fix(chart): drop inert media auth knob

Co-authored-by: coder <d97ebdbb198c7237c94f84ea8bb8a73583ea067407eebd0062abbb3962527fb1@buzz.block.builderlab.xyz>
Signed-off-by: coder <d97ebdbb198c7237c94f84ea8bb8a73583ea067407eebd0062abbb3962527fb1@buzz.block.builderlab.xyz>

deploy/charts/buzz/templates/deployment.yaml

@@ -131,7 +131,6 @@ spec:
             - { name: BUZZ_DRAIN_JITTER_MS,        value: {{ .Values.relay.drainJitterMs | quote }} }
             - { name: BUZZ_REQUIRE_AUTH_TOKEN,     value: {{ .Values.relay.requireAuthToken | quote }} }
             - { name: BUZZ_REQUIRE_RELAY_MEMBERSHIP, value: {{ .Values.relay.requireRelayMembership | quote }} }
-            - { name: BUZZ_REQUIRE_MEDIA_GET_AUTH, value: {{ .Values.relay.requireMediaGetAuth | quote }} }
             - { name: BUZZ_MEDIA_MIGRATION_PHASE,       value: {{ .Values.relay.mediaMigrationPhase | quote }} }
             - { name: BUZZ_ALLOW_NIP_OA_AUTH,      value: {{ .Values.relay.allowNipOaAuth | quote }} }
             - { name: BUZZ_PUBKEY_ALLOWLIST,       value: {{ .Values.relay.pubkeyAllowlist | quote }} }

deploy/charts/buzz/tests/render_test.yaml

@@ -54,16 +54,6 @@ tests:
             name: BUZZ_HUDDLE_AUDIO_AVAILABLE
             value: "true"
         template: templates/deployment.yaml
-      # Security default: media GET/HEAD reads must be auth-gated out of the
-      # box. A private attachment must never be publicly readable by URL/hash
-      # in an unmodified render. If this assertion fails, someone flipped the
-      # default — treat that as a security regression, not a config tweak.
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: BUZZ_REQUIRE_MEDIA_GET_AUTH
-            value: "true"
-        template: templates/deployment.yaml
 
   - it: renders the dual-read-and-write migration phase
     set:

deploy/charts/buzz/values.schema.json

@@ -62,7 +62,6 @@
         "drainJitterMs": { "type": "integer", "minimum": 0 },
         "requireAuthToken": { "type": "boolean" },
         "requireRelayMembership": { "type": "boolean" },
-        "requireMediaGetAuth": { "type": "boolean" },
         "mediaMigrationPhase": { "type": "string", "enum": ["legacy-only", "dual-read-and-write", "sharded-only"] },
         "allowNipOaAuth": { "type": "boolean" },
         "huddleAudioAvailable": {

deploy/charts/buzz/values.yaml

@@ -117,12 +117,6 @@ relay:
   drainJitterMs: 0
   requireAuthToken: true
   requireRelayMembership: true
-  # Authenticated media reads: relay GET/HEAD /media/* requires Blossom
-  # kind 24242 t=get plus relay membership. Enabled by default so private
-  # attachments are never publicly readable by URL/hash. Only set false for
-  # local development or fully public communities — desktop, mobile, and CLI
-  # clients all attach read auth.
-  requireMediaGetAuth: true
   # Behavior-preserving upgrade default: legacy-only reads and writes. Existing deployments use
   # legacy-only -> dual-read-and-write -> backfill -> sharded-only. New deployments should override this to
   # sharded-only before accepting their first upload so they never need a backfill.