Yes, I seem to be using an unsupported S3 Provider (OVH Object Storage)
With an endpoint url of https://s3.de.ovh.cloud.net and a configured s3 cdn_url to https://storage.de.ovh.cloud.net/v1/<some-unique-user-id>/<the-bucket-name>
When short urls are resolved, discourse uses the endpoint url to construct the resulting url (which fails since it does not include the correct ovh user-id - the part in the s3 cdn_url).
Forcing short urls to have dl=1 would however construct a working presigned_url which would be fine for me.
I set these (s3 specific) environment variables within the container yaml:
DISCOURSE_USE_S3: true
DISCOURSE_S3_REGION: DE
DISCOURSE_S3_ENDPOINT: https://s3.de.cloud.ovh.net
DISCOURSE_S3_ACCESS_KEY_ID: ...
DISCOURSE_S3_SECRET_ACCESS_KEY: ...
DISCOURSE_S3_CDN_URL: https://storage.de.ovh.cloud.net/v1/<some-unique-user-id>/<the-bucket-name>
DISCOURSE_S3_UPLOAD_BUCKET: <the-bucket-name>
DISCOURSE_S3_INSTALL_CORS_RULE: false