Skip to main content

Google Cloud Storage Setup

Google Cloud Storage is optional. Without it, Multiforum keeps image and file upload capabilities disabled and shows setup guidance instead of failing.

Configure storage only if the instance needs uploaded images or downloadable files.

Buckets​

Create:

  • a bucket for public images/uploads (GCS_BUCKET_NAME); and
  • optionally, a private download bucket (GCS_PRIVATE_DOWNLOAD_BUCKET_NAME).

Choose globally unique names, an appropriate region, uniform or fine-grained access controls that match your policy, and lifecycle/versioning settings that support recovery.

Service account​

Create a dedicated service account with only the bucket permissions Multiforum needs. Avoid broad project-level Storage Admin access when bucket-scoped roles are sufficient.

Download its JSON credentials and encode the complete file as one base64 value:

base64 < service-account.json | tr -d '\n'

On macOS, base64 -i service-account.json | tr -d '\n' is also available.

CORS​

Allow browser uploads from the forum's HTTPS origin. A minimal starting policy is:

[
  {
    "origin": ["https://forum.example.com"],
    "method": ["GET", "PUT", "POST"],
    "responseHeader": ["Content-Type"],
    "maxAgeSeconds": 3600
  }
]

Apply it with the current Google Cloud CLI:

gcloud storage buckets update \
  gs://YOUR_BUCKET \
  --cors-file=cors.json

Production environment​

Add the values to .env.production:

GCS_BUCKET_NAME=your-public-upload-bucket
GCS_PRIVATE_DOWNLOAD_BUCKET_NAME=your-private-download-bucket
GOOGLE_CREDENTIALS_BASE64=your-single-line-base64-json

The production overlay supplies the public bucket name to the frontend at runtime; a separate VITE_* build variable is not required.

Restart affected services and review Admin → Instance Setup. Uploads should show configured only when the bucket and credentials are present.

Recovery and security​

  • Keep credentials out of Git, images, Terraform state, logs, and screenshots.
  • Restrict service-account permissions and rotate keys.
  • Configure bucket retention, versioning, or replication separately; the repository's Neo4j backup command does not copy GCS objects.
  • Test object recovery as part of the disaster-recovery drill.

See Image Hosting for channel permissions and upload behavior.