diff --git a/.env.example b/.env.example
index 4cc714a..e5a2d5a 100644
--- a/.env.example
+++ b/.env.example
@@ -1 +1,7 @@
-DATABASE_URL=
\ No newline at end of file
+DATABASE_URL=
+
+MINIO_URL=http://localhost:9000
+MINIO_ENDPOINT=localhost
+MINIO_ACCESS_KEY=minioadmin
+MINIO_SECRET_KEY=minioadmin
+MINIO_USE_SSL=false
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 2dc5862..aa0a4a6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,3 +19,17 @@ services:
       POSTGRES_DB: adventurelog
     ports:
       - "5432:5432"
+  minio:
+    image: quay.io/minio/minio
+    command: server /data --console-address ":9001"
+    environment:
+      - MINIO_ROOT_USER=minioadmin
+      - MINIO_ROOT_PASSWORD=minioadmin
+    volumes:
+      - minio_data:/data
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+
+volumes:
+  minio_data:
diff --git a/src/lib/server/minio.ts b/src/lib/server/minio.ts
index 9b61c6a..5b0ef1a 100644
--- a/src/lib/server/minio.ts
+++ b/src/lib/server/minio.ts
@@ -1,11 +1,16 @@
 import { Client } from "minio";
+import { MINIO_URL } from "$env/static/private";
+import { MINIO_ACCESS_KEY } from "$env/static/private";
+import { MINIO_SECRET_KEY } from "$env/static/private";
+import { MINIO_ENDPOINT } from "$env/static/private";
+const port = MINIO_URL?.split(":").pop(); // 9000
 
 const minioClient = new Client({
-  endPoint: "localhost",
-  port: 9000,
+  endPoint: MINIO_ENDPOINT ? MINIO_ENDPOINT : "localhost",
+  port: port ? parseInt(port) : 9000,
   useSSL: false,
-  accessKey: "minioadmin",
-  secretKey: "minioadmin",
+  accessKey: MINIO_ACCESS_KEY,
+  secretKey: MINIO_SECRET_KEY,
 });
 
 export default minioClient;
diff --git a/src/routes/api/upload/+server.ts b/src/routes/api/upload/+server.ts
index f89d9eb..452bac9 100644
--- a/src/routes/api/upload/+server.ts
+++ b/src/routes/api/upload/+server.ts
@@ -11,6 +11,25 @@ export async function POST(event: RequestEvent): Promise<Response> {
     const fileExtension = contentType.split("/").pop();
     const fileName = `${generateId(25)}.${fileExtension}`;
 
+    if (!fileExtension || !fileName) {
+      return new Response(JSON.stringify({ error: "Invalid file type" }), {
+        status: 400,
+        headers: {
+          "Content-Type": "application/json",
+        },
+      });
+    }
+
+    // check if the file is an image
+    if (!contentType.startsWith("image")) {
+      return new Response(JSON.stringify({ error: "Invalid file type" }), {
+        status: 400,
+        headers: {
+          "Content-Type": "application/json",
+        },
+      });
+    }
+
     const fileBuffer = await event.request.arrayBuffer();
     const metaData = {
       "Content-Type": contentType,