GozWire

Guides

Storage

Media is uploaded to S3-compatible object storage. GozWire stores object keys, never bytes, in the messaging path.

Media does not travel through the messaging API on the hot path.

  1. media.createUpload validates MIME, size, and a sanitized display fileName, then returns a presigned PUT URL plus sessionId.
  2. The client uploads directly to MinIO, R2, or S3.
  3. messages.send with attachmentSessionIds HEADs the object, promotes it to an immutable key, and stores the object key plus filename metadata.

Do not put binaries in Redis. Do not put image bytes in the messaging request body after upload authorization.

Inline download URLs are issued only after the message is visible to the actor. Use referrerpolicy="no-referrer". Do not render types outside allowedMimeTypes. SVG is not allowed.

Audio and video skip moderation. Text and images do not, when moderation is enabled.

Profile pictures use identities.createProfileUpload / finalizeProfilePicture. The engine HEADs the staging object, bounds decoded pixels, strips metadata, and writes versioned WebP and JPEG keys.

To use Cloudflare R2, set the S3-compatible endpoint, bucket, keys, S3_PUBLIC_ENDPOINT for the browser, and S3_INTERNAL_ENDPOINT for the API and sidecar.