Django

django>=4.2
django-storages[s3]>=1.14

# settings.py — Django 4.2 and later. There is nothing PopCloud-specific in the
# backend: it is the same S3 backend, pointed at a different endpoint.
STORAGES = {
    "default": {
        "BACKEND": "storages.backends.s3.S3Storage",
        "OPTIONS": {
            "bucket_name": os.environ["POPCLOUD_BUCKET"],
            "endpoint_url": os.environ["AWS_ENDPOINT_URL"],  # https://s3.<region>.popcloud.ca
            "region_name": os.environ["AWS_REGION"],         # canada
            "access_key": os.environ["AWS_ACCESS_KEY_ID"],
            "secret_key": os.environ["AWS_SECRET_ACCESS_KEY"],
            # Recommended for predictable custom-endpoint behavior. PopCloud
            # also supports virtual-hosted requests for single-label buckets.
            "addressing_style": "path",
            # Keep signed media URLs on modern AWS Signature Version 4 too.
            "signature_version": "s3v4",
            # PopCloud has no bucket ACLs — access is a property of the
            # credential and of the bucket, not of each object.
            "default_acl": None,
            # Keep uploads from silently overwriting each other; Django appends
            # a suffix instead.
            "file_overwrite": False,
            # Media URLs come back signed and expiring. Set querystring_auth to
            # False only for a bucket you have made public.
            "querystring_auth": True,
            "querystring_expire": 3600,
        },
    },
    "staticfiles": {
        "BACKEND": "storages.backends.s3.S3Storage",
        "OPTIONS": {
            "bucket_name": os.environ["POPCLOUD_BUCKET"],
            "endpoint_url": os.environ["AWS_ENDPOINT_URL"],
            "region_name": os.environ["AWS_REGION"],
            "access_key": os.environ["AWS_ACCESS_KEY_ID"],
            "secret_key": os.environ["AWS_SECRET_ACCESS_KEY"],
            "addressing_style": "path",
            "default_acl": None,
            "location": "static",
            # Static files are public and immutable — serve them unsigned from a
            # public bucket, with a long cache header.
            "querystring_auth": False,
            "object_parameters": {"CacheControl": "max-age=31536000, immutable"},
        },
    },
}