Inital build

deployment.md

@@ -0,0 +1,76 @@
+# Drive Deployment Documentation
+
+This document covers everything you need to know to deploy and manage the Drive application. The stack consists of a high-performance Go + SQLite backend and a Next.js frontend, bundled together into a single, lightweight Docker container.
+
+## Architecture & System Requirements
+
+- **Backend**: Go (Fiber) running in WAL mode with SQLite for exceptional concurrency.
+- **Frontend**: Next.js compiled into static assets served directly by the Go binary for optimal performance.
+- **Media Support**: Built-in FFmpeg processing for video thumbnails and fast image resizing.
+- **Data Persistence**: A single `/app/data` volume containing both your raw files and the SQLite metadata database (`drive.db`).
+
+### Recommended Specs
+- **CPU**: 1-2 Cores (More cores significantly accelerate FFmpeg video thumbnailing)
+- **RAM**: 512MB minimum (1GB+ recommended for large concurrent video uploads)
+- **Storage**: Sufficient space for your files.
+
+---
+
+## Deploying on Unraid
+
+The application is heavily optimized for Unraid and native folder structures.
+
+1. **Port Configuration**: The default internal port is `5827`. You can easily map this to any available port on your Unraid host using the Docker template or Compose file.
+2. **Volume Mapping**: Map your Unraid array (e.g., `/mnt/user/Drive`) to the `/app/data` container path.
+
+### Docker Compose Example
+
+```yaml
+services:
+  drive:
+    build: .
+    container_name: drive
+    ports:
+      - "5827:5827"
+    volumes:
+      # Map your Unraid array path here
+      - /mnt/user/Drive:/app/data
+    restart: unless-stopped
+    environment:
+      - PORT=5827
+```
+
+---
+
+## First-Run Setup
+
+1. Start the container: `docker-compose up -d`
+2. Open your browser to `http://<your-unraid-ip>:5827`.
+3. You will be greeted by the **First-Run Wizard**.
+4. Create your initial admin account (username and password).
+5. (Recommended) Enable 2FA in the Settings menu once logged in for additional security against brute-force attacks.
+
+---
+
+## Core Features & Maintenance
+
+### File Versioning
+When enabled in Settings, any time a file is overwritten (via web UI, WebDAV, or Tus upload), the older version is automatically moved to the hidden `.versions/` directory. Older versions are pruned automatically based on your Settings configuration.
+
+### WebDAV Access
+Drive supports native OS mounting via WebDAV (Windows Explorer, macOS Finder).
+- **URL**: `http://<your-unraid-ip>:5827/webdav/`
+- **Authentication**: Use your standard Drive username and password.
+
+### Automated Backups
+The container runs a daily background worker that safely executes a `sqlite3 .backup` command to create `drive.db.backup` in your `/app/data` folder. This ensures your metadata (share links, settings, users) is protected even if the live database encounters an issue during a power loss.
+
+---
+
+## Security Features
+
+- **Path Jailing**: All file operations are rigorously sanitized and jailed to the `/app/data` directory to prevent directory traversal attacks (`../` exploits).
+- **Brute-Force Protection**: The login API employs an exponential backoff mechanism.
+- **JWT Authentication**: Short-lived access tokens with secure refresh token rotation.
+- **Rate Limiting**: Public share endpoints are rate-limited to prevent abuse and denial-of-service against the backend.
+- **Zip Slip Prevention**: The background archive extraction worker explicitly sanitizes all incoming archive paths before writing them to the disk.