feat: add private r2 bucket

2026-08-29 01:11:22 +05:30
parent 623935df22
commit 3b10e726b7
12 changed files with 731 additions and 14 deletions
@@ -24,6 +24,11 @@ R2_SECRET_ACCESS_KEY=
 R2_BUCKET=
 # Public base URL where bucket objects are served (custom domain or pub-XXX.r2.dev)
 R2_PUBLIC_URL=
+# Separate bucket for private media (DM attachments), read only via short-lived
+# presigned GETs. It must have NO public access and no custom domain: R2 public
+# access is per-bucket, so a prefix inside R2_BUCKET would still be world-readable.
+# Empty disables private-media endpoints (they return 503).
+R2_PRIVATE_BUCKET=

 # SMTP (password-reset + email-verification + /feedback admin notifications)
 SMTP_HOST=