Skip to content

v0.148.0 — Images without a public bucket

The first milestone of the Google Cloud program (M1). Players on the live site see no change: production is still on AWS. It makes the platform ready to keep images private on Google Cloud, and stands up a test environment there.

On Google Cloud

  • [x] Uploaded images live in a private bucket. Cloud CDN serves them only to signed-in users, through a signed cookie the app fetches and keeps fresh. The same image link opened signed out is refused.
  • [x] The cookie reaches everywhere images appear: map textures, plain images and wiki pages in their sandboxed frames.
  • [x] Module assets live in the bucket too. Built-in textures and map art upload once per module version.
  • [x] Images leaving the browser still work. Anything handed to an outside service gets a signed link that lasts an hour, or the bytes.
  • [x] A next environment on Google Cloud, beside AWS's, at next-gcp.purplecat.games. Cloud Run serves the app as well as the API.

On every deployment

  • [x] The server reads its own images from storage, not over HTTP, for background removal, segmentation, the image proxy and uploads from a URL. It's the one behaviour change on AWS: same images, no loopback request.
  • [x] Every image the app reads back loads through one helper. A guard test fails on a crossOrigin set anywhere else. Without a signing session configured, images load exactly as before.
  • [x] A guard test fails the build if anything under infra/gcp grants public access or a bucket stops enforcing public access prevention.

Still to check

  • A tab left open past 12 hours passed after release, on 2026-11-05.
  • Background removal can't finish on any deployed image yet, AWS included, for a reason unrelated to this release (#143). It gets re-checked on Google Cloud once that's fixed.