S3 with non-public, pre-signed URLs?

[RickyRomero]

Hi! Does Lychee support loading media from S3 if the bucket isn't open for public access? I'm using Wasabi as my bucket provider. They heavily discourage using public buckets.

I've tinkered with this a bit... When I upload a photo to Lychee, it processes the photo and pushes the different scaled assets to my Wasabi bucket. But when I try to view the photo in Lychee, it tries to load the assets as if they were public (without pre-signing the URLs.)

Just wondering if there's a config flag I missed for this. 🙂

[ildyria]

Looking at the code:
https://github.com/LycheeOrg/Lychee/blob/master/app/Models/Extensions/HasUrlGenerator.php#L73
This redirects us to:
https://github.com/LycheeOrg/Lychee/blob/master/config/filesystems.php#L104
So I would say try with AWS_IMAGE_VISIBILITY (though zero guarantees). Hopefully it should work.

[RickyRomero]

@ildyria Thanks for the pointers... I checked my config and AWS_IMAGE_VISIBILITY is indeed set to private.

I did some debugging and it looks like there's a problem in pathToUrl() that's preventing this from working:

Lychee/app/Models/Extensions/HasUrlGenerator.php

Lines 47 to 53 in 98dbddf

	if (
	!Configs::getValueAsBool('SL_enable') ||
	(!Configs::getValueAsBool('SL_for_admin') && Auth::user()?->may_administrate === true)
	) {
	/** @disregard P1013 */
	return $image_disk->url($short_path);
	}

This condition is always evaluating true, so the pre-signed S3 URL is never returned; only the public-style S3 URL. Swapping the if statements provides the correct pre-signed URL and the asset loads, however I don't know what the broader implications of such a change would be.

[ildyria]

hummm that is weird.
Even if you were to use the docker, we should inject it.
https://github.com/LycheeOrg/Lychee-Docker/blob/master/inject.sh#L310

[RickyRomero]

@ildyria I think the environment variable is set and read by Lychee correctly? It's just that the condition I quoted above is returning from pathToUrl() early, making it impossible to get to the condition below it that returns the pre-signed URL.

[ildyria]

Haaa good spot! Indeed you may need to toggle both in your lychee configs first in the Symbolic Link section.

[RickyRomero]

Okay, yep:

1. Go to Admin > Settings
2. Open All Settings
3. Turn on "Enable symbolic link protection"
4. Turn on "Enable symbolic links on logged in admin user"

This lets me serve pre-signed URLs from S3. I'm not sure what the relationship is between this and pre-signed S3 URLs, but it's working. Thanks!

[RickyRomero]

Swapping the if statements provides the correct pre-signed URL and the asset loads, however I don't know what the broader implications of such a change would be.

@ildyria I researched the history of the symlink setting. Swapping the if statements should fix the issue and not cause side-effects, so I opened a PR: #3147.