kianfar/storage-io repository overview

_{More in docs/screenshots⁠: every page in light, dark, RTL and mobile. Regenerate with pnpm screenshots.}

⁠Quick start

docker run -d --name storage-io -p 3000:3000 \
  -e ADMIN_USERNAME=admin \
  -e ADMIN_PASSWORD='choose-a-strong-password' \
  -e APP_SECRET="$(openssl rand -base64 48)" \
  -v storage-io-data:/data \
  kianfar/storage-io:latest

Open http://localhost:3000⁠, sign in, and connect your first server in the welcome wizard.

⁠With Docker Compose

curl -O https://raw.githubusercontent.com/navid-kianfar/storage-io/main/docker-compose.yml
cat > .env <<EOF
ADMIN_USERNAME=admin
ADMIN_PASSWORD=choose-a-strong-password
APP_SECRET=$(openssl rand -base64 48)
EOF
docker compose up -d

⁠Features

• Many servers, one view. Add any number of S3 endpoints. Each connection is verified (reachability, TLS, auth, admin API) and its capabilities are detected. Health, latency, capacity and traffic are monitored continuously, with maintenance mode and credential rotation.
• Buckets. Create buckets with versioning, object lock and quotas. Edit access policies (presets or a JSON editor), lifecycle rules, replication, event notifications, CORS and tags. Bulk actions and CSV export.
• Object browser. Fast virtualised listing, previews (image, video, audio, PDF, text, JSON, Markdown, archive contents), in-place text editing that saves a new version, versions and restore, tags, metadata, retention and legal hold, share links, copy and move across servers, ZIP download, import from URL, and drag-and-drop file and folder uploads.
• Transfers. Resumable multipart uploads with pause and resume, retries, bandwidth limits, and a live transfer manager.
• Bulk jobs. Copy, move, delete, tag, change storage class, set retention or restore versions across millions of objects. Filters, estimates, dry runs, live concurrency, cron schedules, and pause/resume that survives restarts.
• Access management. S3/IAM users, groups, policies (a visual and JSON editor with a simulator and version history) and access keys (expiry, rotation with a grace period, a one-time secret with ready-made .env, AWS CLI, rclone and mc snippets).
• Quotas. Native hard quotas where the provider supports them, alert-only quotas everywhere else.
• Operations. Activity log with CSV export and syslog forwarding. Notifications by e-mail, signed webhook and Telegram. Encrypted configuration backup and restore.
• Interface. Light and dark themes, full right-to-left support, English/Türkçe/فارسی/العربية language switching (translations are in progress), a command palette (⌘K), and a responsive layout down to phones.

⁠Provider support

Capabilities are detected per server. Anything unsupported is shown as such in the UI instead of failing. MinIO and SeaweedFS are tested end to end in CI; the other drivers are covered by protocol-level tests.

⁠Configuration

All configuration comes from environment variables. There is a single administrator, whose credentials come from the environment; there is no sign-up.

The full reference, including the scheduler switches and log level, is in apps/api/.env.example⁠.

⁠Development

Requirements: Node.js ≥ 22, pnpm ≥ 10 (via Corepack), Docker (for the local MinIO/SeaweedFS targets).

git clone https://github.com/navid-kianfar/storage-io.git && cd storage-io
corepack enable && pnpm install
cp apps/api/.env.example apps/api/.env          # set ADMIN_PASSWORD and APP_SECRET
docker compose -f docker/docker-compose.dev.yml up -d   # MinIO + SeaweedFS for testing
pnpm dev                                        # API on :3000, web on :5173
pnpm seed:demo                                  # optional: demo servers, buckets, users and jobs

⁠Tech stack

⁠Repository layout

apps/api            NestJS REST API + SSE, provider drivers, job engine, SQLite
apps/web            React single-page app (served by the API in production)
packages/contracts  Shared zod schemas and types
docker/             Dev containers (MinIO, SeaweedFS)
docs/               Architecture, API contract, routes, screenshots

More detail is in docs/ARCHITECTURE.md⁠, docs/API.md⁠ and docs/ROUTES.md⁠. While the API runs in development, the OpenAPI UI is served at /api/docs.

⁠Security

• Server secrets are encrypted at rest with AES-256-GCM, using a key derived from APP_SECRET. The API never returns them.
• Sessions are opaque tokens stored hashed, in an httpOnly, SameSite=Strict cookie. Mutating requests are Origin-checked, login is rate-limited, and an optional allowed-networks list restricts access.
• A strict Content-Security-Policy is applied. Object previews are sandboxed and only inert types render inline.

Please report vulnerabilities privately; see SECURITY.md⁠.

⁠Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md⁠.

⁠License

MIT⁠ © storage-io contributors