Web client for Kura Vault: end-to-end encrypted photo and video storage, served with nginx.
175
The browser client for Kura Vault: self-hosted, end-to-end encrypted storage for personal photos and videos.
All encryption and decryption happens in the browser. This image serves the
client with nginx and is the single entry point of a deployment. It serves the
app, proxies /api/ to the
server, and can serve
the bundled storage bucket from the same origin. Your HTTPS reverse proxy points
at this container.
Status: early and under active development. It has not had an independent security review. Do not make it the only copy of anything you care about.
Don't run this image on its own. It's one part of a stack: this web client, the server, PostgreSQL and object storage. The installer sets up all of it with Docker Compose:
curl -fsSLO https://github.com/greytimelabs/kura-vault/releases/latest/download/install.sh
less install.sh && sh install.sh
To pull from Docker Hub instead of GHCR, set this in the generated .env:
KURA_SERVER_IMAGE=docker.io/greytimelabs/kura-vault-server
KURA_WEB_IMAGE=docker.io/greytimelabs/kura-vault-web
The self-hosting guide covers manual setup, external buckets, reverse proxy examples, backups and upgrades.
| Tag | Meaning |
|---|---|
1.2.3 | An exact release. Pin this in production, at the same version as the server |
1.2, 1 | The latest release in that minor or major line |
latest | The latest stable release |
1.3.0-rc.1 | A prerelease, published under its own tag only |
Images are built for linux/amd64 and linux/arm64, only from release tags.
Always run the web and server images at the same version.
| Variable | Default | Purpose |
|---|---|---|
API_UPSTREAM | http://server:3000 | Where the server is reached |
S3_PROXY_UPSTREAM | Storage to serve at /<bucket>/, e.g. http://garage:3900 for the bundled Garage | |
S3_BUCKET_NAME | The bucket name, when S3_PROXY_UPSTREAM is set | |
S3_ORIGIN | An external bucket's origin, allowed in the Content-Security-Policy | |
TRUSTED_PROXIES | private ranges | Addresses or CIDRs allowed to set X-Forwarded-For |
Every value is checked at start. A bad one stops the container with a message instead of producing a broken nginx configuration.
nginx-unprivileged on Alpine./tmp, /etc/nginx/conf.d and /var/cache/nginx).8080. The health check is GET /healthz.nosniff, no-referrer and frame-ancestors 'none' on every response.Content type
Image
Digest
sha256:d69df0e7d…
Size
24.9 MB
Last updated
about 6 hours ago
docker pull greytimelabs/kura-vault-web