trust proxy

src/config.ts

@@ -6,6 +6,7 @@ export interface Config {
   storageDir: string;
   maxFileSize: number;
   fileTtlMs: number;
+  publicBaseUrl?: string;
   rateLimitEnabled: boolean;
   rateLimitMax: number;
   rateLimitWindowMs: number;
@@ -69,15 +70,28 @@ export function loadConfig(env: Record<string, string | undefined> = process.env
     throw new Error(`Invalid RATE_LIMIT_WINDOW_MS: ${env.RATE_LIMIT_WINDOW_MS}`);
   }
 
+  const trustProxy = boolFromEnv(env.TRUST_PROXY, false);
+
+  let publicBaseUrl: string | undefined;
+  const rawBase = env.PUBLIC_BASE_URL?.trim();
+  if (rawBase) {
+    const normalized = rawBase.replace(/\/+$/, "");
+    if (!/^https?:\/\/[^\s/]+$/.test(normalized)) {
+      throw new Error(`Invalid PUBLIC_BASE_URL: "${rawBase}"`);
+    }
+    publicBaseUrl = normalized;
+  }
+
   return {
     host,
     port,
     storageDir,
     maxFileSize,
     fileTtlMs,
+    publicBaseUrl,
     rateLimitEnabled: boolFromEnv(env.RATE_LIMIT_ENABLED, true),
     rateLimitMax,
     rateLimitWindowMs,
-    trustProxy: boolFromEnv(env.TRUST_PROXY, false),
+    trustProxy,
   };
 }