ITSWEBER Send

Self-hosted, end-to-end encrypted file sharing in a single Docker container.

Features · Quickstart · Configuration · Security · API · License

🇩🇪 Auf Deutsch lesen → README.de.md

Status: v1.3.5 — three deployment modes (LAN direct with self-signed TLS, behind an existing reverse proxy, public with bundled Caddy + Let's Encrypt), Unraid template ready for Community Apps submission, mobile-responsive UI with hamburger drawer for account / admin, 2FA QR code, resumable chunked uploads for files of any size, FSA streaming downloads, SMTP notifications. All v1.0+ shares stay decryptable. Container image is linux/amd64 only at the moment; arm64 returns when GitHub provides native arm64 runners.

Screenshots

What it is

ITSWEBER Send is a modern, lightweight file-sharing service you run yourself. Files are encrypted in the browser (AES-256-GCM, key in URL fragment) before they touch the server — the server only ever sees ciphertext. Upload one or more files, get a link plus an optional QR code or four-word handoff phrase, and share it. After the configured number of downloads or expiry time, the share is permanently deleted.

Inspired by the original Firefox Send and the timvisee/send fork, but rebuilt from scratch with a modern stack and a wider feature set.

Features

Sharing

• Drag-and-drop multi-file upload with resumable, chunked uploads — files of arbitrary size are streamed in 16 MiB ciphertext chunks, with pause / resume from the UI
• Per-share password (layered on top of the URL key — when set, the share is decrypted via password only, no master key in the link)
• Configurable expiry (1 h / 24 h / 7 d / 30 d) and download limit (1× to unlimited; counts per recipient share-download, not per blob)
• QR code generated client-side for the share link
• Four-word handoff code as an alternative to the long URL — combine with a password for fully voice-shareable transfers
• Optional Markdown note for the recipient

Privacy & Security

• Client-side AES-256-GCM encryption — the server never receives plaintext or filenames
• Argon2id password hashing (OWASP 2026 defaults) for user accounts
• Strict CSP, COOP/COEP, HSTS, Permissions-Policy — no third-party requests
• Rate limiting and progressive backoff for brute-force attempts
• Container runs as non-root with a read-only root filesystem and dropped capabilities
• No telemetry, no trackers, no phone-home

UX

• Light, dark and system-preference themes
• German and English UI (i18n-ready)
• Installable as a PWA
• Anonymous by default; optional account adds upload history, higher quota and API token management

Operations

• Single container, no external database or cache service required
• SQLite by default
• Health and readiness endpoints for container orchestrators
• Webhooks for upload and download events
• S3 / MinIO storage backend
• SMTP notifications on first download

Quickstart

The image ships in three deployment modes. Pick the one that matches your environment.

Mode 1 — LAN direct (embedded Caddy, self-signed TLS)

For a home lab on a static LAN IP, with no public domain. The bundled Caddy terminates HTTPS on port 8443 with a self-signed certificate so Web Crypto works over the LAN.

docker run -d \
  --name itsweber-send \
  -p 8443:8443 \
  -v send-data:/data \
  -e SEND_HOST=192.168.1.100 \
  -e ORIGIN=https://192.168.1.100:8443 \
  -e BASE_URL=https://192.168.1.100:8443 \
  ghcr.io/itsweber-official/itsweber-send:latest

Open https://192.168.1.100:8443 and accept the self-signed certificate once. Compose alternative: docker/docker-compose.lan.yml.

Mode 2 — Behind your existing reverse proxy

For setups where Nginx Proxy Manager, Traefik, an Ingress controller or another upstream proxy already terminates HTTPS with a real certificate. The embedded Caddy is disabled so there is no double TLS termination.

docker run -d \
  --name itsweber-send \
  -p 3000:3000 \
  -v send-data:/data \
  -e REVERSE_PROXY_MODE=true \
  -e ORIGIN=https://send.example.com \
  -e BASE_URL=https://send.example.com \
  ghcr.io/itsweber-official/itsweber-send:latest

Forward your public hostname to port 3000 over plain HTTP. Compose alternative: docker/docker-compose.proxy.yml. Detailed snippets for NPM, Traefik, Caddy and Nginx: docs/REVERSE_PROXY.md.

Mode 3 — Public with bundled Caddy and Let's Encrypt

For single-server deployments with ports 80/443 free and no other proxy in front. A separate Caddy container fetches a Let's Encrypt certificate and proxies to the send container.

curl -O https://raw.githubusercontent.com/ITSWEBER-OFFICIAL/itsweber-send/main/docker/docker-compose.yml
curl -O https://raw.githubusercontent.com/ITSWEBER-OFFICIAL/itsweber-send/main/docker/Caddyfile.example

# Replace send.example.com with your domain in Caddyfile.example, then:
ORIGIN=https://send.example.com docker compose up -d

Unraid one-shot template

Drop the bundled XML template onto the Unraid USB so the container appears in the Docker → Container hinzufügen → Vorlage dropdown with everything pre-filled (image, volume, env vars, security flags):

wget -O /boot/config/plugins/dockerMan/templates-user/itsweber-send.xml \
  https://raw.githubusercontent.com/ITSWEBER-OFFICIAL/itsweber-send/main/unraid/itsweber-send.xml

Pre-chown the data directory before the first start. The image runs as the non-root UID 10001:10001, so the host bind-mount must be owned by that UID:

mkdir -p /mnt/user/appdata/itsweber-send
chown -R 10001:10001 /mnt/user/appdata/itsweber-send

Without this, SQLite refuses to open and the container exits on start.

Delete the source template after the first successful Apply. Unraid keeps both the source XML you wgot above and a my--prefixed copy of the user-applied state. When you later click Update / Force Update, Unraid can fall back to the source and overwrite your customisations (network, IP, public domain, ports). Remove the source after the first Apply so Unraid only reads the user-applied state on subsequent updates:

rm /boot/config/plugins/dockerMan/templates-user/itsweber-send.xml

Repeat the wget + Apply + rm cycle for future releases. This work-around goes away once the project is published to Community Apps proper.

Run from source

git clone https://github.com/ITSWEBER-OFFICIAL/itsweber-send
cd itsweber-send
pnpm install
pnpm dev

Web UI: http://localhost:5173 — API: http://localhost:3000

Configuration

All configuration is done via environment variables. Full reference: docs/CONFIG.md.

Documentation

Architecture

See docs/ARCHITECTURE.md for the full write-up.

License

AGPL-3.0-only. Running a modified version as a network service requires making the source of your modifications available to the users of that service.

Contributing

Pull requests are welcome. See CONTRIBUTING.md for the development setup and conventions. For security issues, use the private reporting process described in .github/SECURITY.md.