fix: Avoid public exposure of audio files

deploy/docker.nginx.template

@@ -74,8 +74,12 @@ server {
         proxy_pass   http://funkwhale-api/.well-known/;
     }
 
-    location /media/ {
-        alias ${MEDIA_ROOT}/;
+    location /media/__sized__/ {
+        alias ${MEDIA_ROOT}/__sized__/;
+    }
+
+    location /media/attachments/ {
+        alias ${MEDIA_ROOT}/attachments/;
     }
 
     # this is an internal location that is used to serve

deploy/nginx.template

@@ -120,8 +120,12 @@ server {
         proxy_pass   http://funkwhale-api/.well-known/;
     }
 
-    location /media/ {
-        alias ${MEDIA_ROOT}/;
+    location /media/__sized__/ {
+        alias ${MEDIA_ROOT}/__sized__/;
+    }
+
+    location /media/attachments/ {
+        alias ${MEDIA_ROOT}/attachments/;
     }
 
     location /_protected/media {

docker/nginx/conf.dev

@@ -108,8 +108,12 @@ http {
             proxy_pass   http://funkwhale-api/api/subsonic/rest/;
         }
 
-        location /media/ {
-            alias /protected/media/;
+        location /media/__sized__/ {
+            alias /protected/media/__sized__/;
+        }
+
+        location /media/attachments/ {
+            alias /protected/media/attachments/;
         }
 
         # this is an internal location that is used to serve