Community Fork

Self-hosted file management and sharing platform — fully open source, actively maintained.

This is an actively maintained fork of cloudreve/cloudreve. All original work is by the Cloudreve authors (cloudreve.org). This fork exists because upstream development had slowed: it continues the project as a complete, fully open-source distribution — backend, web frontend, desktop clients for Windows/macOS/Linux, and a native Android app — with every "Pro"-class feature reimplemented as free software. See NOTICE for attribution.

Downloads #

Server	docker run -d -p 5212:5212 -v backend_data:/cloudreve/data ghcr.io/dvorinka/cloudreve:latest — or a standalone binary from Releases
Desktop	Windows/macOS/Linux sync client — on-demand files, Explorer share menu, in-app updates: latest desktop release
Android	Signed APK (sideload) and AAB (Play): android-v1.1.0

What this fork does differently #

• No Pro tier. The upsell UI (ProChip/ProDialog) is removed. Pro-class capabilities are being reimplemented as open features: share collaboration (upload/edit/preview-only/drop-box shares), OIDC SSO, delegated admin roles — already shipped.
• Upstream issue backlog triaged and fixed. All 137 migrated upstream issues are tracked in this repo's issue tracker; ~70% are closed. WebDAV mounts/read-only/collision handling, stuck uploads, recycle-bin fail-safes, SQLite WAL, MySQL parseTime, unix-socket migrations, and dozens more.
• Security hardening on top of upstream's fixes. OAuth public clients no longer ship hardcoded secrets (PKCE only, per RFC 8252); SSRF validation on remote-download URLs; delegated-admin access is audit-logged; auth endpoints are rate-limited; the downloader layer was reviewed for process execution and path-safety.
• One monorepo. Backend + frontend + desktop + Android live here; no submodules.
• Tests and CI are real. GitHub Actions run backend tests, frontend typecheck/build, and the desktop matrix (Windows/macOS/Linux) on every PR.

Migrating from upstream Cloudreve #

This fork is a drop-in replacement: same schema lineage (4.19.x → 4.20.x), same /cloudreve/data volume layout, same CR_CONF_* env vars, same port 5212. Existing accounts, files, shares, and settings carry over — schema migrations run automatically on first boot. Back up your data volume and database first, as with any upgrade.

Docker Compose — one command (backs up your compose file, swaps the image, restarts):

curl -sSL https://raw.githubusercontent.com/Dvorinka/cloudreve/master/migrate.sh | sh -s -- /path/to/compose/dir

Or edit docker-compose.yml by hand — only the image changes, everything else stays identical to the upstream compose setup:

 services:
   cloudreve:
-    image: cloudreve/cloudreve:v4
+    image: ghcr.io/dvorinka/cloudreve:latest

docker compose pull && docker compose up -d

Plain docker — same flags, new image:

docker stop cloudreve && docker rm cloudreve
docker run -d --name cloudreve --restart unless-stopped \
  -p 5212:5212 -v backend_data:/cloudreve/data \
  ghcr.io/dvorinka/cloudreve:latest

Binary — stop the service, drop in the binary from Releases, start. Your data/ directory (SQLite, uploads, conf.ini) is untouched.

Notes:

• Tags: latest / slim track the newest release; pin ghcr.io/dvorinka/cloudreve:v4.20.0 for reproducibility. Slim drops aria2, LibreOffice, ffmpeg, and font/media tooling.
• CR_LICENSE_KEY has no effect — Pro-class features are reimplemented as free features; the key is simply ignored.
• Migration is supported from upstream ≤ 4.19.x. If you run a newer upstream than our latest release, wait for the next tag rather than downgrading the schema.

Repository layout #

.                    Go backend — Gin + ent ORM (SQLite/MySQL/PostgreSQL)
frontend/            Web SPA — React + TypeScript + Vite + MUI (vendored, no submodule)
desktop/             Desktop client — Tauri/Rust sync engine (Windows cfapi, Linux FUSE;
                     macOS hydration on the roadmap)
android/             Native Android client — Kotlin + Jetpack Compose (v1.1.0 shipped)
cli/                 Terminal client — TypeScript CLI on @cloudreve/sdk (vendored from
                     cloudreve/cli; build with `bun install && bun run build`, binary: `cr`)
docs/                Documentation site — VitePress, EN + ZH (vendored from cloudreve/docs;
                     `npm ci && npm run dev`, build with `npm run build`)
.github/workflows/   CI (backend, frontend, desktop matrix) + release pipeline

Features #

• Storage providers: local, remote node, S3-compatible, OneDrive, OSS, COS, Qiniu, Upyun, KS3, OBS.
• Direct upload/download between client and storage; chunked, resumable, parallel uploads.
• Remote download: aria2, qBittorrent, and yt-dlp providers, multi-node with per-node settings, group-level concurrent/size quotas.
• Share links with expiration — plus fork additions: upload-only drop boxes, edit-in-place, preview-only mode, anonymous upload, IP-restricted views.
• Archive compress/extract, media metadata extraction, metadata/tag search.
• WebDAV across all storage providers (read-only group enforcement fixed in this fork).
• Agents (MCP): authenticated streamable HTTP at POST /api/v4/mcp. Tokens are created under Settings → Agents or Connect → MCP and act as that user.
• SSO: generic OIDC inbound consumer (auth-code + nonce, JWKS-verified, auto-provisioning), OAuth public clients with PKCE, passkeys, TOTP 2FA.
• Multi-user, multi-group; admin task list with CIDR-capable creator-IP filtering; per-user trash retention; per-group remote-download quotas.
• Preview: image (progressive thumbnail→full-res), video, audio, ePub, Markdown, diagrams, Office documents (WOPI), 3D models.
• PWA, dark mode, i18n (en-US, zh-CN, and more), theme customization, custom HTML injection.
• Desktop client: on-demand placeholder sync (Windows cfapi, Linux FUSE), FileCloud-style share dialog from the Explorer right-click menu, in-app self-updates.
• Server self-update: admins can upgrade in place from the dashboard.

Agents (MCP) #

Cloudreve exposes the signed-in user's files to MCP clients (Cursor and others) at POST /api/v4/mcp. Create a token in Settings → Agents or Connect → MCP. The secret is shown once. It lasts 30 days, can be revoked from the same page, and stops working if the password changes. The page also copies a client config:

{
  "mcpServers": {
    "cloudreve": {
      "type": "http",
      "url": "https://your-site.example/api/v4/mcp",
      "headers": { "Authorization": "Bearer TOKEN" }
    }
  }
}

The token can read, change, and share that user's files. Paths look like cloudreve://my and cloudreve://trash. OAuth tokens need Files.Read / Files.Write and Shares.Read / Shares.Write. Details: docs/en/usage/mcp.md.

Build from source #

Prereqs: Go ≥ 1.24, Node ≥ 20 + Yarn, (desktop) Rust + platform Tauri deps.

# Frontend
cd frontend && yarn install
NODE_OPTIONS=--max-old-space-size=6144 yarn build   # emits build/ consumed by the Go embed

# Backend (repo root) — the binary serves frontend + API on :5212
go build -o cloudreve .
./cloudreve

Desktop client: see desktop/CLAUDE.md (cargo tauri build, Windows-first; other platforms WIP).

Development #

go build ./... && go vet ./... && go test ./...          # backend gate
cd frontend && yarn tsc --noEmit && yarn build           # frontend gate

docker-compose.dev.yml brings up postgres + redis + a source-built backend; yarn dev gives frontend hot reload. PRs land via feature branches — never push to master — and must pass all CI jobs before merge.

Status scorecard #

Area	State
Backend / frontend	Stable — 4.20.x line, all CI green
Upstream issues	~70% of the 137 migrated issues closed; remainder are feature-scale, Pro-surface, or device-bound
Code health	desloppify strict score 77.1 (was 18.9); 73 review items dispositioned
Desktop client	Shipped for Windows (cfapi sync + Explorer share menu) and Linux (FUSE hydration); in-app updater live
Android client	Shipped — v1.1.0 signed APK/AAB on Releases
Pro-free features	Share collaboration ✓, OIDC SSO ✓, delegated admins ✓; storage-policy migration, VAS/billing, audit surface in progress

Known limitations and the full plan: ROADMAP.md · issue tracker has honest per-issue status.

Contributing #

This project is community-maintained and contributions are genuinely welcome — code, translations, bug reports, ideas, documentation, testing, anything. If something is broken or missing, open an issue — every report gets looked at. If you want to fix it yourself, open a PR against master; CI must pass before merge.

This project only moves forward because people care enough to use it and report what they find. Thank you for being part of that.

Security #

Report vulnerabilities privately via GitHub's "Report a vulnerability" on this repo — do not open a public issue. All 16 published upstream GHSAs are patched at our baseline; our own additions are reviewed for SSRF, path traversal, process execution, and session entropy before merge.

Credits #

Cloudreve was created by Aaron Liu and the Cloudreve contributors (cloudreve.org). This fork is an independent continuation under the same GPL-3.0 license — attribution, not endorsement. See NOTICE for the full attribution statement.

License #

GPL-3.0 — same as upstream. Contributions are licensed identically.