For self-hosters
A small box you can inspect.
Sprag is one binary, one config file, one SQLite metadata store, and one S3-compatible bucket. Start as a plain one-way upload box; harden only the parts your threat model needs.
Operational shape
No platform sprawl.
- Embedded frontend, Go backend, pure-Go SQLite.
- File bodies stream to S3-compatible storage.
- Plain, HMAC, or no uploader IP metadata depending on ingress.
- Docker Compose with Caddy, or onion-only Tor Compose.
Choose the mode
From simple intake to onion-only E2E.
Sprag should not force every operator into the heaviest deployment. The same product can run as a simple file dump, a server-blind E2E intake box, or a Tor-only channel with anonymous ingress controls.
| Mode | Use when | Core settings | Boundary |
|---|---|---|---|
| Plain HTTPS intake | Fast accountless intake when the Sprag server may read uploaded files. | E2E_INTAKE_ENABLED=false, IP_STORAGE_MODE=plain | Simple and useful, but not server-blind. |
| HTTPS plus E2E required | Sensitive-file intake where the server and bucket should store ciphertext only. | E2E_INTAKE_ENABLED=true, E2E_INTAKE_REQUIRED=true, IP_STORAGE_MODE=hmac-sha256 | Private-key backup is mandatory. Browser-delivered crypto still trusts the host at upload time. |
| Onion-only plus E2E | High-privacy intake where uploaders should not connect to a clearnet Sprag host. | ANONYMOUS_INGRESS=true, TRUSTED_PROXY_HOPS=0, onion BASE_URL, E2E required | No uploader IP metadata, coarser abuse limits, and cloud S3 egress remains visible to the storage provider. |
What stays small
No accounts for uploaders. No folders. No workflow engine.
The public side is intentionally narrow: page metadata, optional PIN, and upload. Admin workflows live behind authentication. The product does not become a shared drive just because a page receives many files.
For the search-shaped version of this operator path, see the self-hosted file drop page.