# Drop

Minimal password-protected file sharing. Upload one file up to 4 GiB, choose its lifetime in days, and copy a direct five-character link. Links accept either letter case. Images display inline; other files download with their original names. Expired files are deleted automatically.

```sh
./install.sh
cat .passwd
./run.sh
```

The installer uses an existing Node.js >=22.13 with npm, or downloads Node.js 24.18.0 into `.runtime/node` on Linux/macOS x64/arm64. It installs backend dependencies from `package-lock.json` and creates a random `.passwd` only when that file does not exist. TypeScript and tsx are not needed; the backend is plain JavaScript.

The server listens on `127.0.0.1:8787`. Put a reverse proxy in front of it for public access, for example:

```caddyfile
http://drop.example.com {
    reverse_proxy 127.0.0.1:8787
}
```

Keep the project directory writable. Uploaded files and SQLite metadata live in `data/`. `.passwd`, `data/`, dependencies and the local Node runtime are excluded from Git. Edit `.passwd` to change the password; existing sessions will be invalidated.