I think public: true in storage.yml should be sufficient for this in Rails 6.1, looking at the Rails service here: https://github.com/rails/rails/blob/80077d3675b9baceb0fee2a9bef8fcce9cf7080c/activestorage/lib/active_storage/service/s3_service.rb#L23

Keep in mind that if you have existing files you’re trying to access that weren’t set with the proper ACL, this will break those files until you make them have a public ACL. If you need both public and private files depending on what kind it is, you’ll need to use the new feature in 6.1 that allows multiple services to be defined and set per-attribute.

Another caveat here: I’ve discovered that since enabling this feature, direct uploads have still been marked as private by default. The problem can be resolved by the comment from astrocket in this issue: https://github.com/rails/rails/issues/39006

Essentially, you need to use a bit of code like this to add the public-read header:

const upload = new DirectUpload(file, "/rails/active_storage/direct_uploads", {
  directUploadWillStoreFileWithXHR: (xhr) => {
    xhr.setRequestHeader('x-amz-acl', 'public-read');
  }
});

You’ll also need to add this x-amz-acl header to the allowed headers in the CORS config for your Spaces instance, otherwise requests will still fail.