Deploy Sprag
One binary behind the channel you choose.
Sprag needs a public or onion base URL, session secret, admin password hash, SQLite path, and S3-compatible storage. The deployment mode sets how much the server can see.
Common start
Configure secrets first.
cp .env.example .env
openssl rand -base64 32
docker compose run --build --rm sprag-app hash-passwordModes
Pick the deployment that matches the channel.
| Mode | Use when | Core settings | Boundary |
|---|---|---|---|
| Plain HTTPS intake | Fast accountless intake when the Sprag server may read uploaded files. | E2E_INTAKE_ENABLED=false, IP_STORAGE_MODE=plain | Simple and useful, but not server-blind. |
| HTTPS plus E2E required | Sensitive-file intake where the server and bucket should store ciphertext only. | E2E_INTAKE_ENABLED=true, E2E_INTAKE_REQUIRED=true, IP_STORAGE_MODE=hmac-sha256 | Private-key backup is mandatory. Browser-delivered crypto still trusts the host at upload time. |
| Onion-only plus E2E | High-privacy intake where uploaders should not connect to a clearnet Sprag host. | ANONYMOUS_INGRESS=true, TRUSTED_PROXY_HOPS=0, onion BASE_URL, E2E required | No uploader IP metadata, coarser abuse limits, and cloud S3 egress remains visible to the storage provider. |
Commands
HTTPS and Tor use different Compose paths.
Plain HTTPS or HTTPS plus E2E
SPRAG_DOMAIN=sprag.example.com docker compose up --build -dOnion-only Tor service
docker compose -f docker-compose.tor.yml up --build -d
docker compose -f docker-compose.tor.yml exec tor cat /var/lib/tor/sprag/hostname