Add support for proxying S3 media files through a custom path (#2863)

Similar to how custom paths are set for filesystem uploads, the `Custom public URL` field in S3 settings now accepts a `/relative/path`, which is then handled by listmonk, proxying files from S3 via it. This allows for S3 or S3-like backends to be not visible to the internet.

Co-authored-by: Kailash Nadh <kailash@nadh.in>

Author: Bogay

cmd/init.go

@@ -722,6 +722,7 @@ func initMediaStore(ko *koanf.Koanf) media.Store {
 	case "s3":
 		var o s3.Opt
 		ko.Unmarshal("upload.s3", &o)
+		o.RootURL = ko.String("app.root_url")
 
 		up, err := s3.NewS3Store(o)
 		if err != nil {
@@ -912,8 +913,16 @@ func initHTTPServer(cfg *Config, urlCfg *UrlConfig, i *i18n.I18n, fs stuffbin.Fi
 	srv.GET("/admin/static/*", echo.WrapHandler(fSrv))
 
 	// Public (subscriber) facing media upload files.
-	if ko.String("upload.provider") == "filesystem" && ko.String("upload.filesystem.upload_uri") != "" {
-		srv.Static(ko.String("upload.filesystem.upload_uri"), ko.String("upload.filesystem.upload_path"))
+	var (
+		uploadProvider = ko.String("upload.provider")
+		uploadFsURI    = ko.String("upload.filesystem.upload_uri")
+		publicURL      = ko.String("upload.s3.public_url")
+	)
+	switch {
+	case uploadProvider == "filesystem" && uploadFsURI != "":
+		srv.Static(uploadFsURI, ko.String("upload.filesystem.upload_path"))
+	case uploadProvider == "s3" && strings.HasPrefix(publicURL, "/"):
+		srv.GET(path.Join(publicURL, "/:filepath"), app.ServeS3Media)
 	}
 
 	// Register all HTTP handlers.

cmd/media.go

@@ -191,6 +191,22 @@ func (a *App) DeleteMedia(c echo.Context) error {
 	return c.JSON(http.StatusOK, okResp{true})
 }
 
+// ServeS3Media serves media files stored in S3 when the public URL is a relative path.
+func (a *App) ServeS3Media(c echo.Context) error {
+	key := c.Param("filepath")
+	if key == "" {
+		return echo.NewHTTPError(http.StatusBadRequest, "missing media file path")
+	}
+
+	b, err := a.media.GetBlob(key)
+	if err != nil {
+		a.log.Printf("error fetching media from s3 %s: %v", key, err)
+		return echo.NewHTTPError(http.StatusInternalServerError, "error fetching media")
+	}
+
+	return c.Stream(http.StatusOK, http.DetectContentType(b), bytes.NewReader(b))
+}
+
 // processImage reads the image file and returns thumbnail bytes and
 // the original image's width, and height.
 func processImage(file *multipart.FileHeader) (*bytes.Reader, int, int, error) {

frontend/src/views/settings/media.vue

@@ -102,10 +102,10 @@
               placeholder="https://s3.$region.amazonaws.com" :maxlength="200" expanded type="url"
               pattern="https?://.*" />
           </b-field>
-          <b-field :label="$t('settings.media.s3.publicURL')" label-position="on-border" expanded>
-            <b-input v-model="data['upload.s3.public_url']" :message="$t('settings.media.s3.publicURLHelp')"
-              name="upload.s3.public_url" placeholder="https://files.yourdomain.com" :maxlength="200" type="url"
-              pattern="https?://.*" />
+          <b-field :label="$t('settings.media.s3.publicURL')" label-position="on-border" :message="$t('settings.media.s3.publicURLHelp')" expanded>
+            <b-input v-model="data['upload.s3.public_url']"
+              name="upload.s3.public_url" placeholder="https://files.yourdomain.com" :maxlength="200" type="string"
+              pattern="(https?://.*|/.+)" />
           </b-field>
         </div>
       </div>

i18n/en.json

@@ -466,8 +466,8 @@
     "settings.media.s3.bucketTypePrivate": "Private",
     "settings.media.s3.bucketTypePublic": "Public",
     "settings.media.s3.key": "AWS access key",
-    "settings.media.s3.publicURL": "Custom public URL (optional)",
-    "settings.media.s3.publicURLHelp": "Custom S3 domain to use for image links instead of the default S3 backend URL.",
+    "settings.media.s3.publicURL": "Custom public URL or path (optional)",
+    "settings.media.s3.publicURLHelp": "Custom URL (https://cdn.example.com) to use for image links, or a path starting with / (e.g., /uploads) to proxy files through listmonk.",
     "settings.media.s3.region": "Region",
     "settings.media.s3.secret": "AWS access secret",
     "settings.media.s3.uploadExpiry": "Upload expiry",

internal/media/providers/s3/s3.go

@@ -23,6 +23,7 @@ type Opt struct {
 	BucketPath string        `koanf:"bucket_path"`
 	BucketType string        `koanf:"bucket_type"`
 	Expiry     time.Duration `koanf:"expiry"`
+	RootURL    string        `koanf:"root_url"`
 }
 
 // Client implements `media.Store` for S3 provider
@@ -159,7 +160,11 @@ func (c *Client) makeBucketPath(name string) string {
 
 func (c *Client) makeFileURL(name string) string {
 	if c.opts.PublicURL != "" {
-		return c.opts.PublicURL + "/" + c.makeBucketPath(name)
+		prefix := c.opts.PublicURL
+		if strings.HasPrefix(prefix, "/") {
+			prefix = c.opts.RootURL + prefix
+		}
+		return prefix + "/" + c.makeBucketPath(name)
 	}
 
 	return c.opts.URL + "/" + c.opts.Bucket + "/" + c.makeBucketPath(name)