@feld @p >Even if you're not using S3 your media files should be served by your webserver, not Pleroma/Phoenix.
Pretty sure it was served by Phoenix for the longest time until the docs changed to recommend using separate media subdomain in the wake of XSS paranoia. Also frontend with all its JSON blobs and emoji annotations in Enochian is served by Phoenix by default as well (I'm using a bunch of hacky nginx rules to serve it directly from my VPS instead of fetching them from my homeserver eery time a new tab is loaded).