argitasuna/it-dropzones repository overview

⁠IT Dropzones

A small, self-hosted web app for quickly sharing files, links, text snippets and notes — no database, no user accounts, just a password.

Built for personal / small-team use: 5 independent workspaces, installable as an app (PWA) on mobile and desktop, and usable for temporary public sharing.

⁠Features

• 5 independent workspaces, each with its own files, URLs, snippets and a notepad.
• Smart input: paste or type content into a single field and the app automatically routes links to URLs and everything else to Snippets.
• Drag-and-drop file uploads, paste images directly from the clipboard.
• Public sharing of a workspace via a link (read-only, or read + write), revocable at any time. Shared workspaces are visually flagged.
• Trash with restore, automatic 30-day retention.
• Installable PWA (home screen icon on mobile, full-screen mode).
• Password authentication, with an optional "stay signed in" (7 days).
• Custom name per workspace.

⁠Tech stack

• Backend: Python / Flask, single file (app.py)
• Storage: plain JSON files on disk (uploads/) — no database
• Frontend: HTML/CSS/JS embedded in Jinja2 templates, no front-end framework
• Production server: Gunicorn (see Dockerfile)

⁠Local setup (Development)

pip install -r requirements.txt
python app.py

The app starts on http://localhost:5000.

⁠Environment variables

⁠Production Deployment (Docker Compose)

Create a docker-compose.yml file and paste the following configuration:

services:
  it-dropzones:
    image: argitasuna/it-dropzones:latest
    container_name: it-dropzones
    ports:
      - "5000:5000"
    environment:
      PASSWORD: yourpassword
      DEFAULT_LANG: en
      DEFAULT_THEME: natura  # iluna | natura | amber | zuri-beltz | beltz-zuri | marrazkia
      # SECRET_KEY: set this explicitly if you run multiple workers/instances
    volumes:
      - ./itdropzones:/app/uploads
    restart: unless-stopped

Run the application with:

docker compose up -d

⚠️ Make sure to mount /app/uploads as a volume: it holds uploaded files, the data store (data.json), auth tokens and the secret key. Without it, everything is lost on every container redeploy.

⁠Sharing a workspace

Public sharing is only available when the app is served over HTTPS on a real domain (it's disabled for local/LAN access, where full access is already direct). Each share link can be instantly revoked by the workspace owner, and write access (add/edit/delete) can be toggled independently from read access.

⁠Security

• Auth cookie is HttpOnly, Secure (over HTTPS), SameSite=Lax.
• Single shared password — no multi-account management. Change PASSWORD before deploying.
• Set SECRET_KEY explicitly in production if the app runs with multiple workers or multiple instances.

© 2026 Argitasuna