Limatura / tessera

Tessera 
 Self-hosted file and note sharing that cleans up after itself. 
 English · 繁體中文 · 简体中文 · 日本語 
https://github.com/user-attachments/assets/f1c95b78-8561-4184-9616-c57e3fa3bc5a
Upload a file, a folder, a snippet of code or a link, and get back a short code and a URL. Whoever has them can open it until it expires or has been downloaded as many times as you allowed. Then it is deleted.
No account is needed to send something, unless you turn that off. Tessera runs as one binary with the web app built in, keeps its data in SQLite, PostgreSQL or MySQL, and stores files on local disk or in object storage.
## Who it is for
**Just you, and people you trust.** Run it on a NAS or a home server, behind your VPN, to move files between your own devices or hand them to friends. The defaults suit this: anonymous uploads on, SQLite and local disk, nothing else to set up. See the personal example.
**A public instance for strangers.** Anyone can upload, so every resource is spent by people you do not know. Cap the file size and the total storage, shorten the default lifetime, keep sign-up closed or invite-only, and point it at a malware scanner. See the public example.
**A team or an organization.** Turn anonymous uploads off and let people sign in through your company's OpenID Connect provider. Roles control who may upload, who may see everyone's shares and who may change settings, and each account can have its own quota. PostgreSQL and S3-compatible storage scale past one machine.
## Features
### Under the hood
- **Big files can skip your server.** With S3 or Google Cloud Storage behind it, uploads go straight to the bucket and plain downloads are redirected there. A share with a password or a download limit always comes through the server, so those limits still hold.
- **Limits that hold under load.** A retrieval is counted in one conditional database update, so two people racing for a one-time share cannot both get it. Expiry is checked on every request, and code lookups are rate-limited.
- **Streams instead of buffering.** Memory use stays flat however large the file.
- **Storage you can mix.** Local disk, S3-compatible stores, Azure Blob, Google Cloud Storage and WebDAV, several at once, added or retired from the admin panel without a restart. One large file can even be split across buckets (off by default).
- **SQLite, PostgreSQL or MySQL**, each with its own hand-written migrations.
- **An API to build on.** The OpenAPI contract is generated from the server code, checked in CI and fuzz-tested. The CLI and API tokens use the same endpoints as the web app.
- **Quotas and limits** per role, per account and for anonymous uploads together, plus resumable uploads and optional malware scanning.
### For the people using it
- **Expiry and download limits.** Each share has a lifetime and, optionally, a maximum number of retrievals.
- **Passwords**, required before anything is shown or downloaded.
- **Previews.** Code is syntax-highlighted, and images, SVGs an