["uri_root"]
+        return uri_root
+
+    def create_object_store_template(self, instance: ObjectStoreInstance) -> str:
+        self.navigate_to_user_preferences()
+        template_id = instance.template_id
+        preferences = self.components.preferences
+        preferences.manage_object_stores.wait_for_and_click()
+        object_store_instances = self.components.object_store_instances
+        object_store_instances.index.create_button.wait_for_and_click()
+
+        select_ftp = object_store_instances.create.select(template_id=template_id)
+        select_ftp.wait_for_present()
+        self.screenshot(f"user_object_store_select_{template_id}")
+        select_ftp.wait_for_and_click()
+
+        object_store_instances.create._.wait_for_present()
+        self.screenshot(f"user_object_store_form_empty_{template_id}")
+        self.components.tool_form.parameter_input(parameter="_meta_name").wait_for_and_send_keys(
+            instance.name,
+        )
+        if instance.description:
+            self.components.tool_form.parameter_input(parameter="_meta_description").wait_for_and_send_keys(
+                instance.description,
+            )
+        for parameter in instance.parameters:
+            assert parameter.form_element_type == "string"
+            self.components.tool_form.parameter_input(parameter=parameter.name).wait_for_and_send_keys(
+                str(parameter.value),
+            )
+        self.screenshot(f"user_object_store_form_full_{template_id}")
+        object_store_instances.create.submit.wait_for_and_click()
+        object_store_instances.index._.wait_for_present()
+        self.screenshot(f"user_object_store_created_{template_id}")
+        instances = self.api_get("object_store_instances")
+        newest_instance = instances[-1]
+        object_store_id = newest_instance["object_store_id"]
+        return object_store_id
+
     def tutorial_mode_activate(self):
         search_selector = "#gtn a"
         self.wait_for_and_click_selector(search_selector)
diff --git a/lib/galaxy/util/config_templates.py b/lib/galaxy/util/config_templates.py
new file mode 100644
index 000000000000..417f9294e14e
--- /dev/null
+++ b/lib/galaxy/util/config_templates.py
@@ -0,0 +1,362 @@
+"""Utilities for defining user configuration bits from admin templates.
+
+This is capturing code shared by file source templates and object store templates.
+"""
+
+import os
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+    Type,
+    TypeVar,
+    Union,
+)
+
+import yaml
+from boltons.iterutils import remap
+from pydantic import (
+    BaseModel,
+    ConfigDict,
+    RootModel,
+)
+from typing_extensions import (
+    Literal,
+    Protocol,
+)
+
+try:
+    from jinja2.nativetypes import NativeEnvironment
+except ImportError:
+    NativeEnvironment = None  # type:ignore[assignment, misc, unused-ignore]
+
+from galaxy.exceptions import (
+    ObjectNotFound,
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.util import asbool
+
+TemplateVariableType = Literal["string", "path_component", "boolean", "integer"]
+TemplateVariableValueType = Union[str, bool, int]
+TemplateExpansion = str
+MarkdownContent = str
+RawTemplateConfig = Dict[str, Any]
+UserDetailsDict = Dict[str, Any]
+VariablesDict = Dict[str, TemplateVariableValueType]
+SecretsDict = Dict[str, str]
+EnvironmentDict = Dict[str, str]
+
+
+class StrictModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class BaseTemplateVariable(StrictModel):
+    name: str
+    label: Optional[str] = None
+    help: Optional[MarkdownContent]
+
+
+class TemplateVariableString(BaseTemplateVariable):
+    type: Literal["string"]
+    default: str = ""
+    # add non-empty validation?
+
+
+class TemplateVariableInteger(BaseTemplateVariable):
+    type: Literal["integer"]
+    default: int = 0
+    # add min/max
+
+
+class TemplateVariablePathComponent(BaseTemplateVariable):
+    type: Literal["path_component"]
+    default: Optional[str] = None
+
+
+class TemplateVariableBoolean(BaseTemplateVariable):
+    type: Literal["boolean"]
+    default: bool = False
+
+
+TemplateVariable = Union[
+    TemplateVariableString, TemplateVariableInteger, TemplateVariablePathComponent, TemplateVariableBoolean
+]
+
+
+class TemplateSecret(StrictModel):
+    name: str
+    label: Optional[str] = None
+    help: Optional[MarkdownContent]
+
+
+class TemplateEnvironmentSecret(StrictModel):
+    type: Literal["secret"]
+    name: str
+    vault_key: str
+    default: Optional[str] = None
+
+
+class TemplateEnvironmentVariable(StrictModel):
+    type: Literal["variable"]
+    name: str
+    variable: str
+    default: Optional[str] = None
+
+
+TemplateEnvironmentEntry = Union[TemplateEnvironmentVariable, TemplateEnvironmentSecret]
+TemplateEnvironment = RootModel[List[TemplateEnvironmentEntry]]
+
+
+def _ensure_path_component(input: Any):
+    input_as_string = str(input)
+    if not acts_as_simple_path_component(input_as_string):
+        raise Exception("Path manipulation detected, failing evaluation")
+    return input
+
+
+# NativeEnvironment preserves Python types
+def _environment(template_start: str, template_end: str) -> NativeEnvironment:
+    env = NativeEnvironment(
+        variable_start_string=template_start,
+        variable_end_string=template_end,
+    )
+    env.filters["ensure_path_component"] = _ensure_path_component
+    env.filters["asbool"] = asbool
+    return env
+
+
+class TemplateConfiguration(Protocol):
+
+    def model_dump(self) -> Dict[str, Any]:
+        """Implements a pydantic model dump to build simple JSON dictionary."""
+
+    @property
+    def template_start(self) -> Optional[str]:
+        """Set a custom variable start for Jinja variable substitution.
+
+        https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+        """
+
+    @property
+    def template_end(self) -> Optional[str]:
+        """Set a custom variable end for Jinja variable substitution.
+
+        https://stackoverflow.com/questions/12083319/add-custom-tokens-in-jinja2-e-g-somevar
+        """
+
+
+def populate_default_variables(variables: Optional[List[TemplateVariable]], variable_values: VariablesDict):
+    if variables:
+        for variable in variables:
+            name = variable.name
+            if name not in variable_values and variable.default is not None:
+                variable_values[name] = variable.default
+
+
+def expand_raw_config(
+    template_configuration: TemplateConfiguration,
+    variables: VariablesDict,
+    secrets: SecretsDict,
+    user_details: UserDetailsDict,
+    environment: EnvironmentDict,
+) -> RawTemplateConfig:
+    template_variables = {
+        "variables": variables,
+        "secrets": secrets,
+        "user": user_details,
+        "environment": environment,
+    }
+
+    template_start = template_configuration.template_start or "{{"
+    template_end = template_configuration.template_end or "}}"
+
+    def expand_template(_, key, value):
+        if isinstance(value, str) and template_start in value and template_end in value:
+            template = _environment(template_start, template_end).from_string(value)
+            return key, template.render(**template_variables)
+        return key, value
+
+    template_model_as_json = template_configuration.model_dump()
+    raw_config = remap(template_model_as_json, visit=expand_template)
+    _clean_template_meta_parameters(raw_config)
+    return raw_config
+
+
+def verify_vault_configured_if_uses_secrets(catalog, vault_configured: bool, exception_message: str) -> None:
+    if _catalog_uses_secrets(catalog) and not vault_configured:
+        raise Exception(exception_message)
+
+
+def _catalog_uses_secrets(catalog) -> bool:
+    templates = catalog.root
+    for template in templates:
+        if template.secrets and len(template.secrets) > 0:
+            return True
+    return False
+
+
+def _clean_template_meta_parameters(config: RawTemplateConfig) -> RawTemplateConfig:
+    # slight templating differences between what is allowed in the template definition
+    # and what is allowed in the actual configuration objects we send to respective modules
+    # to instantiate plugins. In particular, descriptions of how templating is done should
+    # eliminated after templates have been expanded.
+    meta_parameters = ["template_start", "template_end"]
+    for meta_parameter in meta_parameters:
+        if meta_parameter in config:
+            del config[meta_parameter]
+    return config
+
+
+# cwl-like - convert simple dictionary to list of dictionaries for quickly
+# configuring variables and secrets
+def apply_syntactic_sugar(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
+    templates = []
+    expanded_raw_templates = _expand_includes(raw_templates)
+    for template in expanded_raw_templates:
+        _force_key_to_list(template, "variables")
+        _force_key_to_list(template, "secrets")
+        _force_key_to_list(template, "environment")
+        templates.append(template)
+    return templates
+
+
+def _expand_includes(raw_templates: List[RawTemplateConfig]) -> List[RawTemplateConfig]:
+    expanded_raw_templates = []
+    for raw_template in raw_templates:
+        expanded_raw_templates.extend(_expand_include(raw_template))
+    return expanded_raw_templates
+
+
+def _expand_include(raw_template: RawTemplateConfig) -> List[RawTemplateConfig]:
+    has_one_key = len(raw_template.keys()) == 1
+    has_include = "include" in raw_template
+
+    if has_one_key and has_include:
+        include = raw_template["include"]
+        with open(include) as f:
+            included = yaml.safe_load(f)
+            raw_templates: List[RawTemplateConfig]
+            if isinstance(included, list):
+                raw_templates = included
+            else:
+                raw_templates = [included]
+            return _expand_includes(raw_templates)
+    else:
+        return [raw_template]
+
+
+def _force_key_to_list(template: RawTemplateConfig, key: str) -> None:
+    value = template.get(key, None)
+    if isinstance(value, dict):
+        value_as_list = []
+        for key_name, key_value in value.items():
+            key_value["name"] = key_name
+            value_as_list.append(key_value)
+        template[key] = value_as_list
+
+
+class TemplateReference(Protocol):
+    template_id: str
+    template_version: int
+
+
+class InstanceDefinition(TemplateReference, Protocol):
+    variables: Dict[str, Any]
+    secrets: SecretsDict
+
+
+class Template(Protocol):
+    @property
+    def id(self) -> str: ...
+
+    @property
+    def version(self) -> int: ...
+
+    @property
+    def variables(self) -> Optional[List[TemplateVariable]]: ...
+
+    @property
+    def secrets(self) -> Optional[List[TemplateSecret]]: ...
+
+    @property
+    def environment(self) -> Optional[List[TemplateEnvironmentEntry]]: ...
+
+
+T = TypeVar("T", bound=Template, covariant=True)
+
+
+def find_template(templates: List[T], instance_reference: TemplateReference, what: str) -> T:
+    template_id = instance_reference.template_id
+    template_version = instance_reference.template_version
+    return find_template_by(templates, template_id, template_version, what)
+
+
+def find_template_by(templates: List[T], template_id: str, template_version: int, what: str) -> T:
+    for template in templates:
+        if template.id == template_id and template.version == template_version:
+            return template
+
+    raise ObjectNotFound(f"Could not find a {what} template with id {template_id} and version {template_version}")
+
+
+def validate_secrets_and_variables(instance: InstanceDefinition, template: Template) -> None:
+    secrets = instance.secrets
+    for template_secret in template.secrets or []:
+        name = template_secret.name
+        if name not in secrets:
+            raise RequestParameterMissingException(f"Must define secret '{name}'")
+        secret_value = secrets[name]
+        if not isinstance(secret_value, str):
+            raise RequestParameterInvalidException(f"Secret value for secret '{name}' must be of type str")
+    variables = instance.variables
+    for template_variable in template.variables or []:
+        name = template_variable.name
+        if name not in variables:
+            raise RequestParameterMissingException(f"Must define variable '{name}'")
+        variable_value = variables[name]
+        template_type = template_variable.type
+        if template_type in ["string", "path_component"]:
+            if not isinstance(variable_value, str):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type str")
+            if template_type == "path_component":
+                if ".." in variable_value or "/" in variable_value:
+                    raise RequestParameterInvalidException(
+                        f"Variable value for variable '{name}' must be simple path component, invalid characters found"
+                    )
+                if not acts_as_simple_path_component(variable_value):
+                    raise RequestParameterInvalidException(
+                        f"Variable value for variable '{name}' must be simple path component, invalid characters found"
+                    )
+        if template_type == "integer":
+            if not _is_of_exact_type(variable_value, int):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type int")
+        if template_type == "boolean":
+            if not _is_of_exact_type(variable_value, bool):
+                raise RequestParameterInvalidException(f"Variable value for variable '{name}' must be of type bool")
+
+
+def _is_of_exact_type(object: Any, target_type: Type):
+    # isinstance(False, int) and False == 0 are both True in Python...
+    # We are creating a DSL here that is intentionally more strict than Python
+    # so we are using type() instead of isinstance and we have the test coverage
+    # to ensure this is the desired behavior and remains. Think JSON typing, not
+    # pythonic typing. Galaxy's internals as a Python project should not be
+    # exposed here.
+    return type(object) == target_type  # noqa: E721
+
+
+def acts_as_simple_path_component(value: str):
+    cwd = os.getcwd()
+    abs_path = os.path.abspath(f"{cwd}/{value}")
+    unaffected_by_normpath = os.path.normpath(abs_path) == abs_path
+    if not unaffected_by_normpath:
+        return False
+    should_be_cwd, should_be_value = os.path.split(abs_path)
+    if should_be_cwd != cwd:
+        return False
+    if should_be_value != value:
+        return False
+    return True
diff --git a/lib/galaxy/webapps/galaxy/api/file_sources.py b/lib/galaxy/webapps/galaxy/api/file_sources.py
new file mode 100644
index 000000000000..9e14f9209ea0
--- /dev/null
+++ b/lib/galaxy/webapps/galaxy/api/file_sources.py
@@ -0,0 +1,95 @@
+import logging
+from typing import List
+
+from fastapi import (
+    Body,
+    Path,
+)
+
+from galaxy.files.templates import FileSourceTemplateSummaries
+from galaxy.managers.context import ProvidesUserContext
+from galaxy.managers.file_source_instances import (
+    CreateInstancePayload,
+    FileSourceInstancesManager,
+    ModifyInstancePayload,
+    UserFileSourceModel,
+)
+from . import (
+    depends,
+    DependsOnTrans,
+    Router,
+)
+
+log = logging.getLogger(__name__)
+
+router = Router(tags=["file_sources"])
+
+
+UserFileSourceIdPathParam: str = Path(
+    ..., title="User File Source ID", description="The index for a persisted UserFileSourceStore object."
+)
+
+
+@router.cbv
+class FastAPIFileSources:
+    file_source_instances_manager: FileSourceInstancesManager = depends(FileSourceInstancesManager)
+
+    @router.get(
+        "/api/file_source_templates",
+        summary="Get a list of file source templates available to build user defined file sources from",
+        response_description="A list of the configured file source templates.",
+        operation_id="file_sources__templates_index",
+    )
+    def index_templates(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+    ) -> FileSourceTemplateSummaries:
+        return self.file_source_instances_manager.summaries
+
+    @router.post(
+        "/api/file_source_instances",
+        summary="Create a user-bound object store.",
+        operation_id="file_sources__create_instance",
+    )
+    def create(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        payload: CreateInstancePayload = Body(...),
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.create_instance(trans, payload)
+
+    @router.get(
+        "/api/file_source_instances",
+        summary="Get a list of persisted file source instances defined by the requesting user.",
+        operation_id="file_sources__instances_index",
+    )
+    def instance_index(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+    ) -> List[UserFileSourceModel]:
+        return self.file_source_instances_manager.index(trans)
+
+    @router.get(
+        "/api/file_source_instances/{user_file_source_id}",
+        summary="Get a list of persisted file source instances defined by the requesting user.",
+        operation_id="file_sources__instances_get",
+    )
+    def instances_show(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_file_source_id: str = UserFileSourceIdPathParam,
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.show(trans, user_file_source_id)
+
+    @router.put(
+        "/api/file_source_instances/{user_file_source_id}",
+        summary="Update or upgrade user file source instance.",
+        operation_id="file_sources__instances_update",
+    )
+    def update_instance(
+        self,
+        trans: ProvidesUserContext = DependsOnTrans,
+        user_file_source_id: str = UserFileSourceIdPathParam,
+        payload: ModifyInstancePayload = Body(...),
+    ) -> UserFileSourceModel:
+        return self.file_source_instances_manager.modify_instance(trans, user_file_source_id, payload)
diff --git a/lib/galaxy/webapps/galaxy/buildapp.py b/lib/galaxy/webapps/galaxy/buildapp.py
index 8adf5ad441af..dba1447b5238 100644
--- a/lib/galaxy/webapps/galaxy/buildapp.py
+++ b/lib/galaxy/webapps/galaxy/buildapp.py
@@ -227,6 +227,11 @@ def app_pair(global_conf, load_app_kwds=None, wsgi_preflight=True, **kwargs):
     webapp.add_client_route("/object_store_instances/{user_object_store_id}/edit")
     webapp.add_client_route("/object_store_instances/{user_object_store_id}/upgrade")
     webapp.add_client_route("/object_store_templates/{template_id}/new")
+    webapp.add_client_route("/file_source_instances/create")
+    webapp.add_client_route("/file_source_instances/index")
+    webapp.add_client_route("/file_source_instances/{user_file_source_id}/edit")
+    webapp.add_client_route("/file_source_instances/{user_file_source_id}/upgrade")
+    webapp.add_client_route("/file_source_templates/{template_id}/new")
     webapp.add_client_route("/welcome/new")
     webapp.add_client_route("/visualizations")
     webapp.add_client_route("/visualizations/edit")
diff --git a/lib/galaxy_test/base/populators.py b/lib/galaxy_test/base/populators.py
index e5eb2bad26bf..c1c2791933b0 100644
--- a/lib/galaxy_test/base/populators.py
+++ b/lib/galaxy_test/base/populators.py
@@ -507,6 +507,19 @@ def create_deferred_hda(self, history_id, uri: str, ext: Optional[str] = None) -
         details = self.get_history_dataset_details(history_id, dataset=output)
         return details
 
+    def export_dataset_to_remote_file(self, history_id: str, content: str, name: str, target_uri: str):
+        dataset = self.new_dataset(history_id, content=content, wait=True, name=name)
+        infile = {"src": "hda", "id": dataset["id"]}
+        inputs = {
+            "d_uri": target_uri,
+            "export_type|export_type_selector": "datasets_named",
+            "export_type|datasets_0|infile": infile,
+            "export_type|datasets_0|name": name,
+        }
+        response = self.run_tool("export_remote", inputs, history_id)
+        self.wait_for_job(response["jobs"][0]["id"], assert_ok=True)
+        return f"{target_uri}/{name}"
+
     def tag_dataset(self, history_id, hda_id, tags, raise_on_error=True):
         url = f"histories/{history_id}/contents/{hda_id}"
         response = self._put(url, {"tags": tags}, json=True)
diff --git a/lib/galaxy_test/driver/integration_util.py b/lib/galaxy_test/driver/integration_util.py
index 5189a7394f9a..19ceb4de9d5b 100644
--- a/lib/galaxy_test/driver/integration_util.py
+++ b/lib/galaxy_test/driver/integration_util.py
@@ -261,6 +261,19 @@ def _configure_object_store_template_catalog(cls, catalog, config):
         config["object_store_templates_config_file"] = template_config_path
 
 
+class ConfiguredFileSourceTemplates:
+    _test_driver: GalaxyTestDriver
+
+    @classmethod
+    def _configure_file_source_template_catalog(cls, catalog: str, config):
+        temp_directory = cls._test_driver.mkdtemp()
+        template_config_path = os.path.join(temp_directory, "file_source_templates.yml")
+        with open(template_config_path, "w") as f:
+            f.write(catalog)
+
+        config["file_source_templates_config_file"] = template_config_path
+
+
 class ConfiguresDatabaseVault:
     @classmethod
     def _configure_database_vault(cls, config):
diff --git a/packages/files/setup.cfg b/packages/files/setup.cfg
index f294659aa77f..dc0599c9b7c3 100644
--- a/packages/files/setup.cfg
+++ b/packages/files/setup.cfg
@@ -32,7 +32,7 @@ version = 23.2.dev0
 [options]
 include_package_data = True
 install_requires =
-    galaxy-util
+    galaxy-util[config_template]
     fs
     isal
     typing-extensions
diff --git a/packages/objectstore/setup.cfg b/packages/objectstore/setup.cfg
index 0b47a88eaa10..6ba5fe551e67 100644
--- a/packages/objectstore/setup.cfg
+++ b/packages/objectstore/setup.cfg
@@ -33,10 +33,9 @@ version = 23.2.dev0
 [options]
 include_package_data = True
 install_requires =
-    galaxy-util
+    galaxy-util[config_template]
     pydantic>=2,!=2.6.0,!=2.6.1
     PyYAML
-    Jinja2
 packages = find:
 python_requires = >=3.7
 
diff --git a/packages/test.sh b/packages/test.sh
index 0d1d1655d941..be98e038285e 100755
--- a/packages/test.sh
+++ b/packages/test.sh
@@ -49,7 +49,7 @@ while read -r package_dir || [ -n "$package_dir" ]; do  # https://stackoverflow.
 
     # Install extras (if needed)
     if [ "$package_dir" = "util" ]; then
-        pip install '.[template,jstree]'
+        pip install '.[template,jstree,config_template]'
     elif [ "$package_dir" = "tool_util" ]; then
         pip install '.[cwl,mulled,edam,extended-assertions]'
     else
diff --git a/packages/util/setup.cfg b/packages/util/setup.cfg
index 70add5d8311c..d0a614868fa5 100644
--- a/packages/util/setup.cfg
+++ b/packages/util/setup.cfg
@@ -53,6 +53,9 @@ jstree =
 template =
     Cheetah3
     future>=1.0.0
+config_template =
+    Jinja2
+    pydantic
 
 [options.packages.find]
 exclude =
diff --git a/test/integration_selenium/framework.py b/test/integration_selenium/framework.py
index 97a3cb8ef4e3..0bdc82838157 100644
--- a/test/integration_selenium/framework.py
+++ b/test/integration_selenium/framework.py
@@ -7,6 +7,7 @@
     from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
 
 selenium_test = framework.selenium_test
+managed_history = framework.managed_history
 
 
 class SeleniumIntegrationTestCase(
diff --git a/test/integration_selenium/test_objectstore_creation.py b/test/integration_selenium/test_objectstore_creation.py
new file mode 100644
index 000000000000..00c5aff65130
--- /dev/null
+++ b/test/integration_selenium/test_objectstore_creation.py
@@ -0,0 +1,80 @@
+from typing import TYPE_CHECKING
+
+from galaxy_test.driver.integration_util import (
+    ConfiguresDatabaseVault,
+    ConfiguresObjectStores,
+)
+from .framework import (
+    selenium_test,
+    SeleniumIntegrationTestCase,
+)
+from .test_objectstore_selection import MSI_EXAMPLE_OBJECT_STORE_CONFIG_TEMPLATE
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+MULTI_VERSION_WITH_SECRETS_LIBRARY = """
+- id: secure_disk
+  version: 0
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/aftersec'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 1
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec1:
+      help: This is my test secret.
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/{{ secrets.sec1 }}/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
+- id: secure_disk
+  version: 2
+  name: Secure Disk
+  description: Secure Disk Bound to You
+  secrets:
+    sec2:
+      help: This is my test secret 2.
+  configuration:
+    type: disk
+    files_dir: '/data/secure/{{ user.username }}/newbar/{{ secrets.sec2 }}'
+    badges:
+    - type: more_secure
+    - type: slower
+"""
+
+
+class TestObjectStoreSelectionSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguresObjectStores, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_object_store(MSI_EXAMPLE_OBJECT_STORE_CONFIG_TEMPLATE, config)
+        cls._configure_database_vault(config)
+        cls._configure_object_store_template_catalog(MULTI_VERSION_WITH_SECRETS_LIBRARY, config)
+
+    @selenium_test
+    def test_create_and_use(self):
+        self.navigate_to_user_preferences()
+        preferences = self.components.preferences
+        preferences.manage_object_stores.wait_for_and_click()
+        object_store_instances = self.components.object_store_instances
+        object_store_instances.index.create_button.wait_for_and_click()
diff --git a/test/integration_selenium/test_user_file_source_azure.py b/test/integration_selenium/test_user_file_source_azure.py
new file mode 100644
index 000000000000..0b77a8674767
--- /dev/null
+++ b/test/integration_selenium/test_user_file_source_azure.py
@@ -0,0 +1,64 @@
+import os
+from typing import TYPE_CHECKING
+
+from galaxy.files.templates.examples import get_example
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    FileSourceInstance,
+)
+from galaxy.util.unittest_utils import skip_unless_environ
+from galaxy_test.driver.integration_util import (
+    ConfiguredFileSourceTemplates,
+    ConfiguresDatabaseVault,
+)
+from .framework import (
+    managed_history,
+    selenium_test,
+    SeleniumIntegrationTestCase,
+)
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+PRODUCTION_AZURE_LIBRARY = get_example("production_azure.yml")
+
+
+class TestObjectStoreSelectionSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguredFileSourceTemplates, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_database_vault(config)
+        cls._configure_file_source_template_catalog(PRODUCTION_AZURE_LIBRARY, config)
+
+    @skip_unless_environ("GALAXY_TEST_AZURE_CONTAINER_NAME")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_KEY")
+    @skip_unless_environ("GALAXY_TEST_AZURE_ACCOUNT_NAME")
+    @managed_history
+    @selenium_test
+    def test_create_and_use(self):
+        history_id = self.current_history_id()
+        self.navigate_to_user_preferences()
+        random_name = self._get_random_name(prefix="azure source")
+        instance = FileSourceInstance(
+            template_id="azure",
+            name=random_name,
+            description="automated test for azure file source",
+            parameters=[
+                ConfigTemplateParameter("string", "container_name", os.environ["GALAXY_TEST_AZURE_CONTAINER_NAME"]),
+                ConfigTemplateParameter("string", "account_name", os.environ["GALAXY_TEST_AZURE_ACCOUNT_NAME"]),
+                ConfigTemplateParameter("string", "account_key", os.environ["GALAXY_TEST_AZURE_ACCOUNT_KEY"]),
+            ],
+        )
+        uri_root = self.create_file_source_template(instance)
+        published_uri = self.dataset_populator.export_dataset_to_remote_file(
+            history_id,
+            "my file contents",
+            "my_cool_file",
+            uri_root,
+        )
+        self.upload_uri(published_uri, wait=True)
diff --git a/test/integration_selenium/test_user_file_sources_ftp.py b/test/integration_selenium/test_user_file_sources_ftp.py
new file mode 100644
index 000000000000..6980f0e42712
--- /dev/null
+++ b/test/integration_selenium/test_user_file_sources_ftp.py
@@ -0,0 +1,49 @@
+from typing import TYPE_CHECKING
+
+from galaxy.files.templates.examples import get_example
+from galaxy.selenium.navigates_galaxy import (
+    ConfigTemplateParameter,
+    FileSourceInstance,
+)
+from galaxy_test.driver.integration_util import (
+    ConfiguredFileSourceTemplates,
+    ConfiguresDatabaseVault,
+)
+from .framework import (
+    selenium_test,
+    SeleniumIntegrationTestCase,
+)
+
+if TYPE_CHECKING:
+    from galaxy_test.selenium.framework import SeleniumSessionDatasetPopulator
+
+
+PRODUCTION_FTP_LIBRARY = get_example("production_ftp.yml")
+
+
+class TestObjectStoreSelectionSeleniumIntegration(
+    SeleniumIntegrationTestCase, ConfiguredFileSourceTemplates, ConfiguresDatabaseVault
+):
+    ensure_registered = True
+    dataset_populator: "SeleniumSessionDatasetPopulator"
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        cls._configure_database_vault(config)
+        cls._configure_file_source_template_catalog(PRODUCTION_FTP_LIBRARY, config)
+
+    @selenium_test
+    def test_create_and_use(self):
+        random_name = self._get_random_name(prefix="scene ftp")
+        instance = FileSourceInstance(
+            template_id="ftp",
+            name=random_name,
+            description="Archive of computer art from demoscene subsculture",
+            parameters=[
+                ConfigTemplateParameter("string", "host", "ftp.scene.org"),
+                ConfigTemplateParameter("string", "user", "ftp"),
+                ConfigTemplateParameter("string", "password", "email@example.com"),
+            ],
+        )
+        uri_root = self.create_file_source_template(instance)
+        self.upload_uri(f"{uri_root}/welcome.msg", wait=True)
diff --git a/test/unit/app/managers/test_user_file_sources.py b/test/unit/app/managers/test_user_file_sources.py
new file mode 100644
index 000000000000..2594094af83f
--- /dev/null
+++ b/test/unit/app/managers/test_user_file_sources.py
@@ -0,0 +1,196 @@
+import os
+from typing import (
+    List,
+    Optional,
+)
+
+from galaxy.files.templates import ConfiguredFileSourceTemplates
+from galaxy.managers.file_source_instances import (
+    CreateInstancePayload,
+    FileSourceInstancesManager,
+    USER_FILE_SOURCES_SCHEME,
+    UserDefinedFileSourcesConfig,
+    UserDefinedFileSourcesImpl,
+    UserFileSourceModel,
+)
+from galaxy.util.config_templates import RawTemplateConfig
+from .base import BaseTestCase
+
+SIMPLE_FILE_SOURCE_NAME = "myfilesource"
+SIMPLE_FILE_SOURCE_DESCRIPTION = "a description of my file source"
+
+
+class Config:
+    file_source_templates: Optional[List[RawTemplateConfig]] = None
+    file_source_templates_config_file: Optional[str] = None
+
+    def __init__(self, templates: List[RawTemplateConfig]):
+        self.file_source_templates = templates
+
+
+def home_directory_template(tmp_path):
+    return {
+        "id": "home_directory",
+        "name": "Home Directory",
+        "description": "Your Home Directory on this System",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ user.username }}"),
+        },
+    }
+
+
+def secret_directory_template(tmp_path):
+    return {
+        "id": "admin_secret_directory",
+        "name": "Secret Directory",
+        "description": "An directory constructed from admin secrets.",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ environment.var }}/{{ environment.sec }}"),
+        },
+        "environment": {
+            "var": {
+                "type": "variable",
+                "variable": "GX_UNIT_TEST_SECRET_HOME_VAR",
+            },
+            "sec": {
+                "type": "secret",
+                "vault_key": "secret_directory_file_source/my_secret",
+            },
+        },
+    }
+
+
+def secret_directory_template_with_defaults(tmp_path):
+    return {
+        "id": "admin_secret_directory",
+        "name": "Secret Directory",
+        "description": "An directory constructed from admin secrets.",
+        "configuration": {
+            "type": "posix",
+            "root": str(tmp_path / "{{ environment.var }}/{{ environment.sec }}"),
+        },
+        "environment": {
+            "var": {
+                "type": "variable",
+                "variable": "GX_UNIT_TEST_SECRET_HOME_VAR_2",
+                "default": "fine_default_var",
+            },
+            "sec": {
+                "type": "secret",
+                "vault_key": "secret_directory_file_source/my_secret_2",
+                "default": "fine_default_sec",
+            },
+        },
+    }
+
+
+class TestFileSourcesTestCase(BaseTestCase):
+    manager: FileSourceInstancesManager
+    file_sources: UserDefinedFileSourcesImpl
+
+    def test_create_posix(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        assert match.score == len(uri_root)
+        file_source = match.file_source
+        assert file_source
+        assert file_source.label == SIMPLE_FILE_SOURCE_NAME
+        assert file_source.doc == SIMPLE_FILE_SOURCE_DESCRIPTION
+        assert file_source.get_scheme() == USER_FILE_SOURCES_SCHEME
+        assert file_source.get_uri_root() == uri_root
+
+    def test_io(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        target = tmp_path / "round_trip"
+        file_source.realize_to("/moo", target)
+        assert target.read_text("utf-8") == "Moo Cow"
+
+    def test_environment_injection(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=secret_directory_template(tmp_path))
+
+        expected_target = tmp_path / "cool_var" / "cool_sec"
+        assert not expected_target.exists()
+
+        os.environ["GX_UNIT_TEST_SECRET_HOME_VAR"] = "cool_var"
+        self.app.vault.write_secret("secret_directory_file_source/my_secret", "cool_sec")
+
+        user_file_source = self._create_user_file_source("admin_secret_directory")
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        assert expected_target.exists()
+        assert (expected_target / "moo").exists()
+
+    def test_environment_defaults(self, tmp_path):
+        self._init_managers(tmp_path, config_dict=secret_directory_template_with_defaults(tmp_path))
+
+        expected_target = tmp_path / "fine_default_var" / "fine_default_sec"
+        assert not expected_target.exists()
+
+        user_file_source = self._create_user_file_source("admin_secret_directory")
+        uri_root = user_file_source.uri_root
+        match = self.file_sources.find_best_match(uri_root)
+        assert match
+        file_source = match.file_source
+
+        temp_file = tmp_path / "tmp_file"
+        temp_file.write_text("Moo Cow", "utf-8")
+        file_source.write_from("/moo", str(temp_file))
+        assert expected_target.exists()
+        assert (expected_target / "moo").exists()
+
+    def test_show(self, tmp_path):
+        self._init_managers(tmp_path)
+        user_file_source = self._create_user_file_source()
+        user_file_source_showed = self.manager.show(self.trans, user_file_source.uuid)
+        assert user_file_source_showed
+        assert user_file_source_showed.uuid == user_file_source.uuid
+        assert user_file_source_showed.id == user_file_source.id
+
+    def _create_user_file_source(self, template_id="home_directory") -> UserFileSourceModel:
+        create_payload = CreateInstancePayload(
+            name=SIMPLE_FILE_SOURCE_NAME,
+            description=SIMPLE_FILE_SOURCE_DESCRIPTION,
+            template_id=template_id,
+            template_version=0,
+            variables={},
+            secrets={},
+        )
+        user_file_source = self.manager.create_instance(self.trans, create_payload)
+        return user_file_source
+
+    def _init_managers(self, tmp_path, config_dict=None):
+        file_sources_config = UserDefinedFileSourcesConfig(user_object_store_index_by="uuid")
+        self.app[UserDefinedFileSourcesConfig] = file_sources_config
+        self.app.setup_test_vault()
+        if config_dict is None:
+            config_dict = home_directory_template(tmp_path)
+        templates_config = Config([config_dict])
+        templates = ConfiguredFileSourceTemplates.from_app_config(
+            templates_config,
+            vault_configured=True,
+        )
+        self.app[ConfiguredFileSourceTemplates] = templates
+        file_sources = self.app[UserDefinedFileSourcesImpl]
+        manager = self.app[FileSourceInstancesManager]
+        self.file_sources = file_sources
+        self.manager = manager
diff --git a/test/unit/files/_util.py b/test/unit/files/_util.py
index 17e87d5173f3..b38ea167ca82 100644
--- a/test/unit/files/_util.py
+++ b/test/unit/files/_util.py
@@ -5,6 +5,7 @@
 
 from galaxy.files import (
     ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
     DictFileSourcesUserContext,
     OptionalUserContext,
 )
@@ -158,10 +159,10 @@ def write_from(
 def configured_file_sources(conf_file):
     file_sources_config = FileSourcePluginsConfig()
     if isinstance(conf_file, str):
-        conf = ConfiguredFileSources(file_sources_config, conf_file=conf_file)
+        conf = ConfiguredFileSourcesConf(conf_file=conf_file)
     else:
-        conf = ConfiguredFileSources(file_sources_config, conf_dict=conf_file)
-    return conf
+        conf = ConfiguredFileSourcesConf(conf_dict=conf_file)
+    return ConfiguredFileSources(file_sources_config, conf)
 
 
 def assert_simple_file_realize(conf_file, recursive=False, filename="a", contents="a\n", contains=False):
diff --git a/test/unit/files/test_azure.py b/test/unit/files/test_azure.py
index 3e69636df087..5cc55ee8d423 100644
--- a/test/unit/files/test_azure.py
+++ b/test/unit/files/test_azure.py
@@ -23,7 +23,7 @@ def test_azure():
         "container_name": os.environ["GALAXY_TEST_AZURE_CONTAINER_NAME"],
         "account_key": os.environ["GALAXY_TEST_AZURE_ACCOUNT_KEY"],
         "account_name": os.environ["GALAXY_TEST_AZURE_ACCOUNT_NAME"],
-        "namespace_type": os.environ.get("GALAXY_TEST_AZURE_NAMESPACE_TYPE", "flat"),
+        "namespace_type": os.environ.get("GALAXY_TEST_AZURE_NAMESPACE_TYPE", "hierarchal"),
         "writable": True,
     }
     file_sources = configured_file_sources([conf])
diff --git a/test/unit/files/test_posix.py b/test/unit/files/test_posix.py
index f64322db082b..a5749500c597 100644
--- a/test/unit/files/test_posix.py
+++ b/test/unit/files/test_posix.py
@@ -12,7 +12,10 @@
     ItemAccessibilityException,
     RequestParameterInvalidException,
 )
-from galaxy.files import ConfiguredFileSources
+from galaxy.files import (
+    ConfiguredFileSources,
+    ConfiguredFileSourcesConf,
+)
 from galaxy.files.plugins import FileSourcePluginsConfig
 from galaxy.files.unittest_utils import (
     setup_root,
@@ -159,7 +162,7 @@ def test_user_ftp_explicit_config():
         "type": "gxftp",
     }
     tmp, root = setup_root()
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[plugin])
+    file_sources = ConfiguredFileSources(file_sources_config, ConfiguredFileSourcesConf(conf_dict=[plugin]))
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
 
@@ -181,7 +184,9 @@ def test_user_ftp_implicit_config():
         ftp_upload_dir=root,
         ftp_upload_purge=False,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert os.path.exists(os.path.join(root, "a"))
@@ -199,7 +204,9 @@ def test_user_ftp_respects_upload_purge_off():
         ftp_upload_dir=root,
         ftp_upload_purge=True,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert_realizes_as(file_sources, "gxftp://a", "a\n", user_context=user_context)
@@ -211,7 +218,9 @@ def test_user_ftp_respects_upload_purge_on_by_default():
     file_sources_config = FileSourcePluginsConfig(
         ftp_upload_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     user_context = user_context_fixture(user_ftp_dir=root)
     write_file_fixtures(tmp, root)
     assert_realizes_as(file_sources, "gxftp://a", "a\n", user_context=user_context)
@@ -226,7 +235,7 @@ def test_import_dir_explicit_config():
     plugin = {
         "type": "gximport",
     }
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[plugin])
+    file_sources = ConfiguredFileSources(file_sources_config, ConfiguredFileSourcesConf(conf_dict=[plugin]))
     write_file_fixtures(tmp, root)
 
     assert_realizes_as(file_sources, "gximport://a", "a\n")
@@ -237,7 +246,9 @@ def test_import_dir_implicit_config():
     file_sources_config = FileSourcePluginsConfig(
         library_import_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
     write_file_fixtures(tmp, root)
 
     assert_realizes_as(file_sources, "gximport://a", "a\n")
@@ -248,7 +259,9 @@ def test_user_import_dir_implicit_config():
     file_sources_config = FileSourcePluginsConfig(
         user_library_import_dir=root,
     )
-    file_sources = ConfiguredFileSources(file_sources_config, conf_dict=[], load_stock_plugins=True)
+    file_sources = ConfiguredFileSources(
+        file_sources_config, ConfiguredFileSourcesConf(conf_dict=[]), load_stock_plugins=True
+    )
 
     write_file_fixtures(tmp, os.path.join(root, EMAIL))
 
diff --git a/test/unit/files/test_template_manager.py b/test/unit/files/test_template_manager.py
new file mode 100644
index 000000000000..5c89405b0c8b
--- /dev/null
+++ b/test/unit/files/test_template_manager.py
@@ -0,0 +1,58 @@
+from galaxy.files.templates import ConfiguredFileSourceTemplates
+from .test_template_models import (
+    LIBRARY_AWS,
+    LIBRARY_HOME_DIRECTORY,
+)
+
+
+class MockConfig:
+    def __init__(self, config_path):
+        self.file_source_templates = None
+        self.file_source_templates_config_file = config_path
+
+
+def test_manager(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_HOME_DIRECTORY, "utf-8")
+    config = MockConfig(config_path)
+    templates = ConfiguredFileSourceTemplates.from_app_config(config)
+    summaries = templates.summaries
+    assert summaries
+    assert len(summaries.root) == 1
+
+
+def test_manager_throws_exception_if_vault_is_required_but_configured(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_AWS, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=False)
+    except Exception as e:
+        exc = e
+    assert exc, "catalog creation should result in an exception"
+    assert "vault must be configured" in str(exc)
+
+
+def test_manager_with_secrets_is_fine_if_vault_is_required_and_configured(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_AWS, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=True)
+    except Exception as e:
+        exc = e
+    assert exc is None
+
+
+def test_manager_does_not_throw_exception_if_vault_is_not_required(tmpdir):
+    config_path = tmpdir / "conf.yml"
+    config_path.write_text(LIBRARY_HOME_DIRECTORY, "utf-8")
+    config = MockConfig(config_path)
+    exc = None
+    try:
+        ConfiguredFileSourceTemplates.from_app_config(config, vault_configured=False)
+    except Exception as e:
+        exc = e
+    assert exc is None
diff --git a/test/unit/files/test_template_models.py b/test/unit/files/test_template_models.py
new file mode 100644
index 000000000000..afc25c927791
--- /dev/null
+++ b/test/unit/files/test_template_models.py
@@ -0,0 +1,268 @@
+from yaml import safe_load
+
+from galaxy.files.templates.examples import get_example
+from galaxy.files.templates.manager import raw_config_to_catalog
+from galaxy.files.templates.models import (
+    FileSourceTemplate,
+    FileSourceTemplateCatalog,
+    FtpFileSourceConfiguration,
+    PosixFileSourceConfiguration,
+    S3FSFileSourceConfiguration,
+    template_to_configuration,
+)
+
+LIBRARY_AWS = """
+- id: aws_bucket
+  name: Amazon Bucket
+  description: An Amazon S3 Bucket
+  variables:
+    bucket_name:
+      type: string
+      help: Name of bucket to use when connecting to AWS resources.
+  secrets:
+    access_key:
+      help: AWS access key to use when connecting to AWS resources.
+    secret_key:
+      help: AWS secret key to use when connecting to AWS resources.
+  configuration:
+    type: s3fs
+    key: '{{ secrets.access_key}}'
+    secret: '{{ secrets.secret_key}}'
+    bucket: '{{ variables.bucket_name}}'
+"""
+
+
+def test_aws_s3_config():
+    template_library = _parse_template_library(LIBRARY_AWS)
+    s3_template = _assert_has_one_template(template_library)
+    assert s3_template.description == "An Amazon S3 Bucket"
+    configuration_obj = template_to_configuration(
+        s3_template,
+        {"bucket_name": "sec3"},
+        {"access_key": "sec1", "secret_key": "sec2"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, S3FSFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "s3fs"
+    assert configuration["key"] == "sec1"
+    assert configuration["secret"] == "sec2"
+    assert configuration["bucket"] == "sec3"
+
+
+LIBRARY_HOME_DIRECTORY = """
+- id: home_directory
+  name: Home Directory
+  description: Your Home Directory on this System
+  configuration:
+    type: posix
+    root: "/home/{{ user.username}}/"
+"""
+
+
+def test_a_posix_template():
+    template_library = _parse_template_library(LIBRARY_HOME_DIRECTORY)
+    posix_template = _assert_has_one_template(template_library)
+    assert posix_template.description == "Your Home Directory on this System"
+    configuration_obj = template_to_configuration(
+        posix_template,
+        {},
+        {},
+        user_details={"username": "foobar"},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, PosixFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "posix"
+    assert configuration["root"] == "/home/foobar/"
+
+
+LIBRARY_FTP = """
+- id: ftp
+  name: Generic FTP Server
+  description: Generic FTP configuration with all configuration options exposed.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of FTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+      default: false
+    port:
+      type: integer
+      help: Port used to connect to the FTP server.
+      default: 21
+  secrets:
+    password:
+      help: Password to connect to FTP server with.
+"""
+
+
+def test_ftp():
+    template_library = _parse_template_library(LIBRARY_FTP)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "port": 22, "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Not optional but it does specify a default so the configuration object does
+    assert configuration["port"] == 22
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+LIBRARY_FTP_NO_PORT = """
+- id: ftp_no_port
+  name: FTP (no port specified)
+  description: Generic FTP configuration with no port specified.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of FTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an FTP server you have permission to write to?
+  secrets:
+    password:
+      help: Password to connect to FTP server with.
+"""
+
+
+def test_ftp_no_port_template():
+    template_library = _parse_template_library(LIBRARY_FTP_NO_PORT)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Not optional but it does specify a default so the configuration object does
+    assert configuration["port"] == 21
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+LIBRARY_FTP_WITH_DEFAULT_SFTP_PORT = """
+- id: ftp
+  name: Generic SFTP Server
+  description: Generic SFTP configuration with all configuration options exposed.
+  configuration:
+    type: ftp
+    host: "{{ variables.host }}"
+    user: "{{ variables.user }}"
+    port: "{{ variables.port }}"
+    passwd: "{{ secrets.password }}"
+    writable: "{{ variables.writable }}"
+  variables:
+    host:
+      type: string
+      help: Host of SFTP Server to Connect to.
+    user:
+      type: string
+      help: Username to connect with.
+    writable:
+      type: boolean
+      help: Is this an SFTP server you have permission to write to?
+    port:
+      type: integer
+      help: Port used to connect to the SFTP server.
+      default: 22
+  secrets:
+    password:
+      help: Password to connect to SFTP server with.
+"""
+
+
+def test_ftp_default_to_sftp_port():
+    template_library = _parse_template_library(LIBRARY_FTP_WITH_DEFAULT_SFTP_PORT)
+    ftp_template = _assert_has_one_template(template_library)
+    configuration_obj = template_to_configuration(
+        ftp_template,
+        {"host": "ftp.galaxyproject.org", "user": "john", "writable": True},
+        {"password": "mycoolpassword123"},
+        user_details={},
+        environment={},
+    )
+
+    # expanded configuration should validate with template expansions...
+    assert isinstance(configuration_obj, FtpFileSourceConfiguration)
+    configuration = configuration_obj.model_dump()
+
+    assert configuration["type"] == "ftp"
+    assert configuration["host"] == "ftp.galaxyproject.org"
+    # Using the template default for not supplied values
+    assert configuration["port"] == 22
+    assert configuration["passwd"] == "mycoolpassword123"
+    assert configuration["user"] == "john"
+
+
+def test_examples_parse():
+    assert_example_parses("production_ftp.yml")
+    assert_example_parses("production_azure.yml")
+    assert_example_parses("production_aws_private_bucket.yml")
+    assert_example_parses("production_aws_public_bucket.yml")
+    assert_example_parses("templating_override.yml")
+    assert_example_parses("admin_secrets.yml")
+    assert_example_parses("admin_secrets_with_defaults.yml")
+
+
+def assert_example_parses(filename: str):
+    as_str = get_example(filename)
+    _parse_template_library(as_str)
+
+
+def _assert_has_one_template(catalog: FileSourceTemplateCatalog) -> FileSourceTemplate:
+    assert len(catalog.root) == 1
+    template = catalog.root[0]
+    return template
+
+
+def _parse_template_library(contents: str) -> FileSourceTemplateCatalog:
+    raw_contents = safe_load(contents)
+    return raw_config_to_catalog(raw_contents)
diff --git a/test/unit/objectstore/test_from_configuration_object.py b/test/unit/objectstore/test_from_configuration_object.py
index 3829bd64fd7b..8f28302bab73 100644
--- a/test/unit/objectstore/test_from_configuration_object.py
+++ b/test/unit/objectstore/test_from_configuration_object.py
@@ -39,6 +39,7 @@ def app_config(tmpdir) -> UserObjectStoresAppConfig:
         jobs_directory=str(tmpdir / "jobs"),
         new_file_path=str(tmpdir / "new_files"),
         umask=0o077,
+        gid=0o077,
         object_store_cache_path=str(tmpdir / "cache"),
         object_store_cache_size=1,
         user_object_store_index_by="uuid",
diff --git a/test/unit/objectstore/test_template_models.py b/test/unit/objectstore/test_template_models.py
index 505f9b3e8d99..431a63041dac 100644
--- a/test/unit/objectstore/test_template_models.py
+++ b/test/unit/objectstore/test_template_models.py
@@ -1,14 +1,18 @@
+import os
+
 from yaml import safe_load
 
+from galaxy.objectstore.templates.examples import get_example
 from galaxy.objectstore.templates.manager import raw_config_to_catalog
 from galaxy.objectstore.templates.models import (
+    AwsS3ObjectStoreConfiguration,
     AzureObjectStoreConfiguration,
     DiskObjectStoreConfiguration,
     GenericS3ObjectStoreConfiguration,
     ObjectStoreTemplateCatalog,
-    S3ObjectStoreConfiguration,
     template_to_configuration,
 )
+from galaxy.util.config_templates import VariablesDict
 
 LIBRARY_1 = """
 - id: amazon_bucket
@@ -26,7 +30,7 @@
     bucket_name:
       help: Name of bucket to use when connecting to AWS resources.
   configuration:
-    type: s3
+    type: aws_s3
     auth:
         access_key: '{{ secrets.access_key}}'
         secret_key: '{{ secrets.secret_key}}'
@@ -50,16 +54,17 @@ def test_parsing_simple_s3():
         {"use_reduced_redundancy": False},
         {"access_key": "sec1", "secret_key": "sec2", "bucket_name": "sec3"},
         user_details={},
+        environment={},
     )
     badges = s3_template.configuration.badges
     assert badges
     assert len(badges) == 3
 
     # expanded configuration should validate with template expansions...
-    assert isinstance(configuration_obj, S3ObjectStoreConfiguration)
+    assert isinstance(configuration_obj, AwsS3ObjectStoreConfiguration)
     configuration = configuration_obj.model_dump()
 
-    assert configuration["type"] == "s3"
+    assert configuration["type"] == "aws_s3"
     assert configuration["auth"]["access_key"] == "sec1"
     assert configuration["auth"]["secret_key"] == "sec2"
     assert configuration["bucket"]["name"] == "sec3"
@@ -110,6 +115,7 @@ def test_parsing_generic_s3():
         {"use_reduced_redundancy": False},
         {"access_key": "sec1", "secret_key": "sec2", "bucket_name": "sec3"},
         user_details={},
+        environment={},
     )
     badges = s3_template.configuration.badges
     assert badges
@@ -157,15 +163,91 @@ def test_parsing_multiple_posix():
     assert secure_template.version == 0
     assert secure_template.hidden is False
 
-    general_configuration = template_to_configuration(general_template, {}, {}, user_details={"username": "jane"})
+    general_configuration = template_to_configuration(
+        general_template, {}, {}, user_details={"username": "jane"}, environment={}
+    )
     assert isinstance(general_configuration, DiskObjectStoreConfiguration)
     assert general_configuration.files_dir == "/data/general/jane"
 
-    secure_configuration = template_to_configuration(secure_template, {}, {}, user_details={"username": "jane"})
+    secure_configuration = template_to_configuration(
+        secure_template, {}, {}, user_details={"username": "jane"}, environment={}
+    )
     assert isinstance(secure_configuration, DiskObjectStoreConfiguration)
     assert secure_configuration.files_dir == "/data/secure/jane"
 
 
+LIBRARY_WITH_PATH_PARAMETER = """
+- id: path_disk
+  name: General Disk
+  description: General Disk Bound to You
+  configuration:
+    type: disk
+    files_dir: '/data/general/{{ user.username | ensure_path_component }}//{{ variables.project_name | ensure_path_component }}'
+  variables:
+    project_name:
+      type: string  # dont do this in practice - use path_component for more eager validation
+      help: Project name used in path for this template library.
+"""
+
+
+def test_parsing_with_path_security():
+    template_library = _parse_template_library(LIBRARY_WITH_PATH_PARAMETER)
+    assert len(template_library.root) == 1
+    path_template = template_library.root[0]
+
+    assert path_template.version == 0
+
+    user_details = {"username": "jane"}
+    variables: VariablesDict = {"project_name": "moo"}
+
+    general_configuration = template_to_configuration(
+        path_template, variables, {}, user_details=user_details, environment={}
+    )
+    assert isinstance(general_configuration, DiskObjectStoreConfiguration)
+    assert os.path.abspath(general_configuration.files_dir) == "/data/general/jane/moo"
+
+    variables = {"project_name": "../moo"}
+    exc = None
+    try:
+        template_to_configuration(path_template, variables, {}, user_details=user_details, environment={})
+    except Exception as e:
+        exc = e
+    assert exc is not None
+
+
+LIBRARY_WITH_CUSTOM_TEMPLATE_START_END = """
+- id: path_disk
+  name: General Disk
+  description: General Disk Bound to You
+  configuration:
+    type: disk
+    files_dir: '/data/general/@= user.username | ensure_path_component =@/@= variables.project_name | ensure_path_component =@'
+    template_start: '@='
+    template_end: '=@'
+  variables:
+    project_name:
+      type: string  # dont do this in practice - use path_component for more eager validation
+      help: Project name used in path for this template library.
+"""
+
+
+def test_custom_template_start_and_ends():
+    template_library = _parse_template_library(LIBRARY_WITH_CUSTOM_TEMPLATE_START_END)
+    assert len(template_library.root) == 1
+    path_template = template_library.root[0]
+
+    assert path_template.version == 0
+
+    user_details = {"username": "jane"}
+    variables: VariablesDict = {"project_name": "moo"}
+
+    general_configuration = template_to_configuration(
+        path_template, variables, {}, user_details=user_details, environment={}
+    )
+    assert isinstance(general_configuration, DiskObjectStoreConfiguration)
+    assert os.path.abspath(general_configuration.files_dir) == "/data/general/jane/moo"
+
+
 LIBRARY_AZURE_CONTAINER = """
 - id: amazon_bucket
   name: Azure Container
@@ -199,6 +281,7 @@ def test_parsing_azure():
         {"account_name": "galaxyproject"},
         {"account_key": "sec1", "container_name": "sec2"},
         user_details={},
+        environment={},
     )
     assert isinstance(configuration_obj, AzureObjectStoreConfiguration)
     assert configuration_obj.auth.account_name == "galaxyproject"
@@ -206,6 +289,46 @@ def test_parsing_azure():
     assert configuration_obj.container.name == "sec2"
 
 
+def test_minio_example_boolean():
+    template_library = _parse_template_library(get_example("minio_example.yml"))
+    assert len(template_library.root) == 1
+    minio_template = template_library.root[0]
+    configuration_obj = template_to_configuration(
+        minio_template,
+        {"access_key": "galaxyproject", "bucket": "galaxy"},
+        {"secret_key": "sec1"},
+        user_details={},
+        environment={"host": "localhost", "port": "9000", "secure": "1", "connection_path": "moo/cow"},
+    )
+    assert isinstance(configuration_obj, GenericS3ObjectStoreConfiguration)
+    assert configuration_obj.connection.is_secure
+
+    configuration_obj = template_to_configuration(
+        minio_template,
+        {"access_key": "galaxyproject", "bucket": "galaxy"},
+        {"secret_key": "sec1"},
+        user_details={},
+        environment={"host": "localhost", "port": "9000", "secure": "no", "connection_path": "moo/cow"},
+    )
+    assert isinstance(configuration_obj, GenericS3ObjectStoreConfiguration)
+    assert not configuration_obj.connection.is_secure
+
+
+def test_examples_parse():
+    assert_example_parses("simple_example.yml")
+    assert_example_parses("minio_example.yml")
+    assert_example_parses("production_generic_s3.yml")
+    assert_example_parses("production_azure_blob.yml")
+    assert_example_parses("cloudflare.yml")
+    assert_example_parses("minio_just_buckets.yml")
+    assert_example_parses("azure_just_container.yml")
+
+
+def assert_example_parses(filename: str):
+    as_str = get_example(filename)
+    _parse_template_library(as_str)
+
+
 def _parse_template_library(contents: str) -> ObjectStoreTemplateCatalog:
     raw_contents = safe_load(contents)
     return raw_config_to_catalog(raw_contents)
diff --git a/test/unit/util/test_config_template_validation.py b/test/unit/util/test_config_template_validation.py
new file mode 100644
index 000000000000..045c9d28e1f1
--- /dev/null
+++ b/test/unit/util/test_config_template_validation.py
@@ -0,0 +1,138 @@
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+)
+
+from galaxy.exceptions import (
+    RequestParameterInvalidException,
+    RequestParameterMissingException,
+)
+from galaxy.util.config_templates import (
+    StrictModel,
+    TemplateEnvironmentEntry,
+    TemplateSecret,
+    TemplateVariable,
+    TemplateVariableBoolean,
+    TemplateVariableInteger,
+    TemplateVariablePathComponent,
+    TemplateVariableString,
+    validate_secrets_and_variables,
+)
+
+TEST_TEMPLATE_ID = "test_id"
+TEST_TEMPLATE_VERSION = 0
+
+
+class TestTemplate(StrictModel):
+    id: str
+    version: int
+    variables: Optional[List[TemplateVariable]]
+    secrets: Optional[List[TemplateSecret]]
+    environment: Optional[List[TemplateEnvironmentEntry]]
+
+
+def _template_with_variable(variable: TemplateVariable) -> TestTemplate:
+    return TestTemplate(
+        id=TEST_TEMPLATE_ID,
+        version=TEST_TEMPLATE_VERSION,
+        variables=[variable],
+        secrets=None,
+        environment=None,
+    )
+
+
+class TestInstanceDefinition(StrictModel):
+    template_id: str
+    template_version: int
+    variables: Dict[str, Any]
+    secrets: Dict[str, str]
+
+
+def _test_instance_with_variables(variables: Dict[str, Any]) -> TestInstanceDefinition:
+    return TestInstanceDefinition(
+        template_id=TEST_TEMPLATE_ID,
+        template_version=TEST_TEMPLATE_VERSION,
+        variables=variables,
+        secrets={},
+    )
+
+
+def test_variable_typing_string():
+    template = _template_with_variable(TemplateVariableString(name="test_var", help=None, type="string"))
+    instance = _test_instance_with_variables({"test_var": "moocow"})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 5})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_boolean():
+    template = _template_with_variable(TemplateVariableBoolean(name="test_var", help=None, type="boolean"))
+    instance = _test_instance_with_variables({"test_var": False})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 0})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "false"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_int():
+    template = _template_with_variable(TemplateVariableInteger(name="test_var", help=None, type="integer"))
+    instance = _test_instance_with_variables({"test_var": 6})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "six"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_typing_path_component():
+    template = _template_with_variable(TemplateVariablePathComponent(name="test_var", help=None, type="path_component"))
+    instance = _test_instance_with_variables({"test_var": "simple_directory"})
+    validate_secrets_and_variables(instance, template)
+
+    instance = _test_instance_with_variables({"test_var": 0})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": False})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "../simple_directory"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+    instance = _test_instance_with_variables({"test_var": "/simple_directory"})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterInvalidException)
+
+
+def test_variable_missing():
+    template = _template_with_variable(TemplateVariablePathComponent(name="test_var", help=None, type="path_component"))
+    instance = _test_instance_with_variables({})
+    e = assert_validation_throws(instance, template)
+    assert isinstance(e, RequestParameterMissingException)
+
+
+def assert_validation_throws(instance: TestInstanceDefinition, template: TestTemplate) -> Exception:
+    try:
+        validate_secrets_and_variables(instance, template)
+    except Exception as e:
+        return e
+    raise AssertionError("Expected validation error did not occur.")