fix stuff

.env.example

@@ -12,6 +12,7 @@ SESSION_SECRET=local-development-session-secret-change-me
 COOKIE_SECURE=false
 
 STORAGE_ENDPOINT=localhost:9000
+STORAGE_PUBLIC_ENDPOINT=
 STORAGE_ACCESS_KEY=minioadmin
 STORAGE_SECRET_KEY=minioadmin
 STORAGE_BUCKET=gallery-media

backend/cmd/server/main.go

@@ -46,10 +46,12 @@ func main() {
 
 	objectStorage, err := storage.NewMinIO(storage.Config{
 		Endpoint:       cfg.StorageEndpoint,
+		PublicEndpoint: cfg.StoragePublicEndpoint,
 		AccessKey:      cfg.StorageAccessKey,
 		SecretKey:      cfg.StorageSecretKey,
 		Bucket:         cfg.StorageBucket,
 		UseSSL:         cfg.StorageUseSSL,
+		PublicUseSSL:   true,
 		CORSOrigins:    cfg.CORSOrigin,
 	})
 	if err != nil {

backend/internal/config/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	SessionSecret         string
 	CookieSecure          bool
 	StorageEndpoint       string
+	StoragePublicEndpoint string
 	StorageAccessKey      string
 	StorageSecretKey      string
 	StorageBucket         string
@@ -40,6 +41,7 @@ func Load() Config {
 		SessionSecret:         envOrDefault("SESSION_SECRET", "local-development-session-secret-change-me"),
 		CookieSecure:          parseBoolEnv("COOKIE_SECURE", false),
 		StorageEndpoint:       envOrDefault("STORAGE_ENDPOINT", "localhost:9000"),
+		StoragePublicEndpoint: envOrDefault("STORAGE_PUBLIC_ENDPOINT", ""),
 		StorageAccessKey:      envOrDefault("STORAGE_ACCESS_KEY", "minioadmin"),
 		StorageSecretKey:      envOrDefault("STORAGE_SECRET_KEY", "minioadmin"),
 		StorageBucket:         envOrDefault("STORAGE_BUCKET", "gallery-media"),

backend/internal/storage/storage.go

@@ -14,10 +14,12 @@ import (
 
 type Config struct {
 	Endpoint       string
+	PublicEndpoint string
 	AccessKey      string
 	SecretKey      string
 	Bucket         string
 	UseSSL         bool
+	PublicUseSSL   bool
 	CORSOrigins    string
 }
 
@@ -40,6 +42,7 @@ type Storage interface {
 
 type MinIO struct {
 	client       *minio.Client
+	publicClient *minio.Client
 	bucket       string
 	corsOrigins  string
 }
@@ -55,7 +58,24 @@ func NewMinIO(config Config) (*MinIO, error) {
 	if config.Bucket == "" {
 		return nil, fmt.Errorf("object storage bucket is required")
 	}
-	return &MinIO{client: client, bucket: config.Bucket, corsOrigins: config.CORSOrigins}, nil
+
+	publicClient := client
+	if config.PublicEndpoint != "" {
+		publicClient, err = minio.New(config.PublicEndpoint, &minio.Options{
+			Creds:  credentials.NewStaticV4(config.AccessKey, config.SecretKey, ""),
+			Secure: config.PublicUseSSL,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("create public object storage client: %w", err)
+		}
+	}
+
+	return &MinIO{
+		client:       client,
+		publicClient: publicClient,
+		bucket:       config.Bucket,
+		corsOrigins:  config.CORSOrigins,
+	}, nil
 }
 
 func (s *MinIO) EnsureBucket(ctx context.Context) error {
@@ -63,15 +83,14 @@ func (s *MinIO) EnsureBucket(ctx context.Context) error {
 	if err != nil {
 		return fmt.Errorf("check object storage bucket: %w", err)
 	}
-	if exists {
+	if !exists {
-		return nil
-	}
 		if err := s.client.MakeBucket(ctx, s.bucket, minio.MakeBucketOptions{}); err != nil {
 			response := minio.ToErrorResponse(err)
 			if response.Code != "BucketAlreadyExists" && response.Code != "BucketAlreadyOwnedByYou" {
 				return fmt.Errorf("create object storage bucket: %w", err)
 			}
 		}
+	}
 	origins := make([]string, 0)
 	for _, origin := range strings.Split(s.corsOrigins, ",") {
 		if value := strings.TrimSpace(origin); value != "" {
@@ -95,7 +114,7 @@ func (s *MinIO) EnsureBucket(ctx context.Context) error {
 }
 
 func (s *MinIO) CreateUploadURL(ctx context.Context, key, _ string, expiry time.Duration) (string, error) {
-	url, err := s.client.PresignedPutObject(ctx, s.bucket, key, expiry)
+	url, err := s.publicClient.PresignedPutObject(ctx, s.bucket, key, expiry)
 	if err != nil {
 		return "", fmt.Errorf("create upload URL: %w", err)
 	}
@@ -103,7 +122,7 @@ func (s *MinIO) CreateUploadURL(ctx context.Context, key, _ string, expiry time.
 }
 
 func (s *MinIO) CreateDownloadURL(ctx context.Context, key string, expiry time.Duration) (string, error) {
-	url, err := s.client.PresignedGetObject(ctx, s.bucket, key, expiry, nil)
+	url, err := s.publicClient.PresignedGetObject(ctx, s.bucket, key, expiry, nil)
 	if err != nil {
 		return "", fmt.Errorf("create download URL: %w", err)
 	}

docker-compose.yml

@@ -49,6 +49,7 @@ services:
       SESSION_SECRET: "${SESSION_SECRET:-docker-compose-session-secret-change-me}"
       COOKIE_SECURE: "${COOKIE_SECURE:-false}"
       STORAGE_ENDPOINT: "minio:9000"
+      STORAGE_PUBLIC_ENDPOINT: ""
       STORAGE_ACCESS_KEY: "${STORAGE_ACCESS_KEY:-minioadmin}"
       STORAGE_SECRET_KEY: "${STORAGE_SECRET_KEY:-minioadmin}"
       STORAGE_BUCKET: "${STORAGE_BUCKET:-gallery-media}"