iu
ec8d907565
- introduce storage.Backend with S3 and local file-system implementations - deliver all blobs via signed GET/HEAD /api/objects/<key> (Range, Content-Type) - stream S3 objects through the backend; remove presigned URL path - share shared HMAC Signer between backends - remove S3_PUBLIC_URL; rename S3_PRESIGN_TTL to OBJECT_URL_TTL - make storage label in health dynamic; nginx proxy_buffering off for objects
44 lines
1.0 KiB
Bash
44 lines
1.0 KiB
Bash
# PostgreSQL (pg.localnet)
|
|
PG_HOST=pg.localnet
|
|
PG_PORT=5432
|
|
PG_USER=album
|
|
PG_PASSWORD=change_me
|
|
PG_DATABASE=shared_album
|
|
PG_SSLMODE=disable
|
|
|
|
# S3 (Garage on s3.localnet) - internal storage, never exposed to clients
|
|
S3_ENDPOINT=http://s3.localnet:3900
|
|
S3_REGION=garage
|
|
S3_ACCESS_KEY=GKchange_me
|
|
S3_SECRET_KEY=change_me
|
|
S3_BUCKET=galo-data
|
|
S3_USE_PATH_STYLE=true
|
|
|
|
# Storage backend: s3 (default, S3-compatible/Garage) or fs (local filesystem).
|
|
# Blobs are always delivered through the backend via /api/objects/<key>.
|
|
STORAGE_BACKEND=s3
|
|
# Required when STORAGE_BACKEND=fs: root directory for object blobs
|
|
FS_ROOT=/var/lib/galo/objects
|
|
# Signs object URLs; falls back to JWT_SECRET when empty
|
|
URL_SECRET=
|
|
# Lifetime of signed object URLs
|
|
OBJECT_URL_TTL=1h
|
|
|
|
# Auth
|
|
JWT_SECRET=change_me_long_random
|
|
JWT_ACCESS_TTL=15m
|
|
JWT_REFRESH_TTL=720h
|
|
|
|
# Server
|
|
HTTP_ADDR=:8080
|
|
APP_BASE_URL=http://localhost:8080
|
|
|
|
# SSE
|
|
SSE_HEARTBEAT_INTERVAL=25s
|
|
SSE_CLIENT_BUFFER=64
|
|
|
|
# Background worker (variant generation + object GC)
|
|
WORKER_INTERVAL=5s
|
|
WORKER_BATCH=10
|
|
WORKER_PENDING_TTL=10m
|