Ferrite: self-hosted file storage in Laravel, Livewire and Flux UI (open source, with a live demo)

I've built a small self-hosted file server called Ferrite. It is web-only file storage for one person or a small team that you run on your own server, and it is open source (AGPL-3.0). You can try it without installing anything: demo.ferrite.stackcare.pt (one click, a throwaway account that is wiped after an hour; small images, PDFs and text only).

Why I built it

I come from a sysadmin background, and I wanted private file storage that is boring to run: one app, a database, a folder, and nothing else to keep alive. Most of what I found was either a full cloud suite or a sync tool, and I wanted something smaller. I also wanted to see how far a small, opinionated Laravel app could go when it only does one job.

It is deliberately narrow: no sync clients and no WebDAV. You open it in a browser, upload, preview, share and search.

What it does

• Uploads that survive bad connections. Chunked and resumable, so multi-gigabyte files and flaky Wi-Fi are fine. Whole folders by drag and drop.
• Previews and sharing. Images, PDF, video, audio and text open in the browser. Share by link with a password or an expiry, with other users as viewer or editor, or give a guest an upload-only link to one folder.
• Search inside your files. Names, and the text of text files, Markdown, code, CSV and PDFs, with highlighted snippets.
• A small API for scripts and other apps: personal access tokens made under Settings > API tokens, optionally limited to one folder, with list, Range download and chunked upload. Write tokens never replace or rename; a taken name answers 409.
• When a name already exists, it asks: replace (same file, its links and favorites stay), keep both, skip, or cancel.
• Users and storage. Several users with quotas, 2FA and passkeys; files on a local folder, S3 or SFTP.
• Fifteen themes, because I like retro interfaces: Classic Mac, Amiga, a Nokia 3310 screen, Miami Vice and more. They are optional, and you can switch them in the demo under Settings > Appearance.

How it is built

Laravel 13, Livewire, Flux UI, Tailwind and Pest, with about 550 tests. A few decisions I found interesting:

• The slow part never blocks a request. The last upload chunk only queues a job. The job hashes the file and copies it to its disk, which can take minutes on SFTP or S3. It runs on its own queue connection with a retry_after longer than the job's timeout, so a long copy is never started twice.
• Search works on SQLite and MySQL. It uses FTS5 on SQLite and a FULLTEXT index on MySQL and MariaDB, behind one small interface. The CI runs the search tests on both.
• Serving users' files from your own origin needs care. Files only display inline for an allowlist of safe types, everything else is a download, with nosniff on every response. There is a written security review in the repository.
• Names and folders live only in the database. The files themselves are blobs under random keys, so renaming or moving something never touches the disk.

Honest limits

• No versioning, sync clients, WebDAV, office previews or real-time collaboration.
• S3 is tested up to the adapter, not against a real S3 service. SFTP was tested on a Hetzner Storage Box.
• No independent security audit yet, and no encryption at rest (it is planned).
• It is young: version 0.3.0.

What I'd like from you

If you try the demo or read the install docs, tell me what felt confusing or broke. I'd especially like to hear where the install guide lost you, and whether the security notes in the repository (docs/security.md) cover what you would worry about before putting your files on it.

Try it

• Demo: https://demo.ferrite.stackcare.pt
• Project page: https://ferrite.stackcare.pt
• Code: https://github.com/zhoorta/ferrite (AGPL-3.0)
• Install: docker compose up -d, or a normal Laravel install. The README has both routes.

Disclosure: I built Ferrite and I use an AI coding assistant (Claude) while developing it; I review and test what it writes. An AI assistant also helped me draft this post, and I edited it and checked the claims against the code. I chose the "AI-assisted" option when publishing.