From 181ef13c7ed21757b8036a9f4c8f0bdd9a9d1fb4 Mon Sep 17 00:00:00 2001 From: JP Date: Sat, 8 Aug 2026 20:31:01 +0000 Subject: [PATCH] Make the image bucket private The bucket carried an anonymous download policy, which is what made the old unauthenticated proxy work. Now that images are served through a session-gated route using credentials, anonymous access is unnecessary and was the second half of the public exposure. Applied on the running host; both compose files updated so bringing the stack up elsewhere does not re-apply 'download'. Co-Authored-By: Claude Opus 5 (1M context) --- docker-compose.prod.yml | 2 +- docker-compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index c01f847..a717b9b 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -50,7 +50,7 @@ services: /bin/sh -c " mc alias set local http://localhost:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY; mc mb local/drink-images --ignore-existing; - mc anonymous set download local/drink-images; + mc anonymous set none local/drink-images; exit 0; " diff --git a/docker-compose.yml b/docker-compose.yml index 8a81aab..57d6864 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -46,7 +46,7 @@ services: /bin/sh -c " mc alias set local http://minio:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY; mc mb local/drink-images --ignore-existing; - mc anonymous set download local/drink-images; + mc anonymous set none local/drink-images; exit 0; "