drive/deployment.md

Drive Deployment Documentation

This document covers everything you need to know to deploy and manage the Drive application. The stack consists of a high-performance Go + SQLite backend and a Next.js frontend, bundled together into a single, lightweight Docker container.

Architecture & System Requirements

• Backend: Go (Fiber) running in WAL mode with SQLite for exceptional concurrency.
• Frontend: Next.js compiled into static assets served directly by the Go binary for optimal performance.
• Media Support: Built-in FFmpeg processing for video thumbnails and fast image resizing.
• Data Persistence: A single /app/data volume containing both your raw files and the SQLite metadata database (drive.db).

Recommended Specs

• CPU: 1-2 Cores (More cores significantly accelerate FFmpeg video thumbnailing)
• RAM: 512MB minimum (1GB+ recommended for large concurrent video uploads)
• Storage: Sufficient space for your files.

---

Deploying on Unraid

The application is heavily optimized for Unraid and native folder structures.

1. Port Configuration: The default internal port is 5827. You can easily map this to any available port on your Unraid host using the Docker template or Compose file.
2. Volume Mapping: Map your Unraid array (e.g., /mnt/user/Drive) to the /app/data container path.

Docker Compose Example

services:
  drive:
    build: .
    container_name: drive
    ports:
      - "5827:5827"
    volumes:
      # Map your Unraid array path here
      - /mnt/user/Drive:/app/data
    restart: unless-stopped
    environment:
      - PORT=5827

---

First-Run Setup

1. Start the container: docker-compose up -d
2. Open your browser to http://<your-unraid-ip>:5827.
3. You will be greeted by the First-Run Wizard.
4. Create your initial admin account (username and password).
5. (Recommended) Enable 2FA in the Settings menu once logged in for additional security against brute-force attacks.

---

Core Features & Maintenance

File Versioning

When enabled in Settings, any time a file is overwritten (via web UI, WebDAV, or Tus upload), the older version is automatically moved to the hidden .versions/ directory. Older versions are pruned automatically based on your Settings configuration.

WebDAV Access

Drive supports native OS mounting via WebDAV (Windows Explorer, macOS Finder).

• URL: http://<your-unraid-ip>:5827/webdav/
• Authentication: Use your standard Drive username and password.

Automated Backups

The container runs a daily background worker that safely executes a sqlite3 .backup command to create drive.db.backup in your /app/data folder. This ensures your metadata (share links, settings, users) is protected even if the live database encounters an issue during a power loss.

---

Security Features

• Path Jailing: All file operations are rigorously sanitized and jailed to the /app/data directory to prevent directory traversal attacks (../ exploits).
• Brute-Force Protection: The login API employs an exponential backoff mechanism.
• JWT Authentication: Short-lived access tokens with secure refresh token rotation.
• Rate Limiting: Public share endpoints are rate-limited to prevent abuse and denial-of-service against the backend.
• Zip Slip Prevention: The background archive extraction worker explicitly sanitizes all incoming archive paths before writing them to the disk.