26 lines
2.2 KiB
Markdown
26 lines
2.2 KiB
Markdown
# Quickdrop
|
|
|
|
**AI-generated content discolsure**
|
|
|
|
This project is largely AI generated, but based off of my work on [Noctis]{https://gitea.wildcardproject.com/zoeissleeping/noctis}.
|
|
Its largely unsloppified currently, but that unsloppiness isnt _too_ horrific like some other projects I've been working on and will need to heavily manually deslop.
|
|
|
|
My Slop Score: 5/10. It's not bad, but it's not great.
|
|
|
|
Quickdrop is secure self hosted file drop service. The goal is to take a file
|
|
on your PC, upload it via Quickdrop, scane the QR code on your phone or share
|
|
the link, and download the file with no additional software or setup and a
|
|
zero-trust policy.
|
|
|
|
## Deployment
|
|
|
|
Run one Node/Nitro process behind HTTPS and a Cloudflare proxy. Storage is local (`QUICKDROP_STORAGE_DIR`, default `.data/quickdrop`) and locks are in-process, so multiple workers, containers, or replicas are unsupported. Configure `AUTH_PASSCODE`, `AUTH_SECRET` (a long random secret), and optionally `AUTH_TOKEN_TTL_DAYS`; see `.env.example`. Use backups, disk monitoring, and Cloudflare/IP rate limits. Cloudflare request sizing is safe because upload and download requests are one encrypted chunk (about 8 MiB), not whole files.
|
|
|
|
The uploader and reservation APIs require the shared passcode. Room descriptors, lease claims, encrypted chunk reads, and completion are public capability APIs. A descriptor lookup does not consume a read. Explicit download claims one read; interrupted downloads reuse their active `sessionStorage` lease. Expiry starts only when finalize succeeds. Choices are 1h/2h/6h/12h/24h/7d and 1/5/10/20/50/100/unlimited reads.
|
|
|
|
## Browser behavior
|
|
|
|
The File System Access API path writes and decrypts one chunk at a time and supports very large files without whole-file browser materialization. Browsers without it use a deliberately bounded Blob fallback: a warning appears above 100 MiB and files above 256 MiB require a supported desktop browser. Keep the upload tab open and do not share a link until finalize completes.
|
|
|
|
This service has no application total-file-size quota, but disk capacity and operational rate limits remain important. Existing legacy whole-body room drops are not compatible with protocol v2.
|