DOCSEARCHbyAlgolia
Submit Docs

send

repository·master·Indexed 26 days ago

https://github.com/timvisee/send

A file sharing experiment and Android app for securely sharing files via password encryption and time-limited or single-use download URLs. Version 3.4.27 includes a web interface and Android application with varying file size limits (1GB to 2.5GB) and expiration policies based on authentication via Firefox Accounts. The project includes documentation for server configuration, Docker Compose deployment, and AWS resource provisioning using S3, EC2, and ALB.

Tokens
10.2K
Snippets
18
Records
65
Agent score
88%

What's inside send

  1. Overview of the Send Android app

    master

    The Send Android app enables users to select files from an Android device, encrypt them with a password, and generate a secure download URL.

    Default URL Expiration Policy:

    • Expires after one download, OR
    • Expires after 24 hours (whichever comes first).

  2. Understand the purpose of Common Code

    master
    The common/ directory contains shared modules used by both the frontend app and the backend server (including the development server). The primary purpose of these modules is to provide mappings between source asset filenames (e.g., copy-16.png) and their concrete, hashed production filenames (e.g., copy-16.db66e0bf.svg).

  3. Send V2 Web User Capabilities and Limits

    master

    The Send V2 web interface provides different capabilities and constraints based on the user's authentication status via a Firefox Account.

    Non-Authenticated Users

    • File Limit: Maximum sendable file size is 1GB.
    • Expiration Options: Users can set expiration times of 5 minutes, 1 hour, or 24 hours.
    • Download Limits: Users can set a download count of 1.
    • Authentication: Users can log in or create a Firefox Account to unlock higher limits.

    Authenticated Users (via Firefox Account)

    • File Limit: Users can send up to 2.5GB per Send.
    • Expiration Options: Users can extend Send times up to 1 week.
    • Download Limits: Users can extend Send download counts up to 100 times.
    • Session Management: Users can sign in and sign out via their Firefox Account.

  4. Understand the application structure in app/

    master

    The app/ directory contains the core browser-side code that is bundled into app.[hash].js. This directory houses the application's logic, cryptographic functions, and UI components. While primarily intended for browser execution, some parts are utilized by the server for Server Side Rendering (SSR).

    Key subdirectories include:

    • pages: Contains display logic and markup for full pages.
    • routes: Contains route definitions and logic.
    • templates: Contains smaller UI elements (components) used within pages.

  5. Understand the File Encryption Workflow

    master

    Send implements end-to-end encryption using 128-bit AES-GCM via the Web Crypto API. Files are encrypted in the browser before they reach the server. The encryption process involves generating a secret key via crypto.getRandomValues and deriving multiple keys using HKDF SHA-256:

    • Encryption keys for the file: AES-GCM (via ECE RFC 8188)
    • Encryption key for file metadata: AES-GCM
    • Signing key for request authentication: HMAC SHA-256

    The secret key is never sent to the server; instead, it is appended to the share URL as a #fragment (e.g., https://example.com/share/id#secret_key).

  6. Quickstart with Docker

    master

    You can use the official image from the GitLab registry or build it locally.

    Using the GitLab Registry: Pull the latest image using:

    docker pull registry.gitlab.com/timvisee/send:latest

    Building Locally: Clone the repository and run:

    docker build -t send:latest .
    docker pull registry.gitlab.com/timvisee/send:latest

  7. Delist a file from the service via Redis

    master

    To make a file inaccessible and delisted from the service (e.g., for DMCA notices or abuse), remove its record from the Redis server.

    1. Identify the file id from the share link. For example, in https://send.firefox.com/download/3d9d2bb9a1, the ID is 3d9d2bb9a1.
    2. From a host with access to the Redis server, execute the DEL command using that ID.
    redis-cli DEL 3d9d2bb9a1

  8. Run Send in development mode

    master

    To start a development environment, use npm start. This launches a webpack-dev-server on port 8080 which:

    • Compiles assets in memory (no dist/ directory is created).
    • Watches files for changes.
    • Serves the backend API and frontend unit tests via the server/bin/dev.js entrypoint.

    You can run frontend tests in the browser by navigating to http://localhost:8080/test. Tests will rerun automatically when watched files are saved.

    npm start

  9. Install and Configure Send Application

    master

    Follow these steps to set up the Send application directory, clone the repository, and configure environment variables.

    1. Prepare directory: Create /var/www/send and set ownership to www-data.
    2. Clone and Build: Use the www-data user to clone the repository, run npm install, and npm run build.
    3. Configure Environment: Create /var/www/send/.env with required variables.
    4. Set Permissions: Apply strict permissions to files and folders.

  11. Configure Apache as a Reverse Proxy for Send

    master

    To avoid exposing port 1443 directly, use Apache as a reverse proxy.

    1. Enable required Apache modules

    Run the following commands to enable the necessary modules:

    sudo a2enmod headers
sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod proxy_wstunnel
sudo a2enmod rewrite

    2. Update Virtual Host configuration

    Insert the following configuration into your Apache virtual host file. This configuration ensures that:

    • The original domain name is preserved (ProxyPreserveHost on).
    • Generated URLs use https (X-Forwarded-Proto https).
    • Static files (like PNG or CSS) are served directly by Apache.
    • WebSocket connections are routed to the Send WS connection.
    • All other requests are routed to the Send HTTP connection.
    # Enable rewrite engine
RewriteEngine on

# Make sure the original domain name is forwarded to Send
ProxyPreserveHost on

# Make sure the generated URL is https
RequestHeader set X-Forwarded-Proto https

# If it's a normal file (e.g. PNG, CSS) just return it
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule .* - [L]

# If it's a websocket connection, redirect it to a Send WS connection
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) ws://127.0.0.1:1443/$1 [P,L]

# Otherwise redirect it to a normal HTTP connection
RewriteRule ^/(.*)$ http://127.0.0.1:1443/$1 [P,QSA]
ProxyPassReverse  "/" "http://127.0.0.1:1443"

    3. Test and Restart

    Always test your configuration before restarting Apache:

    sudo apache2ctl configtest
sudo systemctl restart apache2

  12. Report experiment results to Google Analytics

    master

    To ensure an action is counted as the experiment goal (the "Objective"), trigger an 'experiment' event using the app's emitter.

    Pass an object as the second argument containing a custom dimension (e.g., a key like cd3) that matches the configuration set up in Google Analytics.