fix: make media uploads work behind docker

- add S3_PUBLIC_ENDPOINT_URL for browser-reachable presigned urls

- support both public/internal file url validation

- configure MinIO bucket CORS in minio-init

- update env examples and docs

docker-compose.yml

@@ -13,6 +13,7 @@ x-app-env: &app-env
   POSTGRES_DSN: postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-messenger}
   REDIS_URL: redis://redis:6379/0
   S3_ENDPOINT_URL: http://minio:9000
+  S3_PUBLIC_ENDPOINT_URL: ${S3_PUBLIC_ENDPOINT_URL:-http://localhost:${MINIO_API_PORT:-9000}}
   S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
   S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
   S3_REGION: ${S3_REGION:-us-east-1}
@@ -88,7 +89,19 @@ services:
     entrypoint: >
       /bin/sh -c "
       mc alias set local http://minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin} &&
-      mc mb --ignore-existing local/${S3_BUCKET_NAME:-messenger-media}
+      mc mb --ignore-existing local/${S3_BUCKET_NAME:-messenger-media} &&
+      cat > /tmp/cors-rules.json <<EOF &&
+      [
+        {
+          \"AllowedHeaders\": [\"*\"],
+          \"AllowedMethods\": [\"GET\", \"PUT\", \"POST\", \"HEAD\"],
+          \"AllowedOrigins\": [\"${S3_CORS_ALLOW_ORIGIN:-*}\"],
+          \"ExposeHeaders\": [\"ETag\"],
+          \"MaxAgeSeconds\": 3600
+        }
+      ]
+      EOF
+      mc cors set local/${S3_BUCKET_NAME:-messenger-media} /tmp/cors-rules.json
       "
     restart: "no"