Public CDN: MinIO assets bucket with public-read policy + public funnel

forgejo_admin commented

2026-03-21 15:36:50 +00:00

Owner

Type

Feature

Lineage

plan-pal-e-platform → discovered scope (jersey email images unreachable)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want the MinIO assets bucket to be publicly readable
So that images in HTML emails and public pages render correctly from any network

Context

MinIO API (minio-api.tail5b443a.ts.net) is Tailscale-internal only. Images referenced in HTML emails (sent via Gmail API) show as broken/question marks because Gmail servers can't reach Tailscale URLs. The westside-app logo in the nav bar has the same problem in emails.

Enterprise fix: S3 bucket policy makes assets publicly readable, public Tailscale funnel exposes the API. Other buckets (postgres_wal, tf_state_backups) stay private via default-deny — no bucket policy = 403.

File Targets

terraform/main.tf — add public funnel annotation to MinIO API ingress, add minio_iam_policy or mc policy for assets bucket
terraform/main.tf — MinIO bucket policy resource for assets (public-read)

Files the agent should NOT touch:

postgres_wal bucket config — must remain private
tf_state_backups bucket config — must remain private

Acceptance Criteria

assets bucket has anonymous GET (public-read) policy
postgres_wal and tf_state_backups return 403 for anonymous requests
MinIO API is accessible via public Tailscale funnel
https://minio-api.tail5b443a.ts.net/assets/westside/jerseys/IMG_4164.jpeg loads from any browser (not on tailnet)
https://minio-api.tail5b443a.ts.net/postgres_wal/ returns 403 from any browser

Test Expectations

curl https://minio-api.tail5b443a.ts.net/assets/westside/branding/logo.jpeg -o /dev/null -w '%{http_code}' returns 200 from non-tailnet
curl https://minio-api.tail5b443a.ts.net/postgres_wal/ -o /dev/null -w '%{http_code}' returns 403
Run command: tofu plan -lock=false

Constraints

Only assets bucket gets public-read. Other buckets must remain private.
Must use bucket policy, not global anonymous access
tofu fmt && tofu validate before push

Checklist

PR opened
Tests pass
No unrelated changes

pal-e-platform — project
Blocks jersey email images for Westside Queens

### Type Feature ### Lineage `plan-pal-e-platform` → discovered scope (jersey email images unreachable) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want the MinIO `assets` bucket to be publicly readable So that images in HTML emails and public pages render correctly from any network ### Context MinIO API (`minio-api.tail5b443a.ts.net`) is Tailscale-internal only. Images referenced in HTML emails (sent via Gmail API) show as broken/question marks because Gmail servers can't reach Tailscale URLs. The westside-app logo in the nav bar has the same problem in emails. Enterprise fix: S3 bucket policy makes `assets` publicly readable, public Tailscale funnel exposes the API. Other buckets (`postgres_wal`, `tf_state_backups`) stay private via default-deny — no bucket policy = 403. ### File Targets - `terraform/main.tf` — add public funnel annotation to MinIO API ingress, add `minio_iam_policy` or `mc policy` for assets bucket - `terraform/main.tf` — MinIO bucket policy resource for `assets` (public-read) Files the agent should NOT touch: - `postgres_wal` bucket config — must remain private - `tf_state_backups` bucket config — must remain private ### Acceptance Criteria - [ ] `assets` bucket has anonymous GET (public-read) policy - [ ] `postgres_wal` and `tf_state_backups` return 403 for anonymous requests - [ ] MinIO API is accessible via public Tailscale funnel - [ ] `https://minio-api.tail5b443a.ts.net/assets/westside/jerseys/IMG_4164.jpeg` loads from any browser (not on tailnet) - [ ] `https://minio-api.tail5b443a.ts.net/postgres_wal/` returns 403 from any browser ### Test Expectations - [ ] `curl https://minio-api.tail5b443a.ts.net/assets/westside/branding/logo.jpeg -o /dev/null -w '%{http_code}'` returns 200 from non-tailnet - [ ] `curl https://minio-api.tail5b443a.ts.net/postgres_wal/ -o /dev/null -w '%{http_code}'` returns 403 - Run command: `tofu plan -lock=false` ### Constraints - Only `assets` bucket gets public-read. Other buckets must remain private. - Must use bucket policy, not global anonymous access - `tofu fmt && tofu validate` before push ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `pal-e-platform` — project - Blocks jersey email images for Westside Queens