Safebucket

Secure, self-hosted file sharing: buckets, sharing with people inside and outside your team, MFA, trash retention, and an audit trail — behind your own domain.

What you get

Safebucket — the app (API + web UI) on a public domain
Postgres 17 — the database, on a volume with daily backups
MinIO — S3-compatible file storage, on a volume with daily backups; your browser uploads and downloads files directly against it with presigned URLs

Setup

Fill in exactly two fields at deploy time:

Admin email — your login
Admin password — pick something strong; you can enable MFA after logging in

Everything else (session signing key, MFA encryption key, database and storage passwords) is generated fresh for your deployment. When the deploy finishes, open the Safebucket service's URL and log in.

Notes

Invite/share emails are written to files inside the container by default (not sent). To send real email, set NOTIFIER__TYPE=smtp and add NOTIFIER__SMTP__HOST, __PORT, __USERNAME, __PASSWORD, __SENDER, __TLS_MODE on the Safebucket service.
The audit trail is stored on the container filesystem and resets on redeploys. Point ACTIVITY__TYPE=loki at a Loki service for a persistent trail.
Single-instance by design (in-memory cache and queue). Add Valkey (CACHE__TYPE=valkey) and NATS JetStream (EVENTS__TYPE=jetstream) before scaling out.

Template source and companion storage image: https://github.com/hmseeb/safebucket-railway