[{"_1":2,"_170":-5,"_171":-5},"loaderData",{"_3":4,"_18":19,"_25":26,"_148":149},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":11,"_24":22},"username","isAskGordonEnabled",true,"showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_136":-5,"_137":11,"_138":22,"_139":11,"_140":11,"_141":-5,"_142":11,"_143":-5,"_144":145,"_146":91,"_147":-7},"canonicalUrl","https://hub.docker.com/r/acaranta/eventdrop/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","acaranta","reponame","eventdrop","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2026-04-14T08:05:18.624255Z","description","","is_private","last_updated","2026-10-02T14:59:02.00261Z","last_modified","2026-04-19T16:04:32.713158Z","media_types",[56],"application/vnd.oci.image.index.v1+json","name","pull_count",2318,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# EventDrop\n\n

\n $\"EventDrop\"$ \n

\n\nEventDrop is a self-hosted web application for collecting and sharing photos and videos from events. Organizers create an event, share a link or QR code, and guests upload media directly from their devices — no account required. Media is stored in a gallery the organizer can browse, manage, and bulk-download as a ZIP archive.\n\n## Table of Contents\n\n- [Features](#features)\n- [Quick Start](#quick-start)\n- [Building from Source](#building-from-source)\n- [Configuration](#configuration)\n- [Development Setup](#development-setup)\n- [Architecture Overview](#architecture-overview)\n- [Usage Guide](#usage-guide)\n - [Upload Messages](#upload-messages)\n - [Gallery Filtering](#gallery-filtering)\n - [Media Attribution](#media-attribution)\n - [Contributors List](#contributors-list)\n- [Email Ingestion](#email-ingestion)\n- [Storage Backends](#storage-backends)\n- [Database](#database)\n- [Authentication](#authentication)\n- [Security Notes](#security-notes)\n\n---\n\n## Features\n\n- **Passwordless guest uploads** — guests enter only their email address before uploading; no registration required\n- **Photo and video support** — accepts JPEG, PNG, HEIC/HEIF, WebP, GIF, MP4, MOV, AVI, MKV, and WebM files\n- **Automatic EXIF extraction** — captures original photo date/time from image metadata\n- **Automatic thumbnail generation** — creates 400×400 JPEG thumbnails for image previews\n- **QR code generation** — each event has a downloadable QR code that links directly to the upload page\n- **Public or private gallery** — event galleries can be opened to anonymous visitors or kept private\n- **Bulk ZIP download** — download all or selected media as a single ZIP archive with a time-limited link\n- **Email ingestion** — poll a dedicated IMAP or POP3 mailbox and automatically import photo/video attachments\n- **S3-compatible storage** — store media on local disk or any S3-compatible object store (AWS, MinIO, Cloudflare R2, etc.)\n- **SQLite or MySQL** — use embedded SQLite for simple deployments or MySQL for production\n- **OIDC single sign-on** — optional OpenID Connect login alongside username/password authentication\n- **Admin dashboard** — manage users, events, and monitor email ingestion status\n- **Session-based authentication** — secure server-side sessions via signed cookies\n- **Duplicate detection** — re-uploading the same filename by the same guest overwrites the previous file\n\n---\n\n## Quick Start\n\nThe fastest way to run EventDrop is with Docker Compose. The image is available on Docker Hub as `acaranta/eventdrop:latest`.\n\nDownload the `docker-compose.yml` file (or clone the repository) and start the stack:\n\n```bash\ndocker compose up -d\n```\n\nNo build step is needed — Docker will pull the pre-built image automatically.\n\nThe application starts on **http://localhost:8000**. Log in with the default credentials:\n\n- **Username:** `admin`\n- **Password:** `changeme`\n\n> **Important:** Change the default password and the `EVENTDROP_SECRET_KEY` before exposing the application to any network. See the [Security Notes](#security-notes) section.\n\nTo follow logs:\n\n```bash\ndocker compose logs -f\n```\n\nTo stop:\n\n```bash\ndocker compose down\n```\n\nPersistent data (database and media files) is stored in the `eventdrop_data` Docker volume.\n\n---\n\n## Building from Source\n\nIf you want to build the Docker image yourself instead of using the pre-built one from Docker Hub:\n\n```bash\ngit clone \ncd eventdrop\ndocker build -t acaranta/eventdrop:latest .\n```\n\nThen run with Docker Compose as normal — the locally built image will be used since its tag matches the one referenced in `docker-compose.yml`.\n\n---\n\n## Configuration\n\nAll settings are read from environment variables prefixed with `EVENTDROP_`. The Docker Compose file provides a ready-to-use template that you can customise.\n\n### Full Variable Reference\n\n| Variable | Default | Description |\n|---|---|---|\n| `EVENTDROP_ADMIN_USERNAME` | `admin` | Username for the built-in administrator account |\n| `EVENTDROP_ADMIN_PASSWORD` | `changeme` | Password for the administrator account — **change this** |\n| `EVENTDROP_SECRET_KEY` | `dev-secret-key-change-in-production` | Key used to sign session cookies and to encrypt stored email passwords — **change this** |\n| `EVENTDROP_DB_TYPE` | `sqlite` | Database engine: `sqlite` or `mysql` |\n| `EVENTDROP_DB_PATH` | `/data/eventdrop.db` | Filesystem path to the SQLite database file (used when `DB_TYPE=sqlite`) |\n| `EVENTDROP_DB_HOST` | _(empty)_ | MySQL server hostname (used when `DB_TYPE=mysql`) |\n| `EVENTDROP_DB_PORT` | `3306` | MySQL server port |\n| `EVENTDROP_DB_NAME` | _(empty)_ | MySQL database name |\n| `EVENTDROP_DB_USER` | _(empty)_ | MySQL username |\n| `EVENTDROP_DB_PASSWORD` | _(empty)_ | MySQL password |\n| `EVENTDROP_STORAGE_TYPE` | `local` | Storage backend: `local` or `s3` |\n| `EVENTDROP_STORAGE_LOCAL_PATH` | `/data/media` | Directory for local media storage (used when `STORAGE_TYPE=local`) |\n| `EVENTDROP_S3_ENDPOINT` | _(empty)_ | S3-compatible endpoint URL, e.g. `https://s3.example.com` (leave empty for AWS) |\n| `EVENTDROP_S3_BUCKET` | _(empty)_ | S3 bucket name |\n| `EVENTDROP_S3_ACCESS_KEY` | _(empty)_ | S3 access key ID |\n| `EVENTDROP_S3_SECRET_KEY` | _(empty)_ | S3 secret access key |\n| `EVENTDROP_S3_REGION` | `us-east-1` | S3 region |\n| `EVENTDROP_S3_USE_SSL` | `true` | Whether to use SSL/TLS for S3 connections |\n| `EVENTDROP_OIDC_ENABLED` | `false` | Enable OpenID Connect authentication |\n| `EVENTDROP_OIDC_PROVIDER_URL` | _(empty)_ | OIDC provider base URL, e.g. `https://auth.example.com/realms/myrealm` |\n| `EVENTDROP_OIDC_CLIENT_ID` | _(empty)_ | OIDC client ID |\n| `EVENTDROP_OIDC_CLIENT_SECRET` | _(empty)_ | OIDC client secret |\n| `EVENTDROP_OIDC_DISPLAY_NAME` | `Login with SSO` | Label shown on the SSO login button |\n| `EVENTDROP_EMAIL_INGESTION_ENABLED` | `true` | Enable the email ingestion background service |\n| `EVENTDROP_EMAIL_POLL_INTERVAL_SECONDS` | `120` | How often (in seconds) to poll configured mailboxes |\n| `EVENTDROP_ARCHIVE_TEMP_PATH` | `/data/tmp` | Directory where ZIP archives are temporarily stored |\n| `EVENTDROP_ARCHIVE_EXPIRY_MINUTES` | `15` | How many minutes a download link remains valid before expiry |\n| `EVENTDROP_BASE_URL` | `http://localhost:8000` | Public base URL of the application — used in generated upload links and QR codes |\n| `EVENTDROP_MAX_UPLOAD_SIZE_MB` | `500` | Maximum allowed size per uploaded file in megabytes |\n\n---\n\n## Development Setup\n\n### Prerequisites\n\n- Python 3.13+\n- [uv](https://github.com/astral-sh/uv) package manager\n- `libmagic` system library (for MIME type detection)\n\nInstall system dependencies on Debian/Ubuntu:\n\n```bash\nsudo apt-get install libmagic1 libmagic-dev libjpeg-dev libpng-dev libwebp-dev\n```\n\n### Install the Project\n\n```bash\ngit clone \ncd eventdrop\n\n# Create a virtual environment and install all dependencies (including dev)\nuv sync\n```\n\n### Run the Development Server\n\n```bash\n# Apply database migrations\nuv run alembic upgrade head\n\n# Start the server with auto-reload\nuv run uvicorn eventdrop.main:app --reload --host 0.0.0.0 --port 8000\n```\n\nThe application is available at **http://localhost:8000**.\n\nOn first startup, the application creates all database tables and provisions the admin user defined by `EVENTDROP_ADMIN_USERNAME` and `EVENTDROP_ADMIN_PASSWORD`.\n\n### Run Tests\n\n```bash\nuv run pytest\n```\n\n### Create a New Database Migration\n\nAfter modifying `src/eventdrop/database/models.py`, generate an Alembic migration:\n\n```bash\nuv run alembic revision --autogenerate -m \"describe your change\"\nuv run alembic upgrade head\n```\n\n---\n\n## Architecture Overview\n\n### Technology Stack\n\n| Layer | Technology |\n|---|---|\n| Language | Python 3.13 |\n| Web framework | FastAPI |\n| Templates | Jinja2 + Tailwind CSS |\n| ORM | SQLAlchemy 2 (async) |\n| Migrations | Alembic |\n| Database | SQLite (aiosqlite) or MySQL (aiomysql) |\n| Storage | Local filesystem (aiofiles) or S3 (boto3) |\n| Session middleware | Starlette `SessionMiddleware` (signed cookies) |\n| OIDC | Authlib |\n| Email | Python standard library `imaplib` / `poplib` |\n| QR codes | qrcode + Pillow |\n| EXIF | exifread |\n| MIME detection | python-magic |\n| Build / package | uv + Hatchling |\n| Container | Docker (multi-stage, `python:3.13-slim`) |\n\n### Project Structure\n\n```\neventdrop/\n├── src/eventdrop/\n│ ├── main.py # FastAPI app factory, lifespan, middleware\n│ ├── config.py # Pydantic Settings (all EVENTDROP_* vars)\n│ ├── auth/\n│ │ ├── dependencies.py # get_current_user, require_admin\n│ │ ├── oidc.py # Authlib OAuth client setup\n│ │ ├── passwords.py # bcrypt hash/verify helpers\n│ │ └── routes.py # /auth/login, /auth/signup, /auth/oidc/*\n│ ├── database/\n│ │ ├── engine.py # Async SQLAlchemy engine + session factory\n│ │ ├── models.py # ORM models (User, Event, MediaFile, …)\n│ │ └── session.py # get_db dependency\n│ ├── routes/\n│ │ ├── admin.py # /admin/* (dashboard, users, events)\n│ │ ├── api.py # /api/* (download, delete, health)\n│ │ ├── events.py # /events/* (CRUD, QR code)\n│ │ ├── gallery.py # /e/{id}/gallery/\n│ │ └── upload.py # /e/{id}/ (upload page and file upload API)\n│ ├── services/\n│ │ ├── archive_service.py # ZIP generation and timed-link management\n│ │ ├── email_ingestion.py # IMAP/POP3 polling background task\n│ │ ├── event_service.py # Event CRUD\n│ │ ├── media_service.py # File storage, thumbnails, EXIF, dedup\n│ │ └── user_service.py # User CRUD\n│ ├── storage/\n│ │ ├── base.py # Abstract StorageBackend interface\n│ │ ├── local.py # LocalStorage — files on disk\n│ │ └── s3.py # S3Storage — boto3-backed\n│ ├── templates/ # Jinja2 HTML templates\n│ └── utils/\n│ └── qrcode.py # QR code generation helpers\n├── alembic/ # Alembic migration environment\n├── tests/ # pytest test suite\n├── Dockerfile\n├── docker-compose.yml\n└── pyproject.toml\n```\n\n### Background Tasks\n\nTwo asyncio tasks run for the lifetime of the application process:\n\n- **Email ingestion loop** — polls all enabled per-event mailboxes every `EVENTDROP_EMAIL_POLL_INTERVAL_SECONDS` seconds (disabled if `EVENTDROP_EMAIL_INGESTION_ENABLED=false`)\n- **Archive cleanup loop** — runs every 5 minutes and deletes expired ZIP files from `EVENTDROP_ARCHIVE_TEMP_PATH`\n\n---\n\n## Usage Guide\n\n### Creating an Event\n\n1. Log in and navigate to **My Events**.\n2. Click **Create Event**.\n3. Enter a name and optional description.\n4. Choose gallery visibility:\n - **Public gallery** — anyone with the gallery link can browse media without logging in.\n - **Allow public download** — guests can download media from the gallery; unchecked means only the owner can download.\n5. Optionally configure email ingestion (see [Email Ingestion](#email-ingestion)).\n6. Submit the form. You are redirected to the event edit page.\n\n### Sharing the Upload Link\n\nThe event edit page shows:\n- A shareable **upload URL** in the form `https:///e//`\n- An inline **QR code** for printing or sharing on screen\n- A **Download QR PNG** button to save a high-resolution QR code image\n\nShare either the URL or the QR code with guests. Guests open the link, enter their email address, and drag-and-drop or select files to upload. The email is stored in a browser cookie so guests do not need to re-enter it on subsequent visits.\n\n### Gallery\n\nBrowse uploaded media at `/e//gallery/`. The gallery shows thumbnails for images and file info for videos. Event owners and admins see additional controls.\n\n### Bulk Download\n\nFrom the gallery, select individual files or click **Download All**. EventDrop assembles a ZIP archive on demand and provides a time-limited download link (default: 15 minutes). The archive is named after the event and the number of files included.\n\n### Upload Messages\n\nWhen uploading files, users can optionally add a text message (up to 500 characters) to their batch. The message is attached to every file in that upload session. A \"Make message visible to everyone\" toggle controls whether the message appears in the public gallery or only to the event owner/admin. Messages are sanitized: HTML is escaped, URLs are deactivated, and JavaScript injection is prevented.\n\n### Gallery Filtering\n\nThe gallery supports filtering by uploader and upload type. Use the filter bar at the top of the gallery to view photos from a specific contributor or filter by \"Web upload\" vs \"Email\". Filters are applied via URL query parameters (`?uploader=email@example.com&source=upload`), making filtered views shareable.\n\n### Media Attribution\n\nEach media item in the gallery displays its filename, file size, upload date, uploader email, and source type. If the uploader added a message, it appears below the media thumbnail.\n\n### Contributors List\n\nThe event management page and gallery both show a contributors panel listing everyone who uploaded media, with their upload count and a link to filter the gallery to their contributions only.\n\n### Managing an Event\n\nFrom the event edit page, the owner can:\n- Update name, description, and visibility settings\n- Activate or deactivate the event (deactivated events reject new uploads)\n- Update or disable the email ingestion configuration\n- Delete the event (removes all media from storage)\n\nAdministrators have full access to all events via the `/admin/` dashboard.\n\n---\n\n## Email Ingestion\n\nEventDrop can automatically import photos and videos sent to a dedicated email address. This is useful when guests prefer to send media by email rather than using the web interface.\n\n### How It Works\n\n1. Create a dedicated email account (e.g. `mywedding@mail.example.com`).\n2. On the event creation or edit page, enable **Email Ingestion** and provide the mailbox credentials.\n3. EventDrop polls the mailbox on a background task at the configured interval.\n4. All image and video attachments found in new/unread messages are imported into the event's media library.\n5. The sender's email address is recorded as the uploader.\n\n### Configuration Fields\n\n| Field | Description |\n|---|---|\n| Protocol | `imap` (recommended) or `pop3` |\n| Server host | Mail server hostname, e.g. `imap.gmail.com` |\n| Server port | Default `993` (IMAP SSL) or `110`/`995` (POP3) |\n| Use SSL | Enable TLS — strongly recommended |\n| Username | Mailbox login username |\n| Password | Mailbox password — stored encrypted using the `EVENTDROP_SECRET_KEY` |\n| Email address | The address guests send media to (displayed on the upload page) |\n| Delete after ingestion | Delete messages from the server after processing; if disabled, messages are marked as read (IMAP) or tracked by UID (POP3) |\n\n### IMAP vs POP3\n\n- **IMAP** is preferred. EventDrop fetches only `UNSEEN` messages and marks them read (or deletes them) after processing. No additional deduplication state is stored.\n- **POP3** does not have a read/unread concept. EventDrop tracks processed message UIDs in the `processed_emails` table to avoid importing the same message twice.\n\n### Testing the Connection\n\nOn the event edit page, click **Test Connection** to verify the credentials without saving, before the next scheduled poll.\n\n### Poll Status\n\nThe admin dashboard shows the last poll time, status (`success` or `error`), error message, and number of files ingested for each configured mailbox.\n\n---\n\n## Storage Backends\n\n### Local Filesystem (default)\n\nMedia files are written to the directory specified by `EVENTDROP_STORAGE_LOCAL_PATH` (default `/data/media`). Files are served directly by the application at `/media/`.\n\nThe directory layout inside the storage root is:\n\n```\n//_\n```\n\nThumbnails are stored alongside originals with a `thumb_` prefix.\n\nNo additional configuration is required beyond ensuring the directory exists and is writable by the application process.\n\n### S3-Compatible Object Storage\n\nSet `EVENTDROP_STORAGE_TYPE=s3` and supply the remaining S3 variables:\n\n```dotenv\nEVENTDROP_STORAGE_TYPE=s3\nEVENTDROP_S3_BUCKET=my-eventdrop-bucket\nEVENTDROP_S3_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE\nEVENTDROP_S3_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\nEVENTDROP_S3_REGION=eu-west-1\n```\n\nFor self-hosted S3-compatible services (MinIO, Ceph, Cloudflare R2), also set:\n\n```dotenv\nEVENTDROP_S3_ENDPOINT=https://s3.example.com\n```\n\nLeave `EVENTDROP_S3_ENDPOINT` empty to use AWS S3.\n\nMedia URLs returned to clients are pre-signed URLs with a 1-hour expiry, generated on demand by boto3. No public bucket policy is required.\n\n---\n\n## Database\n\n### SQLite (default)\n\nSQLite requires no external server. The database is a single file at `EVENTDROP_DB_PATH`. This is the recommended choice for single-server deployments.\n\n### MySQL\n\nFor higher-concurrency deployments or when an existing MySQL infrastructure is available:\n\n```dotenv\nEVENTDROP_DB_TYPE=mysql\nEVENTDROP_DB_HOST=db.example.com\nEVENTDROP_DB_PORT=3306\nEVENTDROP_DB_NAME=eventdrop\nEVENTDROP_DB_USER=eventdrop\nEVENTDROP_DB_PASSWORD=secure-password\n```\n\nEventDrop uses `aiomysql` for async MySQL connectivity. The database must exist before starting the application; EventDrop will not create it automatically.\n\n### Migrations\n\nEventDrop uses **Alembic** for schema management. The Docker image runs `alembic upgrade head` automatically at container startup before launching the server.\n\nFor manual migration management:\n\n```bash\n# Apply all pending migrations\nuv run alembic upgrade head\n\n# Check current migration version\nuv run alembic current\n\n# Roll back one step\nuv run alembic downgrade -1\n\n# Generate a new migration after model changes\nuv run alembic revision --autogenerate -m \"add column foo to events\"\n```\n\n> **Note:** On first startup (without a pre-existing database), the application also calls SQLAlchemy's `create_all` as a safety net. In production, prefer relying exclusively on Alembic to track the schema version.\n\n---\n\n## Authentication\n\n### Username and Password\n\nEventDrop ships with session-based username/password authentication backed by bcrypt password hashing (via `passlib`).\n\n- Users can sign up at `/auth/signup`.\n- The admin account is provisioned automatically from `EVENTDROP_ADMIN_USERNAME` and `EVENTDROP_ADMIN_PASSWORD` on every startup. If the account already exists its password is updated to match the environment variable.\n- Passwords must be at least 8 characters.\n\n### OpenID Connect (OIDC)\n\nOIDC support is implemented with **Authlib** and works with any standards-compliant provider (Keycloak, Authentik, Auth0, Google, GitHub via OIDC proxy, etc.).\n\nEnable OIDC by setting:\n\n```dotenv\nEVENTDROP_OIDC_ENABLED=true\nEVENTDROP_OIDC_PROVIDER_URL=https://auth.example.com/realms/myrealm\nEVENTDROP_OIDC_CLIENT_ID=eventdrop\nEVENTDROP_OIDC_CLIENT_SECRET=your-client-secret\nEVENTDROP_OIDC_DISPLAY_NAME=Login with Keycloak\n```\n\nEventDrop uses the `/.well-known/openid-configuration` discovery document from `EVENTDROP_OIDC_PROVIDER_URL` and requests the `openid email profile` scope.\n\n> **Important:** `EVENTDROP_BASE_URL` must be set to the public-facing URL of your EventDrop instance (e.g. `https://eventdrop.yourdomain.com`). The redirect URI sent to the OIDC provider is built as:\n>\n> ```\n> /auth/oidc/callback\n> ```\n>\n> This value must exactly match a `redirect_uri` registered in your OIDC client configuration. If `EVENTDROP_BASE_URL` is left at its default (`http://localhost:8000`) or set incorrectly, the provider will reject the authorization request with an `invalid_request` error stating that the redirect URI does not match.\n\n**Account linking behaviour:**\n\n1. If a user with the matching OIDC `sub` claim already exists, they are logged in directly.\n2. If no match is found but the email matches an existing local user, that user is linked to the OIDC subject.\n3. Otherwise, a new account is created with the username derived from `preferred_username`, `name`, or the email prefix.\n\nOIDC and local username/password authentication can coexist. When OIDC is configured, an SSO login button appears on the login page alongside the standard form.\n\n#### Authelia\n\nEventDrop works with [Authelia](https://www.authelia.com/) 4.38+. Add a client entry to your Authelia `configuration.yml`:\n\n```yaml\nidentity_providers:\n oidc:\n clients:\n - client_id: eventdrop\n client_name: EventDrop\n # Generate with: authelia crypto hash generate pbkdf2 --random --random.length 64\n client_secret: '$pbkdf2-sha512$310000$'\n public: false\n authorization_policy: one_factor # change to two_factor to require MFA\n redirect_uris:\n # Must match /auth/oidc/callback exactly\n - https://eventdrop.example.com/auth/oidc/callback\n scopes:\n - openid\n - profile\n - email\n response_types:\n - code\n grant_types:\n - authorization_code\n token_endpoint_auth_method: client_secret_basic\n```\n\nThen configure EventDrop to point at your Authelia instance:\n\n```dotenv\n# Must match the redirect_uris entry in the Authelia client config above\n# The redirect URI sent to Authelia will be: https://eventdrop.example.com/auth/oidc/callback\nEVENTDROP_BASE_URL=https://eventdrop.example.com\nEVENTDROP_OIDC_ENABLED=true\n# Authelia issuer base URL — no path suffix needed, discovery is automatic\nEVENTDROP_OIDC_PROVIDER_URL=https://auth.example.com\nEVENTDROP_OIDC_CLIENT_ID=eventdrop\n# Plain-text secret here; Authelia stores only the hash above\nEVENTDROP_OIDC_CLIENT_SECRET=your-plain-text-secret\nEVENTDROP_OIDC_DISPLAY_NAME=Login with Authelia\n```\n\n### Admin Access\n\nUsers with `is_admin=true` can access the `/admin/` panel. Admin status can be toggled from the admin users page. The initial admin user created from the environment variables always has admin access.\n\n---\n\n## Security Notes\n\n### Secret Key\n\n`EVENTDROP_SECRET_KEY` serves two purposes:\n\n1. **Session cookie signing** — Starlette's `SessionMiddleware` uses it to sign the session cookie. If the key is compromised or rotated, all existing sessions are immediately invalidated.\n2. **Email password encryption** — Per-event mailbox passwords are encrypted with Fernet symmetric encryption, using a key derived from `EVENTDROP_SECRET_KEY` via SHA-256. Rotating the secret key will make all stored email passwords unreadable; re-enter them after any key rotation.\n\nGenerate a strong key before deploying:\n\n```bash\npython -c \"import secrets; print(secrets.token_hex(32))\"\n```\n\n### Default Credentials\n\nThe default admin password `changeme` must be replaced via the `EVENTDROP_ADMIN_PASSWORD` environment variable before any public-facing deployment. Setting the variable to a new value is sufficient — the admin account password is updated on every restart.\n\n### Upload Size Limit\n\n`EVENTDROP_MAX_UPLOAD_SIZE_MB` caps the size of each individual file upload. The limit is enforced in application code after reading the request body; it is advisable to also configure a matching limit at the reverse proxy level (nginx `client_max_body_size`, Caddy `request_body max_size`).\n\n### MIME Type Validation\n\nUploaded file types are validated using `python-magic` (libmagic), which inspects file content rather than relying on the file extension or `Content-Type` header. Only the following types are accepted:\n\n`image/jpeg`, `image/png`, `image/heic`, `image/heif`, `image/webp`, `image/gif`, `video/mp4`, `video/quicktime`, `video/x-msvideo`, `video/x-matroska`, `video/webm`\n\n### Reverse Proxy\n\nFor production deployments, run EventDrop behind a TLS-terminating reverse proxy (nginx, Caddy, Traefik). Ensure the proxy forwards `X-Forwarded-For` and `X-Forwarded-Proto` headers if needed for correct URL generation.\n\nSet `EVENTDROP_BASE_URL` to the public HTTPS URL so that generated upload links and QR codes point to the correct address.\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":22,"_83":11,"_84":11},"read","write","admin","user","storage_size",4268431240,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_50":124,"_125":94,"_126":33,"_127":56,"_57":128,"_129":130,"_131":132,"_133":124,"_134":66,"_135":22},"content_type","creator",16513,"digest","sha256:436a99d99a087526bd2128970f2f2aa252238678482830f29d3667e477a23ca8","full_size",353329407,"id",1130553870,"images",[103,119],{"_104":105,"_95":106,"_107":48,"_108":109,"_110":111,"_112":113,"_114":48,"_115":-5,"_116":117,"_63":66,"_118":-5},"architecture","amd64","sha256:35432111d65c5db206aca36dbf0d0ce7c375d052f899ae94efe968ac2ecf29eb","features","last_pulled","2026-11-03T11:00:35.861536588Z","last_pushed","2026-10-02T14:58:59.034924508Z","os","linux","os_features","os_version","size",371321017,"variant",{"_104":120,"_95":121,"_107":48,"_108":122,"_110":123,"_112":113,"_114":48,"_115":-5,"_116":98,"_63":66,"_118":-5},"arm64","sha256:1313955b889b5a30825b659604bc82de09fc892f27988691872b4d36e0919f5f","2026-10-30T20:34:35.612480939Z","2026-10-02T14:58:59.686754123Z","2026-10-02T14:59:01.507207Z","last_updater","last_updater_username","media_type","latest","repository",30774829,"tag_last_pulled","2026-11-04T20:12:42.074151732Z","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":150,"_157":158,"_144":168,"_169":11},{"_40":151,"_42":152,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":153,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":154,"_79":11,"_80":156,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":155},[78],{"_82":22,"_83":11,"_84":11},"tags",{"_159":64,"_160":-5,"_161":-5,"_162":163},"count","next","previous","results",[164],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":165,"_50":124,"_125":94,"_126":33,"_127":56,"_57":128,"_129":130,"_131":132,"_133":124,"_134":66,"_135":22},[166,167],{"_104":105,"_95":106,"_107":48,"_108":109,"_110":111,"_112":113,"_114":48,"_115":-5,"_116":117,"_63":66,"_118":-5},{"_104":120,"_95":121,"_107":48,"_108":122,"_110":123,"_112":113,"_114":48,"_115":-5,"_116":98,"_63":66,"_118":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
35432111d65c	linux/amd64	354.12 MB
1313955b889b	linux/arm64	336.96 MB

acaranta/eventdrop

Tags for acaranta/eventdrop