feat: manage uploaded image retention

deploy/nginx/templates/default.conf.template

@@ -82,6 +82,32 @@ http {
     }
 
     location ^~ /v1/admin/ { return 404; }
+
+    location = /admin {
+        proxy_pass http://image-hook:8081/admin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location ^~ /admin/ {
+        client_max_body_size 8k;
+        proxy_pass http://image-hook:8081;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_request_buffering on;
+    }
+
+    location = /v1/internal/content-access {
+        internal;
+        proxy_pass http://image-hook:8081/v1/internal/content-access;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Image-Path $request_uri;
+        access_log off;
+    }
+
     location = /image { return 404; }
     location = /image/ { return 404; }
     location ^~ /image/ { rewrite ^/image/(.*)$ /$1 last; }
@@ -105,6 +131,8 @@ http {
 
     location ~ "^/uploads/([a-z0-9][a-z0-9_-]{1,31})/([a-f0-9]{32}\.(?:avif|webp|jpe?g|png|gif))$" {
         alias /srv/uploads/content/$1/$2;
+        mirror /v1/internal/content-access;
+        mirror_request_body off;
         etag on;
         expires 1y;
         add_header Cache-Control "public, immutable" always;

deploy/scripts/init-secrets.sh

@@ -4,13 +4,14 @@ set -eu
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 repository_dir=$(CDPATH= cd -- "$script_dir/../.." && pwd)
 secret_dir="$repository_dir/secrets"
-state_dir="$repository_dir/runtime-data"
+state_dir=${IMAGE_RUNTIME_PATH:-$repository_dir/runtime-data}
+upload_dir=${IMAGE_UPLOAD_PATH:-$state_dir/uploads}
 
 umask 077
 mkdir -p "$secret_dir"
 mkdir -p "$state_dir"
-mkdir -p "$state_dir/uploads"
-for name in gitea_webhook_secret image_admin_secret image_sync_core_secret image_sync_core2026_secret image_upload_core_secret image_upload_core2026_secret; do
+mkdir -p "$upload_dir"
+for name in gitea_webhook_secret image_admin_secret image_admin_panel_password image_admin_panel_session_secret image_sync_core_secret image_sync_core2026_secret image_upload_core_secret image_upload_core2026_secret; do
     path="$secret_dir/$name"
     if [ ! -e "$path" ]; then
         openssl rand -hex 32 > "$path"
@@ -18,6 +19,6 @@ for name in gitea_webhook_secret image_admin_secret image_sync_core_secret image
     chmod 600 "$path"
 done
 chmod 700 "$state_dir"
-chmod 755 "$state_dir/uploads"
+chmod 755 "$upload_dir"
 
 echo "Secret files are ready in $secret_dir (values not printed)."