Repository navigation
Public files don't render in Docker Compose, and 'private' isn't enforced by the bucket in Aspire #1410
Description
Follow-up from #1402. Uploads now work in the Docker Compose stack, but files uploaded as Public (for example the admin avatar) still don't render there. BuildPublicUrl returns PublicBaseUrl, or else ServiceUrl (http://rustfs:9000/fsh/...). Browsers can't resolve that host, and the compose bucket has no anonymous-read policy anyway.
Why this isn't a one-line fix
Visibility is not encoded in the storage key. StorageKeyBuilder puts every file under the same layout, so there's no way to grant anonymous read to public files only:
| Stack | Bucket policy today | Effect |
|---|---|---|
Aspire (AppHost.cs) |
anonymous s3:GetObject on fsh/* |
Public files render. Private files are also readable without auth by anyone who has the key. Keys contain a UUIDv7, so they're hard to guess, but "private" isn't enforced by the store. |
| Compose | none | Private files are safe, public URLs are broken |
| AWS Terraform | off by default; app_s3_public_read_prefix (uploads/) if enabled |
Can only work if public files live under a known prefix, which they don't |
Proposal
- Put visibility in the key. Have
StorageKeyBuilderadd apublic/orprivate/root prefix (existing keys stay valid; only new uploads get it). - Grant anonymous read only on
public/*in all three stacks: the Aspire bootstrap policy, a new compose bootstrap policy, and the Terraformapp_s3_public_read_prefixdefault changed topublic/. - Compose: set
Storage__S3__PublicBaseUrl=${FSH_S3_PUBLIC_URL}/fsh. - Changing visibility (if a file can go from public to private) becomes a copy plus delete. We need to check whether the Files module allows that today.
Alternative considered: an API endpoint that answers 302 with a presigned GET for public files. It needs no bucket policy anywhere, but it adds an API round trip per image and URLs change on every request, so browsers and CDNs can't cache them. Prefix + policy is better for public assets, since those are what you want cached.
Also worth doing
- The RustFS S3 port that fix(storage): sign presigned URLs for the host browsers reach, so compose uploads work #1402 publishes in compose is bound to all interfaces. The README should say to firewall it, or bind it to the proxy's interface (
127.0.0.1:${FSH_S3_PORT}:9000) when the proxy runs on the same host.
Touches src/BuildingBlocks/Storage (key builder, if it lives there) and the Files module, so it needs maintainer sign-off on the design before a PR.
Activity
iammukeshm commentedon Sep 30, 2026
Signed off on the design: visibility goes in the key, and anonymous read is granted on
public/*only, in all three stacks. I'm implementing it now. Decisions:public/orprivate/, and the storage key builder stays the one place that decides.fsh/*topublic/*would break every public file uploaded before the change. The PR ships a one-time migration that copies existing public objects topublic/…keys and updates their rows, so nothing is lost on upgrade. Existing private objects stay where they are and become non-public once the broad policy goes.public/*and setsStorage__S3__PublicBaseUrl=${FSH_S3_PUBLIC_URL}/fsh. The README gets a note to firewall the published S3 port, or bind it to127.0.0.1when the proxy runs on the same host.app_s3_public_read_prefixdefault becomespublic/.fix(compose): serve public files from the public/* prefix and documen…
fix(files): serialize storage moves per file and make the old-object …
feat(storage): put file visibility in the key and open only public/* …
iammukeshm commentedon Sep 30, 2026
Fixed in #1422 (docs: fullstackhero/docs#262). Follow-ups are tracked in #1423.