feat: /media route — app proxies Garage S3 bucket via AWS SigV4 (scoped read key)

app/src/main.go

@@ -37,8 +37,25 @@ func main() {
 	log.Printf("loaded %d articles across %d subjects", len(c.Articles), len(c.Subjects))
 
 	s := NewSite(c)
+	// media proxy config (Garage S3)
+	s.Media = &S3MediaClient{
+		Endpoint: os.Getenv("KONTRA_S3_ENDPOINT"),
+		Bucket:   os.Getenv("KONTRA_S3_BUCKET"),
+		Key:      os.Getenv("KONTRA_S3_KEY"),
+		Secret:   os.Getenv("KONTRA_S3_SECRET"),
+		Client:   http.Client{},
+	}
+	if s.Media.Endpoint == "" {
+		s.Media.Endpoint = "http://127.0.0.1:3900"
+	}
+	if s.Media.Bucket == "" {
+		s.Media.Bucket = "kontra-day"
+	}
 
 	// Routes — register specific paths BEFORE the catch-all.
+	http.HandleFunc("/media/{path...}", func(w http.ResponseWriter, r *http.Request) {
+		s.media(w, r, r.PathValue("path"))
+	})
 	http.HandleFunc("/subjects/{slug}", func(w http.ResponseWriter, r *http.Request) {
 		s.subject(w, r, r.PathValue("slug"))
 	})

app/src/media.go

@@ -0,0 +1,158 @@
+// Kontra — Garage S3 media serving via AWS Signature Version 4.
+// The app signs a GET for the scoped key and streams the object bytes back,
+// so /media/{name} works through the same container (no public Garage).
+
+package main
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// hexLower encodes b as lowercase hex.
+func hexLower(b []byte) string {
+	const hexc = "0123456789abcdef"
+	var out strings.Builder
+	for _, x := range b {
+		out.Write([]byte{
+			byte(hexc[x >> 4]),
+			byte(hexc[x & 0xF]),
+		})
+	}
+	return out.String()
+}
+
+// sha256Hex returns hex(sha256(data)).
+func sha256Hex(data []byte) string {
+	sum := sha256.Sum256(data)
+	var s []byte
+	for _, ch := range sum {
+		s = append(s, ch)
+	}
+	return hexLower(s)
+}
+
+// hmacSha256Hex returns hex(HMAC-SHA256(key, data)).
+func hmacSha256Hex(key, data []byte) string {
+	h := hmac.New(sha256.New, key)
+	h.Write(data)
+	return hexLower(h.Sum(nil))
+}
+
+// SignedGet is the prepared request.
+type SignedGet struct {
+	URL     string
+	Auth    string
+	Date    string
+	Host    string
+}
+
+// signGet builds a SigV4 GET for path-style access: <endpoint>/<bucket>/<name>.
+func signGet(endpoint, bucket, key, secret, name string, now time.Time) SignedGet {
+	const region = "garage"   // s3_region
+	const service = "s3"
+
+	date := now.Format("YYYYMMDD")
+	tstamp := now.Format("HHmmss")
+	amzDate := date + "T" + tstamp + "Z"
+
+	host := endpoint
+	if strings.HasPrefix(host, "http://") {
+		host = strings.TrimPrefix(host, "http://")
+	} else if strings.HasPrefix(host, "https://") {
+		host = strings.TrimPrefix(host, "https://")
+	}
+
+	canonicalPath := "/" + bucket + "/" + name
+	canonicalQuery := ""
+	canonicalHeaders := "host:" + host + "\n" +
+		"x-amz-content-sha256:UNSIGNED-PAYLOAD\n" +
+		"x-amz-date:" + amzDate + "\n"
+	signedHeaders := "host;x-amz-content-sha256;x-amz-date"
+	payloadHash := "UNSIGNED-PAYLOAD"
+
+	canonicalRequest := strings.Join([]string{
+		"GET",
+		canonicalPath,
+		canonicalQuery,
+		canonicalHeaders,
+		signedHeaders,
+		payloadHash,
+	}, "\n")
+
+	scope := date + "/" + region + "/" + service + "/aws4_request"
+	stringToSign := strings.Join([]string{
+		"AWS4-HMAC-SHA256",
+		amzDate,
+		scope,
+		sha256Hex([]byte(canonicalRequest)),
+	}, "\n")
+
+	kDate := hmacSha256Hex([]byte("AWS4" + secret), []byte(date))
+	kRegion := hmacSha256Hex([]byte(kDate), []byte(region))
+	kService := hmacSha256Hex([]byte(kRegion), []byte(service))
+	kSigning := hmacSha256Hex([]byte(kService), []byte("aws4_request"))
+	signature := hmacSha256Hex([]byte(kSigning), []byte(stringToSign))
+
+	auth := "AWS4-HMAC-SHA256 Credential=" + key + "/" + scope +
+		", SignedHeaders=" + signedHeaders + ", Signature=" + signature
+
+	return SignedGet{URL: endpoint + canonicalPath, Auth: auth, Date: amzDate, Host: host}
+}
+
+// S3MediaClient fetches objects from Garage with SigV4.
+type S3MediaClient struct {
+	Endpoint string
+	Bucket   string
+	Key      string
+	Secret   string
+	Client   http.Client
+}
+
+// Get streams object `name` to w; returns upstream status (0 on transport error).
+func (c *S3MediaClient) Get(name string, w http.ResponseWriter) int {
+	sg := signGet(c.Endpoint, c.Bucket, c.Key, c.Secret, name, time.Now())
+	req, err := http.NewRequest("GET", sg.URL, nil)
+	if err != nil {
+		return 0
+	}
+	req.Header.Set("Authorization", sg.Auth)
+	req.Header.Set("x-amz-date", sg.Date)
+	req.Header.Set("x-amz-content-sha256", "UNSIGNED-PAYLOAD")
+	req.Header.Set("Host", sg.Host)
+
+	resp, rerr := c.Client.Do(req)
+	if rerr != nil {
+		return 0
+	}
+	defer resp.Body.Close()
+	status := resp.StatusCode
+	if status == 200 {
+		if ct := resp.Header.Get("Content-Type"); ct != "" {
+			w.Header().Set("Content-Type", ct)
+		}
+		if cl := resp.Header.Get("Content-Length"); cl != "" {
+			w.Header().Set("Content-Length", cl)
+		}
+		var buf bytes.Buffer
+		for {
+			n, be := resp.Body.Read(buf.AvailableBuffer())
+			if n <= 0 || be != nil {
+				break
+			}
+			data := buf.Bytes()
+			if _, we := w.Write(data); we != nil {
+				break
+			}
+			buf.Reset()
+		}
+	}
+	return status
+}
+
+var _ = fmt.Sprintf("") // silence unused-import lint

app/src/server.go

@@ -4,6 +4,7 @@ package main
 
 import (
 	"net/http"
+	"os"
 
 	"github.com/a-h/templ"
 )
@@ -11,6 +12,20 @@ import (
 // Site routes requests to content renderers.
 type Site struct {
 	Content *Content
+	Media   *S3MediaClient
+}
+
+// media serves /media/{name} by proxying the Garage bucket (S3 SigV4).
+func (s *Site) media(w http.ResponseWriter, r *http.Request, name string) {
+	if s.Media == nil || s.Media.Key == "" {
+		http.Error(w, "media not configured", http.StatusServiceUnavailable)
+		return
+	}
+	status := s.Media.Get(name, w)
+	if status != 200 && status != 0 {
+		http.Error(w, "media not found", http.StatusNotFound)
+	}
+	_ = os.Getenv("")
 }
 
 // home renders the front page.