Question

How to make Rails uploads to a Digital Ocean bucket to be public by default?

Posted August 4, 2020 1.1k views
Ruby on Rails

Hi there,

I can upload files from Rails 6 using Active Storage direct upload to a Digital Ocean Spaces bucket, but even when in my app’s storage.yml file I am including a public-read ACL for uploads, when I check the files in the bucket, their permissions are set to private, not public.

Here’s my storage.yml file from the Rails app:

digitalocean:
   service: S3
   access_key_id: <%= Credential.digitalocean_access_key_id %>
   secret_access_key: <%= Credential.digitalocean_secret_access_key %>
   endpoint: https://sfo2.digitaloceanspaces.com
   region: sfo2
   bucket: mybucket
   upload:
     acl: "public-read"   

As you can see I do specify a “public-read” upload ACL for Active Storage. The files do upload fine but the file permission is set to private.

Any hints on this, please?

Any help is appreciated, thank you!

2 comments

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
2 answers

I think public: true in storage.yml should be sufficient for this in Rails 6.1, looking at the Rails service here: https://github.com/rails/rails/blob/80077d3675b9baceb0fee2a9bef8fcce9cf7080c/activestorage/lib/active_storage/service/s3_service.rb#L23

Keep in mind that if you have existing files you’re trying to access that weren’t set with the proper ACL, this will break those files until you make them have a public ACL. If you need both public and private files depending on what kind it is, you’ll need to use the new feature in 6.1 that allows multiple services to be defined and set per-attribute.

Another caveat here: I’ve discovered that since enabling this feature, direct uploads have still been marked as private by default. The problem can be resolved by the comment from astrocket in this issue: https://github.com/rails/rails/issues/39006

Essentially, you need to use a bit of code like this to add the public-read header:

const upload = new DirectUpload(file, "/rails/active_storage/direct_uploads", {
  directUploadWillStoreFileWithXHR: (xhr) => {
    xhr.setRequestHeader('x-amz-acl', 'public-read');
  }
});

You’ll also need to add this x-amz-acl header to the allowed headers in the CORS config for your Spaces instance, otherwise requests will still fail.

  • @connorshea are you able to expand on how one might do this when using ActionText? Right now it works out of the box with S3 but I don’t see how it could be extended to add another request header unless this is baked into Rails/ActionText?

    • I’m not familiar with ActionText, unfortunately, so I can’t really say. I’d assume it’s baked in and you’d need to get the upstream to make it configurable.