Deployment Notes

TURN server for Internet Transfer

Beware that you have to host your own TURN server to enable transfers between different networks. Follow this guide to either install coturn directly on your system (Step 1) or deploy it via Docker (Step 5). You can use the docker-compose-coturn.yml in this repository. See Coturn and ErikrafT Drop via Docker Compose. Alternatively, use a free, pre-configured TURN server like OpenRelay

ErikrafT Drop via HTTPS

On some browsers ErikrafT Drop must be served over TLS in order for some features to work properly. These may include:

Copying an incoming message via the ‘copy’ button
Installing ErikrafT Drop as PWA
Persistent pairing of devices
Changing of the display name
Notifications

Naturally, this is also recommended to increase security.

Deployment with Docker

The easiest way to get ErikrafT Drop up and running is by using Docker.

Docker Image from Docker Hub

docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 lscr.io/linuxserver/pairdrop

⚠️ This is a third-party community image hosted by linuxserver.io. This is based on PairDrop (a similar but unofficial project), not the official ErikrafT Drop. For more information visit https://hub.docker.com/r/linuxserver/pairdrop For official ErikrafT Drop images, build from source using the Dockerfile below.

Docker Image from GitHub Container Registry (ghcr.io)

docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 ghcr.io/schlagmichdoch/pairdrop

⚠️ This is the non-official PairDrop image from the original PairDrop project. This is based on PairDrop (a similar but unofficial project), not the official ErikrafT Drop.

Docker Image self-built

Build the image

docker build --pull . -f Dockerfile -t pairdrop

A GitHub action is set up to do this step automatically at the release of new versions. --pull ensures always the latest node image is used.

Run the image

docker run -d --restart=unless-stopped --name=pairdrop -p 127.0.0.1:3000:3000 -it pairdrop

You must use a server proxy to set the X-Forwarded-For header to prevent all clients from discovering each other (See #HTTP-Server). To prevent bypassing the proxy by reaching the docker container directly, 127.0.0.1 is specified in the run command.

Flags

Set options by using the following flags in the docker run command:

Port

-p 127.0.0.1:8080:3000

Specify the port used by the docker image

3000 -> -p 127.0.0.1:3000:3000

8080 -> -p 127.0.0.1:8080:3000

Set Environment Variables via Docker

Environment Variables are set directly in the docker run command:
e.g. docker run -p 127.0.0.1:3000:3000 -it pairdrop -e DEBUG_MODE="true" Overview of available Environment Variables are found here. Example:

docker run -d \
    --name=pairdrop \
    --restart=unless-stopped \
    -p 127.0.0.1:3000:3000 \
    -e PUID=1000 \
    -e PGID=1000 \
    -e WS_SERVER=false \
    -e WS_FALLBACK=false \
    -e RTC_CONFIG=false \
    -e RATE_LIMIT=false \
    -e DEBUG_MODE=false \
    -e TZ=Etc/UTC \
    lscr.io/linuxserver/pairdrop

Deployment with Docker Compose

Here’s an example docker compose file:

version: "3"
services:
    pairdrop:
        image: "lscr.io/linuxserver/pairdrop:latest"
        container_name: pairdrop
        restart: unless-stopped
        environment:
            - PUID=1000 # UID to run the application as
            - PGID=1000 # GID to run the application as
            - WS_FALLBACK=false # Set to true to enable websocket fallback if the peer to peer WebRTC connection is not available to the client.
            - RATE_LIMIT=false # Set to true to limit clients to 1000 requests per 5 min.
            - RTC_CONFIG=false # Set to the path of a file that specifies the STUN/TURN servers.
            - DEBUG_MODE=false # Set to true to debug container and peer connections.
            - TZ=Etc/UTC # Time Zone
        ports:
            - "127.0.0.1:3000:3000" # Web UI

Run the compose file with docker compose up -d.

You must use a server proxy to set the X-Forwarded-For header to prevent all clients from discovering each other (See #HTTP-Server). To prevent bypassing the proxy by reaching the Docker container directly, 127.0.0.1 is specified in the ports argument.

Deployment with Node.js

Clone this repository and enter the folder

git clone https://github.com/erikraft/Drop.git && cd Drop

Install all dependencies with NPM:

npm install

Start the server with:

npm start

By default, the node server listens on port 3000.

Options / Flags

These are some flags only reasonable when deploying via Node.js

Port

PORT=3000

Default: 3000 Environment variable to specify the port used by the Node.js server
e.g. PORT=3010 npm start

Local Run

npm start -- --localhost-only

Only allow connections from localhost. You must use a server proxy to set the X-Forwarded-For header to prevent all clients from discovering each other (See #HTTP-Server). Use this when deploying ErikrafT Drop with node to prevent bypassing the reverse proxy by reaching the Node.js server directly.

Automatic restart on error

npm start -- --auto-restart

Restarts server automatically on error

Production (autostart and rate-limit)

npm run start:prod

shortcut for RATE_LIMIT=5 npm start -- --auto-restart

Production (autostart, rate-limit, localhost-only)

npm run start:prod -- --localhost-only

To prevent connections to the node server from bypassing
the proxy server you should always use “—localhost-only” on production.

Set Environment Variables via Node.js

To specify environment variables set them in the run command in front of npm start. The syntax is different on Unix and Windows. On Unix based systems

PORT=3000 RTC_CONFIG="rtc_config.json" npm start

On Windows

$env:PORT=3000 RTC_CONFIG="rtc_config.json"; npm start

Overview of available Environment Variables are found here.

Environment Variables

Debug Mode

DEBUG_MODE="true"

Default: false Logs the used environment variables for debugging. Prints debugging information about the connecting peers IP addresses. This is quite useful to check whether the #HTTP-Server is configured correctly, so the auto-discovery feature works correctly. Otherwise, all clients discover each other mutually, independently of their network status. If this flag is set to "true" each peer that connects to the ErikrafT Drop server will produce a log to STDOUT like this:
----DEBUGGING-PEER-IP-START----
remoteAddress: ::ffff:172.17.0.1
x-forwarded-for: 19.117.63.126
cf-connecting-ip: undefined
ErikrafT Drop uses: 19.117.63.126
IP is private: false
if IP is private, '127.0.0.1' is used instead
----DEBUGGING-PEER-IP-END----
If the IP address “ErikrafT Drop uses” matches the public IP address of the client device, everything is set up correctly.
To find out the public IP address of the client device visit https://whatsmyip.com/. To preserve your clients’ privacy:
Never use this environment variable in production!

Rate limiting requests

RATE_LIMIT=1

Default: false Limits clients to 1000 requests per 5 min “If you are behind a proxy/load balancer (usually the case with most hosting services, e.g. Heroku, Bluemix, AWS ELB, Render, Nginx, Cloudflare, Akamai, Fastly, Firebase Hosting, Rackspace LB, Riverbed Stingray, etc.), the IP address of the request might be the IP of the load balancer/reverse proxy (making the rate limiter effectively a global one and blocking all requests once the limit is reached) or undefined.” (See: https://express-rate-limit.mintlify.app/guides/troubleshooting-proxy-issues) To find the correct number to use for this setting:

Start ErikrafT Drop with DEBUG_MODE=True and RATE_LIMIT=1

Make a get request to /ip of the ErikrafT Drop instance (e.g. https://pairdrop-example.net/ip)

Check if the IP address returned in the response matches your public IP address (find out by visiting e.g. https://whatsmyip.com/)

You have found the correct number if the IP addresses match. If not, then increase RATE_LIMIT by one and redo 1. - 4.

e.g. on Render you must use RATE_LIMIT=5

IPv6 Localization

IPV6_LOCALIZE=4

Default: false To enable Peer Auto-Discovery among IPv6 peers, you can specify a reduced number of segments
of the client IPv6 address to be evaluated as the peer’s IP.
This can be especially useful when using Cloudflare as a proxy. The flag must be set to an integer between 1 and 7.
The number represents the number of IPv6 hextets
to match the client IP against. The most common value would be 4,
which will group peers within the same /64 subnet.

Websocket Fallback (for VPN)

WS_FALLBACK=true

Default: false Provides ErikrafT Drop to clients with an included websocket fallback
if the peer to peer WebRTC connection is not available to the client. This is not used on the official https://pairdrop.net website, but you can activate it on your self-hosted instance.
This is especially useful if you connect to your instance via a VPN (as most VPN services block WebRTC completely in order to hide your real IP address). (Read more here). Warning:
All traffic sent between devices using this fallback is routed through the server and therefor not peer to peer! Beware that the traffic routed via this fallback is readable by the server.
Only ever use this on instances you can trust. Additionally, beware that all traffic using this fallback debits the servers data plan.

Specify STUN/TURN Servers

RTC_CONFIG="rtc_config.json"

Default: false Specify the STUN/TURN servers ErikrafT Drop clients use by setting
RTC_CONFIG to a JSON file including the configuration.
You can use rtc_config_example.json as a starting point. To host your own TURN server you can follow this guide: https://gabrieltanner.org/blog/turn-server/ Alternatively, use a free, pre-configured TURN server like OpenRelay Default configuration:
{
  "sdpSemantics": "unified-plan",
  "iceServers": [
    {
      "urls": "stun:stun.l.google.com:19302"
    }
  ]
}

You can host an instance that uses another signaling server This can be useful if you don’t want to trust the client files that are hosted on another instance but still want to connect to devices that use https://pairdrop.net.

Specify Signaling Server

SIGNALING_SERVER="pairdrop.net"

Default: false By default, clients connecting to your instance use the signaling server of your instance to connect to other devices. By using SIGNALING_SERVER, you can host an instance that uses another signaling server. This can be useful if you want to ensure the integrity of the client files and don’t want to trust the client files that are hosted on another ErikrafT Drop instance but still want to connect to devices that use the other instance. E.g. host your own client files under pairdrop.your-domain.com but use the official signaling server under pairdrop.net This way devices connecting to pairdrop.your-domain.com and pairdrop.net can discover each other. Beware that the version of your ErikrafT Drop server must be compatible with the version of the signaling server. SIGNALING_SERVER must be a valid url without the protocol prefix. Examples of valid values: pairdrop.net, pairdrop.your-domain.com:3000, your-domain.com/pairdrop

Customizable buttons for the About ErikrafT Drop page

DONATION_BUTTON_ACTIVE=true
DONATION_BUTTON_LINK="https://ko-fi.com/erikraft"
DONATION_BUTTON_TITLE="Buy me a coffee"
TWITTER_BUTTON_ACTIVE=true
TWITTER_BUTTON_LINK="https://twitter.com/account"
TWITTER_BUTTON_TITLE="Find me on Twitter"
MASTODON_BUTTON_ACTIVE=true
MASTODON_BUTTON_LINK="https://mastodon.social/account"
MASTODON_BUTTON_TITLE="Find me on Mastodon"
BLUESKY_BUTTON_ACTIVE=true
BLUESKY_BUTTON_LINK="https://bsky.app/profile/account"
BLUESKY_BUTTON_TITLE="Find me on Bluesky"
CUSTOM_BUTTON_ACTIVE=true
CUSTOM_BUTTON_LINK="https://your-custom-social-network.net/account"
CUSTOM_BUTTON_TITLE="Find me on this custom social network"
PRIVACYPOLICY_BUTTON_ACTIVE=true
PRIVACYPOLICY_BUTTON_LINK="https://link-to-your-privacy-policy.net"
PRIVACYPOLICY_BUTTON_TITLE="Open our privacy policy"

Default: unset By default, clients will show the default button configuration: GitHub, BuyMeACoffee, Twitter, and FAQ on GitHub. The GitHub and FAQ on GitHub buttons are essential, so they are always shown. The other buttons can be customized:

*_BUTTON_ACTIVE: set this to true to show a natively hidden button or to false to hide a normally shown button

*_BUTTON_LINK: set this to any URL to overwrite the href attribute of the button

*_BUTTON_TITLE: set this to overwrite the hover title of the button. This will prevent the title from being translated.

Healthcheck

The Docker Image hosted on ghcr.io and the self-built Docker Image include a healthcheck. Read more about Docker Swarm Usage.

HTTP-Server

When running ErikrafT Drop, the X-Forwarded-For header has to be set by a proxy.
Otherwise, all clients will be mutually visible. To check if your setup is configured correctly use the environment variable DEBUG_MODE="true".

Using nginx

Allow http and https requests

server {
    listen       80;

    expires epoch;

    location / {
        proxy_connect_timeout 300;
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Connection "upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-for $remote_addr;
    }
}

server {
    listen       443 ssl http2;
    ssl_certificate /etc/ssl/certs/pairdrop-dev.crt;
    ssl_certificate_key /etc/ssl/certs/pairdrop-dev.key;

    expires epoch;

    location / {
        proxy_connect_timeout 300;
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Connection "upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-for $remote_addr;
    }
}

Automatic http to https redirect:

server {
    listen       80;

    expires epoch;

    location / {
        return 301 https://$host:3000$request_uri;
    }
}

server {
    listen       443 ssl http2;
    ssl_certificate /etc/ssl/certs/pairdrop-dev.crt;
    ssl_certificate_key /etc/ssl/certs/pairdrop-dev.key;

    expires epoch;

    location / {
        proxy_connect_timeout 300;
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Connection "upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-for $remote_addr;
    }
}

Using Apache

install modules proxy, proxy_http, mod_proxy_wstunnel

a2enmod proxy

a2enmod proxy_http

Create a new configuration file under /etc/apache2/sites-available (on Debian) pairdrop.conf

Allow HTTP and HTTPS requests

<VirtualHost *:80>
	ProxyPass / http://127.0.0.1:3000/ upgrade=websocket
</VirtualHost>
<VirtualHost *:443>
	ProxyPass / https://127.0.0.1:3000/ upgrade=websocket
</VirtualHost>

Automatic HTTP to HTTPS redirect:

<VirtualHost *:80>
	Redirect permanent / https://127.0.0.1:3000/
</VirtualHost>
<VirtualHost *:443>
	ProxyPass / http://127.0.0.1:3000/ upgrade=websocket
</VirtualHost>

Activate the new virtual host and reload Apache:

a2ensite pairdrop

service apache2 reload

Coturn and ErikrafT Drop via Docker Compose

Setup container

To run coturn and ErikrafT Drop at once by using the docker-compose-coturn.yml with TURN over TLS enabled you need to follow these steps:

Generate or retrieve certificates for your <DOMAIN> (e.g. letsencrypt / certbot)
Create ./ssl folder: mkdir ssl
Copy your ssl-certificates and the privkey to ./ssl
Restrict access to ./ssl: chown -R nobody:nogroup ./ssl
Create a dh-params file: openssl dhparam -out ./ssl/dhparams.pem 4096
Copy rtc_config_example.json to rtc_config.json
Copy turnserver_example.conf to turnserver.conf
Change <DOMAIN> in both files to the domain where your ErikrafT Drop instance is running
Change username and password in turnserver.conf and rtc-config.json
To start the container including coturn run:
docker compose -f docker-compose-coturn.yml up -d

Setup container

To restart the container including coturn run:
docker compose -f docker-compose-coturn.yml restart

Setup container

To stop the container including coturn run:
docker compose -f docker-compose-coturn.yml stop

Firewall

To run ErikrafT Drop including its own coturn-server you need to punch holes in the firewall. These ports must be opened additionally:

3478 tcp/udp
5349 tcp/udp
10000:20000 tcp/udp

Local Development

Install

All files needed for developing are available in the folder ./dev. For convenience, there is also a docker compose file for developing:

Developing with docker compose

First, Install docker with docker compose. Then, clone the repository and run docker compose:

git clone https://github.com/erikraft/Drop.git && cd Drop

docker compose -f docker-compose-dev.yml up --no-deps --build

Now point your web browser to http://localhost:8080.

To debug the Node.js server, run docker logs pairdrop.
After changes to the code you have to rerun the docker compose command

PWAs requires the app to be served under a correctly set up and trusted TLS endpoint. The NGINX container creates a CA certificate and a website certificate for you. To correctly set the common name of the certificate, you need to change the FQDN environment variable in docker-compose-dev.yml to the fully qualified domain name of your workstation. (Default: localhost) If you want to test PWA features, you need to trust the CA of the certificate for your local deployment.
For your convenience, you can download the crt file from http://<Your FQDN>:8080/ca.crt.
Install that certificate to the trust store of your operating system. \

Windows

Make sure to install it to the Trusted Root Certification Authorities store.

macOS

Double-click the installed CA certificate in Keychain Access,
expand Trust, and select Always Trust for SSL.

Firefox

Firefox uses its own trust store. To install the CA:

point Firefox at http://<Your FQDN>:8080/ca.crt (Default: http://localhost:8080/ca.crt)
When prompted, select Trust this CA to identify websites and click OK.

Alternatively:

Download ca.crt from http://<Your FQDN>:8080/ca.crt (Default: http://localhost:8080/ca.crt)
Go to about:preferences#privacy scroll down to Security and Certificates and click View Certificates
Import the downloaded certificate file (step 1)

Chrome

When using Chrome, you need to restart Chrome so it reloads the trust store (chrome://restart).
Additionally, after installing a new cert, you need to clear the Storage (DevTools → Application → Clear storage → Clear site data).

Google Chrome

To skip the installation of the certificate, you can also open chrome://flags/#unsafely-treat-insecure-origin-as-secure
The feature Insecure origins treated as secure must be enabled and the list must include your ErikrafT Drop test instance. E.g.: http://127.0.0.1:3000,https://127.0.0.1:8443

Please note that the certificates (CA and webserver cert) expire after a day. Also, whenever you restart the NGINX Docker container new certificates are created. The site is served on https://<Your FQDN>:8443 (Default: https://localhost:8443).

Introduction

Architecture

Features

Usage

Ecosystem

Reference

Technical Documentation

​Deployment Notes

​TURN server for Internet Transfer

​ErikrafT Drop via HTTPS

​Deployment with Docker

​Docker Image from Docker Hub

​Docker Image from GitHub Container Registry (ghcr.io)

​Docker Image self-built

​Build the image

​Run the image

​Flags

​Port

​Set Environment Variables via Docker

​Deployment with Docker Compose

​Deployment with Node.js

​Options / Flags

​Port

​Local Run

​Automatic restart on error

​Production (autostart and rate-limit)

​Production (autostart, rate-limit, localhost-only)

​Set Environment Variables via Node.js

​Environment Variables

​Debug Mode

​Rate limiting requests

​IPv6 Localization

​Websocket Fallback (for VPN)

​Specify STUN/TURN Servers

​Specify Signaling Server

​Customizable buttons for the About ErikrafT Drop page

​Healthcheck

​HTTP-Server

​Using nginx

​Allow http and https requests

​Automatic http to https redirect:

​Using Apache

​Allow HTTP and HTTPS requests

​Automatic HTTP to HTTPS redirect:

​Coturn and ErikrafT Drop via Docker Compose

​Setup container

​Setup container

​Setup container

​Firewall

​Local Development

​Install

​Developing with docker compose

​Testing PWA related features

Windows

macOS

Firefox

Chrome

Google Chrome

Deployment Notes

TURN server for Internet Transfer

ErikrafT Drop via HTTPS

Deployment with Docker

Docker Image from Docker Hub

Docker Image from GitHub Container Registry (ghcr.io)

Docker Image self-built

Build the image

Run the image

Flags

Port

Set Environment Variables via Docker

Deployment with Docker Compose

Deployment with Node.js

Options / Flags

Port

Local Run

Automatic restart on error

Production (autostart and rate-limit)

Production (autostart, rate-limit, localhost-only)

Set Environment Variables via Node.js

Environment Variables

Debug Mode

Rate limiting requests

IPv6 Localization

Websocket Fallback (for VPN)

Specify STUN/TURN Servers

Specify Signaling Server

Customizable buttons for the About ErikrafT Drop page

Healthcheck

HTTP-Server

Using nginx

Allow http and https requests

Automatic http to https redirect:

Using Apache

Allow HTTP and HTTPS requests

Automatic HTTP to HTTPS redirect:

Coturn and ErikrafT Drop via Docker Compose

Setup container

Setup container

Setup container

Firewall

Local Development

Install

Developing with docker compose

Testing PWA related features