Open source · Apache-2.0 · Docker or Proxmox VE
Send files from your own S3 bucket.
CrabS3 is a self-hosted transfer platform for any S3-compatible storage. Resumable multipart uploads, download limits, automatic deletion, encrypted secrets. Your keys, your bucket, your retention rules.
- No cloud vendor
- No monthly bill
- No file size cap
Three things hosted transfer services will not do
01
The bucket is yours
File bytes never leave your storage. CrabS3 holds presigned URLs and metadata — RustFS, MinIO, Ceph, Wasabi or AWS S3 all work unchanged.
02
Links that delete themselves
Set a deadline, a download count, or both. When the quota is spent the object is removed from storage — not just hidden behind a 404.
03
Secrets, not just files
Send a password, a token or a note through the same pipeline. Password-protected, time-limited, gone after reading.
How a transfer actually works
Nothing is proxied through the app server. The browser talks straight to your storage; CrabS3 signs the requests and keeps the metadata.
- upload
- bucket
- share link
- N downloads or T days
- archive or delete
STEP 1
Multipart upload
Parts go up in parallel against presigned URLs. A dropped connection resumes instead of restarting.
STEP 2
Metadata in Postgres
Owner, size, hash, expiry, download quota, password hash. Duplicate uploads are caught by hash, not stored twice.
STEP 3
Scan, then publish
ClamAV inspects the object. A hit flags the file and refuses download — the link never becomes usable.
STEP 4
Expire on schedule
A cron container sweeps expired objects: archived to cold storage or deleted, per EXPIRED_FILE_POLICY.
Everything in the box
One container, one database, one bucket pair. No paid tier, no feature gate.
01
Resumable uploads
Multipart transfers with live per-part progress. A dropped connection continues where it stopped.
02
Hot and cold tiers
Serve from fast storage, archive to cheap storage. Replication belongs to the backend.
03
Download quotas
A file can allow three downloads and then delete itself. No manual cleanup.
04
Malware scanning
ClamAV inspects every object. Infected files are flagged and blocked from download.
05
Encrypted secrets
Passwords, tokens and notes travel through the same retention rules as files.
06
Accounts and 2FA
Invite-only signup, sessions, TOTP two-factor, and a storage quota per user.
07
Notifications
Email on upload, download and share. Webhooks for whatever you built yourself.
08
Audit log
Every action recorded with a level you control, filterable by action and date.
Or send a secret
Stop pasting credentials into chat.
A secret is a short text payload with the same guarantees as a file: optional password, hard expiry, and a read counter that destroys it. Nothing lands in a message history you cannot purge.
Secret API →Questions people actually ask
Storage, retention, access and compatibility — the four things every operator checks before deploying.
- Where are my files stored?
- In the S3 bucket you configured. CrabS3 stores metadata in Postgres and signs requests — object bytes never pass through the app server.
- When exactly is a file deleted?
- When its deadline passes or its download quota is spent, whichever comes first. A scheduled job then archives or deletes the object according to EXPIRED_FILE_POLICY.
- Can anyone sign up on my instance?
- No. Signup requires an invite issued by an admin, so a public instance does not become a free file host for strangers.
- Does it work with AWS S3 or MinIO?
- Yes. Any S3-compatible endpoint works — RustFS, MinIO, Ceph, Wasabi, AWS S3. Only the endpoint and keys change.
- Can I use a free S3 tier?
- Yes. CrabS3 does not charge for storage or bandwidth. You pay your S3 provider only.
- Do I have to run Docker?
- No. Alongside Docker Compose, a community-scripts LXC install is available for Proxmox VE — Node.js, PostgreSQL and ClamAV set up directly in the container, no Docker inside it.
Your storage. Your rules. Ten minutes.
Fill in a bucket and a Postgres URL, then docker compose up -d — or run the Proxmox VE script and skip Docker entirely.