fix: separate public object store TLS

internal/config/config.go

@@ -86,6 +86,7 @@ type Config struct {
 	ObjectStoreBucket        string
 	ObjectStoreRegion        string
 	ObjectStoreSecure        bool
+	ObjectStorePublicSecure  bool
 	ExportDownloadTTL        time.Duration
 	ExportObjectTTL          time.Duration
 	MediaLocalDeleteGrace    time.Duration
@@ -195,6 +196,10 @@ func Load(serviceName string) (Config, error) {
 	if err != nil {
 		return Config{}, err
 	}
+	objectStorePublicSecure, err := boolEnv("OBJECT_STORE_PUBLIC_SECURE", objectStoreSecure)
+	if err != nil {
+		return Config{}, err
+	}
 	environment := stringEnv("APP_ENV", EnvironmentLocal)
 	secretValues, err := loadSecretValues(
 		"DATABASE_URL", "REDIS_PASSWORD", "DEVICE_LOCAL_SECRET", "RTC_APP_KEY", "RTC_TOKEN_SIGNING_SECRET",
@@ -304,6 +309,7 @@ func Load(serviceName string) (Config, error) {
 		ObjectStoreBucket:       objectStoreBucket,
 		ObjectStoreRegion:       objectStoreRegion,
 		ObjectStoreSecure:       objectStoreSecure,
+		ObjectStorePublicSecure: objectStorePublicSecure,
 		ExportDownloadTTL:       exportDownloadTTL,
 		ExportObjectTTL:         exportObjectTTL,
 		MediaLocalDeleteGrace:   mediaLocalDeleteGrace,
@@ -590,7 +596,7 @@ func (c Config) validateProduction() error {
 		}
 	}
 	if c.ServiceName == "api" || c.ServiceName == "worker" {
-		if !c.ObjectStoreSecure {
+		if !c.ObjectStoreSecure || !c.ObjectStorePublicSecure {
 			return errors.New("production object storage must use TLS")
 		}
 		if isLocalValue(c.ObjectStoreEndpoint) || isLocalValue(c.ObjectStorePublic) {