Backends
The backend is selected by the
STORAGE_TYPE environment variable.
Configuration
Local:STORAGE_LOCAL_PATH— filesystem directory (defaultpublic/uploads).STORAGE_LOCAL_URL— public URL prefix (default/uploads).
S3_BUCKET_NAME— the bucket.AWS_REGION— the region.AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY— credentials (optional; an IAM role is used if omitted).S3_ENDPOINT— custom endpoint for S3-compatible providers (e.g. Scaleway).
Access via signed URLs
Files are stored privately. The app serves them through pre-signed URLs generated on read, with a default expiry of one hour. Local storage returns direct URLs (no expiry). A fresh signature is produced each time, so signed URLs are not cached.Object keys are organized per organization, keeping each tenant’s files separated. The
storage layer is plain file I/O; any image processing happens upstream in the
upload handlers.

