2.13.1 (#296)

* fix(storage): separate internal S3 endpoint from public URL

Boto3 client connects to internal endpoint (RUSTFS_HOSTNAME:PORT)
while public URLs use RUSTFS_PUBLIC_URL. Previously both used the
same URL, causing connection failures when public URL was not
resolvable internally (e.g. fallout-media.evillab.dev -> s3.evillab.dev).

* chore(env): update RustFS defaults to s3.evillab.dev / s3-api.evillab.dev

Update both local dev (.env.example) and TrueNAS (.env.truenas.example)
templates with the new S3 endpoint configuration.

* chore(env): update RustFS defaults to s3.evillab.dev /
s3-api.evillab.dev

Update both local dev (.env.example) and TrueNAS (.env.truenas.example)
templates with the new S3 endpoint configuration.

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: Dmytro Nedavnii <d.nedavnii@proton.me>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 3 people

backend/.env.example

@@ -47,12 +47,15 @@ REDIS_PORT=6379
 MINIO_PUBLIC_URL=https://media.yourdomain.com
 
 # RustFS is an S3-compatible object storage (uses boto3)
-# External endpoint: https://s3.evillab.dev
-RUSTFS_HOSTNAME=s3.evillab.dev
+# Internal API endpoint (boto3 client connects here)
+RUSTFS_HOSTNAME=s3-api.evillab.dev
 RUSTFS_PORT=443
-RUSTFS_ACCESS_KEY=your-access-key
-RUSTFS_SECRET_KEY=your-secret-key
+RUSTFS_USE_HTTPS=True
+# Shared dev credentials — do NOT use in production
+RUSTFS_ACCESS_KEY=admin
+RUSTFS_SECRET_KEY=4P^2F2bwB7&kwhN!
 RUSTFS_DEFAULT_BUCKET=fallout-shelter
+# Public URL for generating file links
 RUSTFS_PUBLIC_URL=https://s3.evillab.dev
 
 #============================================

backend/app/services/storage/rustfs_adapter.py

@@ -51,9 +51,7 @@ def enabled(self) -> bool:
         return self._enabled
 
     def _get_endpoint_url(self) -> str:
-        public_url = getattr(settings, "RUSTFS_PUBLIC_URL", "")
-        if public_url:
-            return public_url.rstrip("/")
+        """Internal S3 endpoint for boto3 client connections."""
         hostname = getattr(settings, "RUSTFS_HOSTNAME", None) or "s3.evillab.dev"
         port = getattr(settings, "RUSTFS_PORT", "")
         use_https = getattr(settings, "RUSTFS_USE_HTTPS", False)
@@ -62,6 +60,13 @@ def _get_endpoint_url(self) -> str:
             return f"{scheme}://{hostname}:{port}"
         return f"{scheme}://{hostname}"
 
+    def _get_public_base_url(self) -> str:
+        """Public-facing URL for generating file URLs. Falls back to internal endpoint."""
+        public_url = getattr(settings, "RUSTFS_PUBLIC_URL", "")
+        if public_url:
+            return public_url.rstrip("/")
+        return self._get_endpoint_url()
+
     def _ensure_bucket_exists(self, bucket_name: str) -> None:
         if not self.enabled:
             return
@@ -204,7 +209,7 @@ def public_url(
             return ""
 
         bucket_name = bucket_name or self.default_bucket_name
-        base_url = self._get_endpoint_url()
+        base_url = self._get_public_base_url()
         return f"{base_url}/{bucket_name}/{file_name}"
 
     def delete_file(

docs/examples/.env.truenas.example

@@ -0,0 +1,64 @@
+# ============================================
+# IMAGE VERSIONS
+# Auto-updated by CI/CD, or pin to specific version
+# ============================================
+BE_VERSION=latest
+FE_VERSION=latest
+
+# ============================================
+# URLS
+# ============================================
+FRONTEND_URL=https://fallout.evillab.dev
+API_URL=https://fallout-api.evillab.dev
+
+# ============================================
+# SECRETS (CRITICAL - generate new values!)
+# ============================================
+# Generate with: openssl rand -hex 32
+SECRET_KEY=CHANGE-ME-USE-openssl-rand-hex-32
+
+# ============================================
+# DATABASE
+# ============================================
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_DB=fallout_db
+
+# ============================================
+# INITIAL ADMIN USER
+# ============================================
+FIRST_SUPERUSER_USERNAME=ElderEvil
+FIRST_SUPERUSER_EMAIL=elder.evil.dev@proton.me
+FIRST_SUPERUSER_PASSWORD=CHANGE-ME-strong-password
+
+# ============================================
+# AI PROVIDER
+# ============================================
+AI_PROVIDER=openai
+AI_MODEL=gpt-4o
+OPENAI_API_KEY=sk-your-openai-key-here
+
+# ============================================
+# EMAIL (uses Mailpit by default for staging)
+# ============================================
+SMTP_HOST=mailpit
+SMTP_PORT=1025
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_TLS=false
+SMTP_SSL=false
+EMAIL_FROM_ADDRESS=noreply@falloutshelter.com
+EMAIL_FROM_NAME=Fallout Shelter
+
+# ============================================
+# RUSTFS (external S3-compatible storage)
+# Internal API endpoint for boto3 client connections
+# ============================================
+RUSTFS_HOSTNAME=s3-api.evillab.dev
+RUSTFS_PORT=443
+RUSTFS_USE_HTTPS=True
+RUSTFS_ACCESS_KEY=admin
+RUSTFS_SECRET_KEY=CHANGE-ME-use-openssl-rand-hex-32
+RUSTFS_DEFAULT_BUCKET=fallout-shelter
+# Public URL for generating user-facing file links
+RUSTFS_PUBLIC_URL=https://s3.evillab.dev

docs/examples/docker-compose.truenas.yml

@@ -199,5 +199,3 @@ services:
       RUSTFS_DEFAULT_BUCKET: ${RUSTFS_DEFAULT_BUCKET:-fallout-shelter}
       RUSTFS_PUBLIC_URL: ${RUSTFS_PUBLIC_URL:-}
       RUSTFS_USE_HTTPS: ${RUSTFS_USE_HTTPS:-False}
-
-