fix: separate public object store TLS

internal/config/config.go

@@ -86,6 +86,7 @@ type Config struct {
 	ObjectStoreBucket        string
 	ObjectStoreRegion        string
 	ObjectStoreSecure        bool
+	ObjectStorePublicSecure  bool
 	ExportDownloadTTL        time.Duration
 	ExportObjectTTL          time.Duration
 	MediaLocalDeleteGrace    time.Duration
@@ -195,6 +196,10 @@ func Load(serviceName string) (Config, error) {
 	if err != nil {
 		return Config{}, err
 	}
+	objectStorePublicSecure, err := boolEnv("OBJECT_STORE_PUBLIC_SECURE", objectStoreSecure)
+	if err != nil {
+		return Config{}, err
+	}
 	environment := stringEnv("APP_ENV", EnvironmentLocal)
 	secretValues, err := loadSecretValues(
 		"DATABASE_URL", "REDIS_PASSWORD", "DEVICE_LOCAL_SECRET", "RTC_APP_KEY", "RTC_TOKEN_SIGNING_SECRET",
@@ -304,6 +309,7 @@ func Load(serviceName string) (Config, error) {
 		ObjectStoreBucket:       objectStoreBucket,
 		ObjectStoreRegion:       objectStoreRegion,
 		ObjectStoreSecure:       objectStoreSecure,
+		ObjectStorePublicSecure: objectStorePublicSecure,
 		ExportDownloadTTL:       exportDownloadTTL,
 		ExportObjectTTL:         exportObjectTTL,
 		MediaLocalDeleteGrace:   mediaLocalDeleteGrace,
@@ -590,7 +596,7 @@ func (c Config) validateProduction() error {
 		}
 	}
 	if c.ServiceName == "api" || c.ServiceName == "worker" {
-		if !c.ObjectStoreSecure {
+		if !c.ObjectStoreSecure || !c.ObjectStorePublicSecure {
 			return errors.New("production object storage must use TLS")
 		}
 		if isLocalValue(c.ObjectStoreEndpoint) || isLocalValue(c.ObjectStorePublic) {

internal/config/config_test.go

@@ -118,6 +118,7 @@ func TestProductionAPIAcceptsHardenedConfiguration(t *testing.T) {
 	cfg.ObjectStoreAccessKey = strings.Repeat("a", 40)
 	cfg.ObjectStoreSecretKey = strings.Repeat("s", 40)
 	cfg.ObjectStoreSecure = true
+	cfg.ObjectStorePublicSecure = true
 	cfg.EmbeddingProvider = "ark"
 	cfg.ArkBaseURL = "https://ark.cn-beijing.volces.com/api/v3"
 	cfg.ArkAPIKey = strings.Repeat("k", 40)
@@ -150,6 +151,7 @@ func TestProductionRejectsReusedSigningSecrets(t *testing.T) {
 	cfg.ObjectStoreAccessKey = strings.Repeat("a", 40)
 	cfg.ObjectStoreSecretKey = strings.Repeat("s", 40)
 	cfg.ObjectStoreSecure = true
+	cfg.ObjectStorePublicSecure = true
 	cfg.EmbeddingProvider = "ark"
 	cfg.ArkBaseURL = "https://ark.cn-beijing.volces.com/api/v3"
 	cfg.ArkAPIKey = strings.Repeat("k", 40)
@@ -182,6 +184,7 @@ func TestProductionWorkerRequiresRealArkContentGenerator(t *testing.T) {
 	cfg.ObjectStoreAccessKey = strings.Repeat("a", 40)
 	cfg.ObjectStoreSecretKey = strings.Repeat("s", 40)
 	cfg.ObjectStoreSecure = true
+	cfg.ObjectStorePublicSecure = true
 	if err = cfg.Validate(); err == nil || !strings.Contains(err.Error(), "content generation") {
 		t.Fatalf("Validate() error=%v, want local content generator production gate", err)
 	}