Storage

storage-server. Browsers upload directly; clc-core never sees the bytes. Auth is an Ed25519 signature whose public key matches CORE_API__PRIVATE_KEY.

Staging: https://gnosis-storage.cosmolocal.credit

CDN: https://cdn.cosmolocal.credit (R2 bucket clc).

STORAGE_API__ADDRESS=:5003
STORAGE_API__MAX_BODY_SIZE=8          # MB
STORAGE_API__UPLOAD_TIMEOUT=60s
STORAGE_API__CDN_BASE_URL=https://cdn.cosmolocal.credit
STORAGE_API__ALLOWED_FOLDERS=voucher,profile,pool,report,offering
STORAGE_AUTH__PUBLIC_KEY=<PEM matching CORE_API__PRIVATE_KEY>
STORAGE_AUTH__CLOCK_SKEW=30s

Generate the pair once:

openssl genpkey -algorithm ED25519 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem
awk '{printf "%s\\n", $0}' private.pem   # CORE_API__PRIVATE_KEY
awk '{printf "%s\\n", $0}' public.pem    # STORAGE_AUTH__PUBLIC_KEY

clc-core mints a short-lived storage token: POST /auth/storage-token (authenticated). The app puts that on the upload request.

Allowed image widths: 400,800,1280. Method 6, quality 82, max 12.5 MP.