simthem/privcloud-sharing repository overview

PrivCloud_Sharing is a self-hosted file sharing platform and an alternative for WeTransfer.

For more informations -> https://github.com/Simthem/PrivCloud_Sharing⁠

⁠Features

• Share files using a link
• Unlimited file size (restricted only by disk space)
• Set an expiration date for shares
• Secure shares with visitor limits and passwords
• End-to-end encryption (E2E) - Files are encrypted client-side with AES-256-GCM before upload. The server never sees the encryption key.
• E2E encrypted reverse shares - Reverse share links include a per-share encryption key in the URL fragment. Senders encrypt files with that key, and only the reverse share creator can decrypt them.
• Email recipients
• Reverse shares
• OIDC and LDAP authentication
• Integration with ClamAV for security scans
• Different file providers: local storage and S3

⁠Security

PrivCloud_Sharing includes a hardened dependency tree with zero known CVEs across all three packages (backend, frontend, docs). Key upgrades:

• Next.js 16 with @ducanh2912/next-pwa (replaces deprecated next-pwa)
• NestJS 11 with Prisma 7 and stricter type guards
• All transitive vulnerabilities resolved via targeted overrides

⁠End-to-End Encryption

PrivCloud_Sharing encrypts all uploaded files client-side using AES-256-GCM via the Web Crypto API.

• User uploads: A per-user master key (K_master) is generated on first upload and stored in the browser's localStorage. A SHA-256 hash of the key is stored server-side for verification - never the key itself. Share links include the key in the URL fragment (#key=...), which is never sent to the server.
• Reverse share uploads: When a user creates a reverse share, a per-reverse-share key (K_rs) is generated and encrypted with K_master. The encrypted key is stored server-side. The cleartext K_rs is appended to the reverse share link via the URL fragment. Senders use K_rs to encrypt their files. Only the reverse share owner can decrypt K_rs (using their K_master) to access the uploaded files.

⁠Get to know PrivCloud_Sharing

⁠Setup

⁠Installation with Docker (recommended)

1. Download the docker-compose.yaml file
2. Run docker compose up -d

The website is now listening on http://localhost:3000, have fun with PrivCloud_Sharing!

⁠Building from source

The Dockerfile compiles OpenSSL 3.6.2 and Node.js 24 from source to patch CVE-2026-2673 (HIGH). The first build takes ~20-30 min due to these compilation stages. Subsequent builds use Docker layer cache and are much faster.

docker compose build
# or, with explicit build args:
docker build -t privcloud-sharing .

Speed up rebuilds: you can cache the heavy compilation stages as local images so they are never recompiled unless you explicitly want to:

# Build and tag the OpenSSL stage (~5-10 min)
docker build --target openssl-builder -t my-registry/openssl-cache .

# Build and tag the Node.js stage (~15-25 min)
docker build --target node-builder -t my-registry/node-cache .

Then edit the Dockerfile and replace:

• FROM debian:trixie-slim AS openssl-builder with FROM my-registry/openssl-cache AS openssl-builder
• FROM debian:trixie-slim AS node-builder with FROM my-registry/node-cache AS node-builder

Node.js version: the NODE_VERSION build arg (default: 24.14.1) must match the node:24-slim base image. When upgrading the base image, update this arg accordingly.

⁠Proxy Configuration

If your server accesses the internet through an HTTP proxy, uncomment and edit the proxy lines in docker-compose.yaml:

environment:
  - NODE_OPTIONS=--dns-result-order=ipv4first --require /opt/app/backend/node_modules/global-agent/bootstrap
  - GLOBAL_AGENT_HTTP_PROXY=http://your-proxy:3128
  - GLOBAL_AGENT_NO_PROXY=localhost,127.0.0.1,::1
  - HTTP_PROXY=http://your-proxy:3128
  - HTTPS_PROXY=http://your-proxy:3128
  - NO_PROXY=localhost,127.0.0.1,::1

If you are building the image yourself behind a proxy, also pass build args:

build:
  context: .
  args:
    HTTP_PROXY: http://your-proxy:3128
    HTTPS_PROXY: http://your-proxy:3128

Node.js does not natively honor HTTP_PROXY / HTTPS_PROXY environment variables. PrivCloud_Sharing bundles global-agent⁠ to patch http.globalAgent / https.globalAgent at runtime, so outbound requests (S3, external APIs) are properly routed through the proxy.

⁠Environment Variables

⁠Documentation

For more installation options and advanced configurations, please refer to the documentation⁠.

⁠Packages and Vulnerabilities (2026-05-12)

Nothing found