Documentation

First launch

chmod +x elxcloud-linux-amd64
./elxcloud-linux-amd64 -data /srv/elxcloud -http 8080
# open http://<server>:8080 and sign in as the administrator it prints on first run

elxcloud-windows-x64.exe -data D:\elxcloud -http 8080

Storage layout

Everything lives under the data directory: each user's home folder, the thumbnail cache, the database and the certificates. Moving the installation means moving that directory.

HTTPS and ports

Three ways to get a certificate: obtain one automatically, which also renews it; supply your own pair of files; or generate a self-signed one for a closed network. HTTP can redirect to HTTPS.

Ports for HTTP, HTTPS and FTP, and the passive port range, are changed in the administration panel without restarting the service. A port is checked for availability before the switch, so a typo does not take the server off the network.

FTP and FTPS

• The same login and password as the web interface; FTP can be enabled per account.
• Explicit FTPS via AUTH TLS, using the web interface's certificate.
• Passive mode with a configurable port range — that range has to be open on the firewall as well as the control port.
• Deletions over FTP go to the trash, exactly as they do in the browser.
• A data connection closed without a TLS shutdown counts as a normal end of transfer, because that is what mobile clients do.

Password protection

Any folder or file can be locked with its own password, unrelated to any account. Two modes: fully hidden, or visible but unchangeable.

• The password is asked for on entering the folder and lasts thirty minutes within the session.
• Removing the protection always asks for it again.
• Protection covers everything inside, and travels with the folder when it is renamed or moved.
• A protected object cannot be published as a public link, and is not visible over FTP at all.

Users and quotas

• Accounts are created by the administrator: name, password, quota, whether FTP is allowed.
• An account can be blocked without being deleted, which is usually what you want when somebody leaves.
• Administrator rights are granted and revoked with one button, and the system refuses to remove the last administrator.
• A user changes their own display name, e-mail, password and avatar.
• The event log keeps logins, uploads, deletions and publications for ninety days.

Mail

With SMTP configured, the server can send a warning after a run of failed logins and, if you want it, on every administrator login. Password recovery by e-mail uses a one-time link valid for an hour.

Behind a reverse proxy

If nginx already terminates TLS on the machine, let it: point it at the plain HTTP port and switch the server's own HTTPS off. Two things matter — pass the real client address through, or the login log and the block list will see only the proxy, and raise the proxy's upload limit, or large files will be refused before they reach the application.

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 0;
proxy_request_buffering off;

When something is wrong

Frequently asked questions