Safebucket

Safebucket is a self-hosted file sharing platform designed with a pluggable infrastructure. It allows users to upload and download files using presigned URLs, which ensures that data transfers bypass the application server to reduce overhead and increase security. This architecture prevents the server from becoming a bottleneck during large file transfers and minimizes the exposure of sensitive data to the application layer.

The software is deployed as a server application and is available via Docker Compose for local or remote installations. It provides a comprehensive web interface for managing files and buckets, supporting both internal organizational use and external sharing via public links. Users can manage their storage through a browser, while administrators can oversee the entire platform through a dedicated management interface.

Key features

• Direct uploads and downloads via presigned URLs
• Swappable storage, database, events, cache, and notifier components
• SSO integration via OIDC providers and local authentication
• Role-based access control at both platform and bucket levels
• Public sharing with password protection and download limits
• Real-time activity tracking and audit logs
• Multifactor authentication using TOTP
• File expiration and trash with configurable retention periods
• Admin dashboard for platform-wide statistics

The backend is written in Go using the Gorm ORM and Goose for migrations, while the frontend is built with React, Radix UI, and shadcn/ui. It utilizes Watermill for pub/sub integrations and Koanf for configuration management. The architecture is highly modular, allowing administrators to replace core components such as the database or storage backend to fit specific infrastructure requirements. The project also implements security measures for its distribution, using cosign for keyless signing of container images via GitHub Actions OIDC.

Safebucket is intended for users and organizations requiring a private, flexible file distribution system with granular access controls and the ability to customize the underlying technology stack.