# Drive Deployment Documentation

This document covers everything you need to know to deploy and manage the Drive application. The stack consists of a high-performance Go + SQLite backend and a Next.js frontend, bundled together into a single, lightweight Docker container.

## Architecture & System Requirements

- **Backend**: Go (Fiber) running in WAL mode with SQLite for exceptional concurrency.
- **Frontend**: Next.js compiled into static assets served directly by the Go binary for optimal performance.
- **Media Support**: Built-in FFmpeg processing for video thumbnails and fast image resizing.
- **Data Persistence**: A single `/app/data` volume containing both your raw files and the SQLite metadata database (`drive.db`).

### Recommended Specs
- **CPU**: 1-2 Cores (More cores significantly accelerate FFmpeg video thumbnailing)
- **RAM**: 512MB minimum (1GB+ recommended for large concurrent video uploads)
- **Storage**: Sufficient space for your files.

---

## Deploying on Unraid

The application is heavily optimized for Unraid and native folder structures.

1. **Port Configuration**: The default internal port is `5827`. You can easily map this to any available port on your Unraid host using the Docker template or Compose file.
2. **Volume Mapping**: Map your Unraid array (e.g., `/mnt/user/Drive`) to the `/app/data` container path.

### Docker Compose Example

```yaml
services:
  drive:
    build: .
    container_name: drive
    ports:
      - "5827:5827"
    volumes:
      # Map your Unraid array path here
      - /mnt/user/Drive:/app/data
    restart: unless-stopped
    environment:
      - PORT=5827
```

---

## First-Run Setup

1. Start the container: `docker-compose up -d`
2. Open your browser to `http://<your-unraid-ip>:5827`.
3. You will be greeted by the **First-Run Wizard**.
4. Create your initial admin account (username and password).
5. (Recommended) Enable 2FA in the Settings menu once logged in for additional security against brute-force attacks.

---

## Core Features & Maintenance

### File Versioning
When enabled in Settings, any time a file is overwritten (via web UI, WebDAV, or Tus upload), the older version is automatically moved to the hidden `.versions/` directory. Older versions are pruned automatically based on your Settings configuration.

### WebDAV Access
Drive supports native OS mounting via WebDAV (Windows Explorer, macOS Finder).
- **URL**: `http://<your-unraid-ip>:5827/webdav/`
- **Authentication**: Use your standard Drive username and password.

### Automated Backups
The container runs a daily background worker that safely executes a `sqlite3 .backup` command to create `drive.db.backup` in your `/app/data` folder. This ensures your metadata (share links, settings, users) is protected even if the live database encounters an issue during a power loss.

---

## Security Features

- **Path Jailing**: All file operations are rigorously sanitized and jailed to the `/app/data` directory to prevent directory traversal attacks (`../` exploits).
- **Brute-Force Protection**: The login API employs an exponential backoff mechanism.
- **JWT Authentication**: Short-lived access tokens with secure refresh token rotation.
- **Rate Limiting**: Public share endpoints are rate-limited to prevent abuse and denial-of-service against the backend.
- **Zip Slip Prevention**: The background archive extraction worker explicitly sanitizes all incoming archive paths before writing them to the disk.