Assets

By default, files are stored on the local filesystem. For production, use a cloud storage service. Spree auto-detects the storage provider based on which environment variables are set — no code changes needed. See Environment Variables for the full list.

AWS S3

Set the following environment variables:

Variable	Default	Description
`AWS_ACCESS_KEY_ID`	—	AWS access key
`AWS_SECRET_ACCESS_KEY`	—	AWS secret key
`AWS_REGION`	—	AWS region (e.g., `us-east-1`)
`AWS_BUCKET`	`spree-production`	S3 bucket name

CORS Configuration

The Admin Dashboard uses direct uploads. Configure CORS on your S3 bucket to allow this:

Go to your S3 bucket in AWS Console
Click on “Permissions” tab
Scroll down to “Cross-origin resource sharing (CORS)”
Click “Edit” and paste the following configuration:

[
  {
    "AllowedMethods": ["GET", "PUT", "POST"],
    "AllowedOrigins": ["https://myspreestore.com"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"]
  }
]

Replace myspreestore.com with the domain you use to access your Spree Admin Dashboard.

Cloudflare R2

Cloudflare R2 is S3-compatible object storage with zero egress fees and a built-in CDN. Set the following environment variables:

Variable	Default	Description
`CLOUDFLARE_ENDPOINT`	—	R2 endpoint URL
`CLOUDFLARE_ACCESS_KEY_ID`	—	R2 access key
`CLOUDFLARE_SECRET_ACCESS_KEY`	—	R2 secret key
`CLOUDFLARE_BUCKET`	`spree-production`	R2 bucket name

CORS Configuration

Configure CORS on your R2 bucket for direct uploads:

Go to your R2 bucket in Cloudflare Console
Click on “Settings” tab
Scroll down to “CORS policy”
Click “Edit CORS policy” and paste the following configuration:

[
  {
    "AllowedOrigins": [
      "https://myspreestore.com"
    ],
    "AllowedMethods": [
      "PUT"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "Origin",
      "Content-Type",
      "Content-MD5",
      "Content-Disposition"
    ],
    "MaxAgeSeconds": 3600
  }
]

Replace myspreestore.com with the domain you use to access your Spree Admin Dashboard.

Deployment

Upgrading

Contributing

Security

AWS S3

CORS Configuration

Cloudflare R2

CORS Configuration

​AWS S3

​CORS Configuration

​Cloudflare R2

​CORS Configuration

AWS S3

CORS Configuration

Cloudflare R2

CORS Configuration