feat: add configurable secure option for S3 storage

Allows disabling TLS for S3-compatible endpoints (e.g. local MinIO).
Defaults to true when not specified.

Author: DeltaLaboratory

internal/config/storage/s3.go

@@ -9,6 +9,7 @@ type S3Storage struct {
 	Region *string `hcl:"region"`
 
 	Prefix *string `hcl:"prefix"`
+	Secure *bool   `hcl:"secure"`
 
 	// Retention settings
 	RetentionPeriod *string `hcl:"retention_period"`
@@ -22,3 +23,11 @@ func (s *S3Storage) GetRegion() string {
 
 	return *s.Region
 }
+
+func (s *S3Storage) IsSecure() bool {
+	if s.Secure == nil {
+		return true
+	}
+
+	return *s.Secure
+}

internal/storage/s3/upload.go

@@ -26,7 +26,7 @@ func Upload(ctx context.Context, reader io.Reader) error {
 	client, err := minio.New(config.Loaded.Storage.S3.Endpoint, &minio.Options{
 		Creds:  credentials.NewStaticV4(config.Loaded.Storage.S3.AccessKey, config.Loaded.Storage.S3.SecretKey, ""),
 		Region: config.Loaded.Storage.S3.GetRegion(),
-		Secure: true,
+		Secure: config.Loaded.Storage.S3.IsSecure(),
 	})
 
 	if err != nil {
@@ -170,7 +170,7 @@ func CleanupRetention(ctx context.Context) error {
 	client, err := minio.New(config.Loaded.Storage.S3.Endpoint, &minio.Options{
 		Creds:  credentials.NewStaticV4(config.Loaded.Storage.S3.AccessKey, config.Loaded.Storage.S3.SecretKey, ""),
 		Region: config.Loaded.Storage.S3.GetRegion(),
-		Secure: true,
+		Secure: config.Loaded.Storage.S3.IsSecure(),
 	})
 	if err != nil {
 		return fmt.Errorf("failed to create S3 client: %w", err)
@@ -249,7 +249,7 @@ func CreateClient() (*minio.Client, error) {
 	client, err := minio.New(config.Loaded.Storage.S3.Endpoint, &minio.Options{
 		Creds:  credentials.NewStaticV4(config.Loaded.Storage.S3.AccessKey, config.Loaded.Storage.S3.SecretKey, ""),
 		Region: config.Loaded.Storage.S3.GetRegion(),
-		Secure: true,
+		Secure: config.Loaded.Storage.S3.IsSecure(),
 	})
 
 	if err != nil {