Configure file storage (R2/S3)

FastStaq stores uploads (support attachments, live-chat files, avatars, blog media, and GDPR exports) in an S3-compatible bucket. Cloudflare R2 is recommended for its zero egress fees, but any S3-compatible provider works.

File storage stays disabled until configured

Uploads are off until S3_BUCKET, S3_ACCESS_KEY, and S3_SECRET_KEY are all set. Until then, upload features are inactive.

Configure Cloudflare R2

1. In Cloudflare, create an R2 bucket.
2. Create an R2 API token with Object Read & Write permission.
3. Set the bucket's public access (public r2.dev URL or a custom domain).
4. Add to server/.env:

S3_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
S3_REGION=auto
S3_BUCKET=your-bucket-name
S3_ACCESS_KEY=your-r2-access-key
S3_SECRET_KEY=your-r2-secret-key
S3_PUBLIC_URL=https://pub-xxxx.r2.dev   # or your custom domain
MAX_FILE_SIZE=5242880                   # 5 MiB default

S3_PUBLIC_URL is required for correct public links. When it is unset the code falls back to S3_ENDPOINT, which does not serve private buckets.

Mirror the public URL on the client

So Next.js image and CSP rules allow your bucket, set in client/.env:

NEXT_PUBLIC_STORAGE_URL=https://pub-xxxx.r2.dev

Upload validation (built in)

Every upload is validated server-side before it reaches the bucket: MIME and extension allowlist, size and count limits, magic-byte sniffing, and filename sanitization. Archives and macro-enabled documents are blocked by default; only enable ATTACHMENT_ALLOW_ARCHIVES=true after wiring an antivirus scanner via ANTIVIRUS_SCAN_URL.

Test it

1. Restart the server after setting the variables.
2. Upload an avatar or a support attachment.
3. Confirm the file is reachable at its public URL.

Related articles

• User management and profiles
• Support desk overview

Still need help?

Open a support ticket if uploads fail or links 404.