jpscott84/drinktracker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make the image bucket private

Browse Source 
The bucket carried an anonymous download policy, which is what made the
old unauthenticated proxy work. Now that images are served through a
session-gated route using credentials, anonymous access is unnecessary
and was the second half of the public exposure.

Applied on the running host; both compose files updated so bringing the
stack up elsewhere does not re-apply 'download'.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
JP
2026-08-08 20:31:01 +00:00
parent 996b1b5360
commit 181ef13c7e
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docker-compose.prod.yml
View File

@@ -50,7 +50,7 @@ services:
/bin/sh -c " /bin/sh -c "
mc alias set local http://localhost:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY; mc alias set local http://localhost:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY;
mc mb local/drink-images --ignore-existing; mc mb local/drink-images --ignore-existing;
mc anonymous set download local/drink-images; mc anonymous set none local/drink-images;
exit 0; exit 0;
" "

2
docker-compose.yml
View File

@@ -46,7 +46,7 @@ services:
/bin/sh -c " /bin/sh -c "
mc alias set local http://minio:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY; mc alias set local http://minio:9000 $$MINIO_ACCESS_KEY $$MINIO_SECRET_KEY;
mc mb local/drink-images --ignore-existing; mc mb local/drink-images --ignore-existing;
mc anonymous set download local/drink-images; mc anonymous set none local/drink-images;
exit 0; exit 0;
" "