refactor(backend): simplify media schema and recording metadata

Backend/utils/minio.ts

@@ -1,3 +1,5 @@
+import { readFileSync } from 'node:fs';
+import { Agent as HttpsAgent } from 'node:https';
 import { Client } from 'minio';
 
 const endpoint = process.env.MINIO_ENDPOINT ?? 'localhost';
@@ -5,6 +7,9 @@ const port = Number(process.env.MINIO_PORT ?? 9000);
 const useSSL = (process.env.MINIO_USE_SSL ?? 'false').toLowerCase() === 'true';
 const accessKey = process.env.MINIO_ACCESS_KEY;
 const secretKey = process.env.MINIO_SECRET_KEY;
+const insecureSkipTlsVerify = (process.env.MINIO_INSECURE_SKIP_TLS_VERIFY ?? 'false').toLowerCase() === 'true';
+const tlsRejectUnauthorized = (process.env.MINIO_TLS_REJECT_UNAUTHORIZED ?? 'true').toLowerCase() !== 'false';
+const minioCaCertPath = process.env.MINIO_CA_CERT_PATH?.trim();
 
 if (!accessKey || !secretKey) {
   throw new Error('MINIO_ACCESS_KEY and MINIO_SECRET_KEY must be set');
@@ -12,6 +17,14 @@ if (!accessKey || !secretKey) {
 
 export const minioBucket = process.env.MINIO_BUCKET ?? 'videos';
 export const minioPresignedExpirySeconds = Number(process.env.MINIO_PRESIGNED_EXPIRY_SECONDS ?? 60 * 10);
+const customCa = minioCaCertPath ? readFileSync(minioCaCertPath) : undefined;
+const transportAgent = useSSL
+  ? new HttpsAgent({
+      keepAlive: true,
+      ca: customCa,
+      rejectUnauthorized: insecureSkipTlsVerify ? false : tlsRejectUnauthorized,
+    })
+  : undefined;
 
 export const minioClient = new Client({
   endPoint: endpoint,
@@ -19,6 +32,7 @@ export const minioClient = new Client({
   useSSL,
   accessKey,
   secretKey,
+  transportAgent,
 });
 
 let ensureBucketPromise: Promise<void> | null = null;