zoeissleeping/quickdrop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Zoe
2026-08-07 22:13:25 -05:00
commit 8006fd67f3
40 changed files with 11017 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
README.md Normal file
View File

@@ -0,0 +1,25 @@
# Quickdrop
**AI-generated content discolsure**
This project is largely AI generated, but based off of my work on [Noctis]{https://gitea.wildcardproject.com/zoeissleeping/noctis}.
Its largely unsloppified currently, but that unsloppiness isnt _too_ horrific like some other projects I've been working on and will need to heavily manually deslop.
My Slop Score: 5/10. It's not bad, but it's not great.
Quickdrop is secure self hosted file drop service. The goal is to take a file
on your PC, upload it via Quickdrop, scane the QR code on your phone or share
the link, and download the file with no additional software or setup and a
zero-trust policy.
## Deployment
Run one Node/Nitro process behind HTTPS and a Cloudflare proxy. Storage is local (`QUICKDROP_STORAGE_DIR`, default `.data/quickdrop`) and locks are in-process, so multiple workers, containers, or replicas are unsupported. Configure `AUTH_PASSCODE`, `AUTH_SECRET` (a long random secret), and optionally `AUTH_TOKEN_TTL_DAYS`; see `.env.example`. Use backups, disk monitoring, and Cloudflare/IP rate limits. Cloudflare request sizing is safe because upload and download requests are one encrypted chunk (about 8 MiB), not whole files.
The uploader and reservation APIs require the shared passcode. Room descriptors, lease claims, encrypted chunk reads, and completion are public capability APIs. A descriptor lookup does not consume a read. Explicit download claims one read; interrupted downloads reuse their active `sessionStorage` lease. Expiry starts only when finalize succeeds. Choices are 1h/2h/6h/12h/24h/7d and 1/5/10/20/50/100/unlimited reads.
## Browser behavior
The File System Access API path writes and decrypts one chunk at a time and supports very large files without whole-file browser materialization. Browsers without it use a deliberately bounded Blob fallback: a warning appears above 100 MiB and files above 256 MiB require a supported desktop browser. Keep the upload tab open and do not share a link until finalize completes.
This service has no application total-file-size quota, but disk capacity and operational rate limits remain important. Existing legacy whole-body room drops are not compatible with protocol v2.