LibreChatCloudFront Object Structure
The cloudfront object configures CloudFront delivery for files stored in S3. It is required when fileStrategy or any fileStrategies entry uses "cloudfront".
Example
fileStrategies:
avatar: 'cloudfront'
image: 'cloudfront'
document: 's3'
cloudfront:
domain: 'https://cdn.example.com'
distributionId: 'E1234ABCD'
invalidateOnDelete: false
imageSigning: 'cookies'
cookieDomain: '.example.com'
cookieExpiry: 1800
urlExpiry: 3600
storageRegion: 'us-east-2'
includeRegionInPath: false
requireSignedAccess: trueFields
| Key | Type | Description | Example |
|---|---|---|---|
| domain | String | CloudFront distribution domain or CNAME. Required. | domain: "https://cdn.example.com" |
| distributionId | String | CloudFront distribution ID. Required when `invalidateOnDelete` is true. | distributionId: "E1234ABCD" |
| invalidateOnDelete | Boolean | Creates a CloudFront invalidation after deleting the S3 object. Default: false. | invalidateOnDelete: false |
| imageSigning | String | Inline media signing mode. Options: `"none"`, `"cookies"`, `"url"`. `"url"` is reserved and not implemented for images. | imageSigning: "cookies" |
| urlExpiry | Number | Signed CloudFront download URL lifetime in seconds. Default: 3600. | urlExpiry: 3600 |
| cookieExpiry | Number | Signed cookie lifetime in seconds. Default: 1800. Maximum: 604800. | cookieExpiry: 1800 |
| cookieDomain | String | Shared parent domain for signed cookies. Required when `imageSigning` is `"cookies"`. Must start with a dot. | cookieDomain: ".example.com" |
| storageRegion | String | Optional region label used in generated object keys when `includeRegionInPath` is true. | storageRegion: "us-east-2" |
| includeRegionInPath | Boolean | Includes the storage region in newly generated object keys. Default: false. | includeRegionInPath: false |
| requireSignedAccess | Boolean | Requires signed-cookie CloudFront access to initialize successfully at startup. Default: false. | requireSignedAccess: true |
Validation Rules
distributionIdis required wheninvalidateOnDeleteistrue.cookieDomainis required whenimageSigningis"cookies".cookieDomainmust start with a dot, for example.example.com.requireSignedAccess: truerequiresimageSigning: "cookies".
Related Environment Variables
| Key | Type | Description | Example |
|---|---|---|---|
| CLOUDFRONT_KEY_PAIR_ID | String | CloudFront public key pair ID. Required for signed cookies and signed downloads. | # CLOUDFRONT_KEY_PAIR_ID=K1234567890ABC |
| CLOUDFRONT_PRIVATE_KEY | String | CloudFront private key PEM. Required for signed cookies and signed downloads. | # CLOUDFRONT_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----" |
For deployment guidance, see CloudFront with S3.
How is this guide?