SkySend

Name: SkySend
Author: Harman Singh Hira

End-to-end encrypted, zero-knowledge file and note sharing

skyfay/skysend:v3.2.0
port 6159
Productivity

Visit project site

Web App

http://localhost:6159/

SkySend is a minimalist, end-to-end encrypted file and note sharing service. Files and notes are encrypted in your browser before upload, so the server only stores encrypted data and never sees the key.

Features

Drag-and-drop file and folder uploads, with expiry times and download limits
Encrypted notes made of blocks: text, passwords, code and SSH keys together, with optional burn-after-reading
File requests: hand out a link and others upload files that only you can open
Optional password protection with Argon2id
Optional OIDC / SSO sign-in to limit who can upload, while downloads stay public
Optional S3-compatible storage (AWS S3, R2, MinIO and more)
No accounts and no telemetry

How to use

Open SkySend from your dashboard.
Drag a file onto the page, or switch to the Note tab to share text, a password, code or an SSH key.
Pick an expiry time and a download or view limit, and add a password if you like.
Copy the share link and send it. The key to open it is only in the link, never on the server.
Open My Links to see what you shared from this browser.

Before you install

Set BASE_URL to the address you open SkySend at, like http://192.168.1.50:6159; share links are built from it. The first start takes about half a minute. Everything else is optional and listed in the Variables tab: size limits, expiry choices, branding, S3 storage and SSO sign-in. Add them in the app settings, only with a value. For SSO, OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET must be set together, and set OIDC_SESSION_SECRET too so people stay signed in after a restart.

The settings in the first table are already in the app settings. To use any other one, open the app settings, add the variable with your value, save, and the app restarts with it. A setting you leave out uses its default.

In the app settings

Variable	Default value	Description
`TZ`	`$TZ`	Your time zone. It is filled in from your ZimaOS time zone. Leave it unless you need another.
`BASE_URL`	`http://localhost:6159`	The address you type in your browser. Share links are built from it. It starts as localhost, which only works on this device. For other devices, change `localhost` to your ZimaOS IP, or use your own https address. Keep the port at 6159 unless you use a reverse proxy.

Files

Variable	Default value	Description
`FILE_MAX_SIZE`	`2GB`	The biggest file someone can upload, like 500MB or 10GB.
`FILE_MAX_FILES_PER_UPLOAD`	`200`	The most files in one upload.
`FILE_EXPIRE_OPTIONS_SEC`	`300,3600,86400,604800`	The expiry times people can pick, in seconds, comma-separated (300 is 5 minutes, 604800 is 7 days).
`FILE_DEFAULT_EXPIRE_SEC`	`86400`	The expiry time picked at first, in seconds. It must be one of FILE_EXPIRE_OPTIONS_SEC.
`FILE_DOWNLOAD_OPTIONS`	`1,2,3,4,5,10,20,50,100`	The download limits people can pick, comma-separated.
`FILE_DEFAULT_DOWNLOAD`	`1`	The download limit picked at first. It must be one of FILE_DOWNLOAD_OPTIONS.
`FILE_UPLOAD_QUOTA_BYTES`	`0`	How much one person may upload per time window, like 5GB. 0 means no limit.
`FILE_UPLOAD_QUOTA_WINDOW`	`86400`	The time window for FILE_UPLOAD_QUOTA_BYTES, in seconds.
`FILE_UPLOAD_SPEED_LIMIT`	`0`	The fastest one upload may go, like 10MB (per second). 0 means no limit.
`FILE_UPLOAD_WS`	`true`	Set to false if uploads fail because WebSockets are blocked, for example by a proxy.

Notes

Variable	Default value	Description
`NOTE_MAX_SIZE`	`1MB`	The biggest note someone can share.
`NOTE_EXPIRE_OPTIONS_SEC`	`300,3600,86400,604800`	The expiry times people can pick for notes, in seconds, comma-separated.
`NOTE_DEFAULT_EXPIRE_SEC`	`86400`	The note expiry time picked at first. It must be one of NOTE_EXPIRE_OPTIONS_SEC.
`NOTE_VIEW_OPTIONS`	`0,1,2,3,5,10,20,50,100`	The view limits people can pick for notes, comma-separated. 0 means no limit.
`NOTE_DEFAULT_VIEWS`	`0`	The view limit picked at first. 1 means burn after reading.

File requests

Variable	Default value	Description
`FILE_REQUEST_EXPIRE_OPTIONS_SEC`	`86400,259200,604800`	How long a file request can stay open, in seconds, comma-separated.
`FILE_REQUEST_DEFAULT_EXPIRE_SEC`	`259200`	How long a file request stays open at first. It must be one of FILE_REQUEST_EXPIRE_OPTIONS_SEC.
`FILE_REQUEST_UPLOAD_OPTIONS`	`1,2,3,5,10,20,50,100`	How many uploads a file request can take, comma-separated.
`FILE_REQUEST_DEFAULT_UPLOADS`	`10`	How many uploads a file request takes at first.
`FILE_REQUEST_MAX_SIZE`	`2GB`	The biggest file someone can upload into a request. It can't be more than FILE_MAX_SIZE.
`FILE_REQUEST_RETENTION_SEC`	`604800`	How long an uploaded file stays in the inbox, in seconds.
`FILE_REQUEST_DAILY_LIMIT`	`0`	How many new file requests one person can make per day. 0 means no limit.

Features

Variable	Default value	Description
`ENABLED_SERVICES`	`file,note,request`	Which parts are on: any of file, note and request, comma-separated.
`DEFAULT_TAB`	`file`	The tab shown first: file or note. text, password, code or sshkey open the note tab with that block added.
`FORCE_FILE_PASSWORD`	`false`	Set to true to require a password on every file upload.
`FORCE_NOTE_PASSWORD`	`false`	Set to true to require a password on every note.
`FORCE_REQUEST_PASSWORD`	`false`	Set to true to require a password on the inbox of every file request.

Server

Variable	Default value	Description
`TRUST_PROXY`	`false`	Set to true when SkySend is behind a reverse proxy, so it sees the visitor's real IP.
`CORS_ORIGINS`	`—`	Other web addresses allowed to call this SkySend, comma-separated. Most people never need it.
`RATE_LIMIT_MAX`	`60`	The most requests one IP can make per minute.
`PASSWORD_MAX_ATTEMPTS`	`10`	Wrong password tries before an IP is locked out of a file or note.
`PASSWORD_LOCKOUT_MS`	`900000`	How long that lockout lasts, in milliseconds (900000 is 15 minutes).
`PUID`	`1001`	The user that owns the data and uploads folders.
`PGID`	`1001`	The group that owns the data and uploads folders.

Branding

Variable	Default value	Description
`CUSTOM_TITLE`	`SkySend`	The site name shown in the browser tab and the page.
`CUSTOM_COLOR`	`46c89d`	The main color, as a 6-digit hex code.
`CUSTOM_LOGO`	`—`	Your own logo. Put the file in data/branding in the app's folder and type /branding/logo.svg.
`DEFAULT_THEME`	`graphite`	The look of the site: graphite, aurora or midnight.
`DEFAULT_COLOR_SCHEME`	`system`	Dark, light or system for new visitors.
`CUSTOM_PRIVACY`	`—`	A link to your privacy policy, shown at the bottom of the page.
`CUSTOM_LEGAL`	`—`	A link to your legal notice or impressum, shown at the bottom of the page.
`CUSTOM_LINK_URL`	`—`	A link of your own at the bottom of the page. Set CUSTOM_LINK_NAME too.
`CUSTOM_LINK_NAME`	`—`	The text of that link, up to 50 characters.
`CUSTOM_REPORT_URL`	`—`	A link to a page for reporting abuse, shown at the bottom of the page.

Sign in with SSO (OIDC)

Variable	Default value	Description
`OIDC_PROVIDER`	`generic`	Your sign-in provider: generic, pocketid, authentik or keycloak.
`OIDC_ISSUER`	`—`	Your provider's issuer address. With OIDC_CLIENT_ID and OIDC_CLIENT_SECRET it turns SSO on. All three must be set together, or SkySend won't start.
`OIDC_CLIENT_ID`	`—`	The client ID from your provider.
`OIDC_CLIENT_SECRET`	`—`	The client secret from your provider.
`OIDC_SESSION_SECRET`	`—`	At least 32 random characters that keep people signed in after a restart. Without it everyone is signed out on each restart.
`OIDC_PROTECT_FILES`	`true`	Set to false to let people upload files without signing in.
`OIDC_PROTECT_NOTES`	`true`	Set to false to let people make notes without signing in.
`OIDC_PROTECT_REQUESTS`	`—`	Set to false to let people make file requests without signing in. Left out, requests need sign-in while files or notes do.
`OIDC_SCOPES`	`openid profile email`	The scopes to ask for, separated by spaces.
`OIDC_SESSION_DURATION`	`86400`	How long a sign-in lasts, in seconds.

S3 storage

Variable	Default value	Description
`STORAGE_BACKEND`	`filesystem`	Set to s3 to keep uploads in S3-compatible storage instead of the uploads folder.
`S3_BUCKET`	`—`	The bucket name.
`S3_REGION`	`—`	The region, like eu-central-1.
`S3_ENDPOINT`	`—`	The S3 server address, for R2, MinIO, Garage and others. Leave it out for AWS.
`S3_ACCESS_KEY`	`—`	The access key.
`S3_SECRET_KEY`	`—`	The secret key.
`S3_FORCE_PATH_STYLE`	`false`	Set to true for MinIO, Garage and some other self-hosted S3 servers.

docker-compose.yml

name: skysend

services:
  skysend:
    image: skyfay/skysend:v3.2.0
    container_name: skysend
    restart: unless-stopped
    stop_grace_period: 15s
    network_mode: bridge
    environment:
      - TZ=$TZ
      - BASE_URL=http://localhost:6159
    ports:
      - target: 3000
        published: "6159"
        protocol: tcp
    volumes:
      - type: bind
        source: /DATA/AppData/$AppID/data
        target: /data
        bind:
          create_host_path: true
      - type: bind
        source: /DATA/AppData/$AppID/uploads
        target: /uploads
        bind:
          create_host_path: true
    deploy:
      resources:
        limits:
          cpus: "1.00"
          memory: 512M
        reservations:
          cpus: "0.00"
          memory: 128M
    labels:
      icon: https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/icon.png
    x-casaos:
      id: com.icestore.skysend
      envs:
        - container: TZ
          description:
            en_US: >-
              Your time zone. It is filled in from your ZimaOS time zone.
              Leave it unless you need another.
        - container: BASE_URL
          description:
            en_US: >-
              The address you type in your browser. Share links are built
              from it. It starts as localhost, which only works on this
              device. For other devices, change `localhost` to your ZimaOS
              IP, or use your own https address. Keep the port at 6159 unless
              you use a reverse proxy.
      ports:
        - container: "3000"
          description:
            en_US: >-
              Web UI for sharing encrypted files and notes, published on host
              as 6159
      volumes:
        - container: /data
          description:
            en_US: SkySend's database and any branding files you add.
        - container: /uploads
          description:
            en_US: >-
              The encrypted files people upload. SkySend never sees what is
              inside them.

x-casaos:
  id: com.icestore.skysend
  architectures:
    - amd64
    - arm64
  main: skysend
  author: HSinghHira
  category: Productivity
  developer: Skyfay
  icon: https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/icon.png
  thumbnail: https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-1.png
  screenshot_link:
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-1.png
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-2.png
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-3.png
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-4.png
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/skysend/screenshot-5.png
  title:
    en_US: SkySend
  tagline:
    en_US: End-to-end encrypted, zero-knowledge file and note sharing
  description:
    en_US: >-
      SkySend is a minimalist, end-to-end encrypted file and note sharing
      service. Files and notes are encrypted in your browser before upload,
      so the server only stores encrypted data and never sees the key.


      **Features**


      - Drag-and-drop file and folder uploads, with expiry times and
        download limits

      - Encrypted notes made of blocks: text, passwords, code and SSH keys
        together, with optional burn-after-reading

      - File requests: hand out a link and others upload files that only
        you can open

      - Optional password protection with Argon2id

      - Optional OIDC / SSO sign-in to limit who can upload, while downloads
        stay public

      - Optional S3-compatible storage (AWS S3, R2, MinIO and more)

      - No accounts and no telemetry


      **How to use?**


      1. Open SkySend from the Zima OS dashboard.

      2. Drag a file onto the page, or switch to the Note tab to share text,
         a password, code or an SSH key.

      3. Pick an expiry time and a download or view limit, and add a
         password if you like.

      4. Copy the share link and send it. The key to open it is only in the
         link, never on the server.

      5. Open My Links to see what you shared from this browser.
  tips:
    before_install:
      en_US: >-
        1. Open the app configuration before you install.


        2. Find BASE_URL. It starts as http://localhost:6159.


        3. Change localhost to your ZimaOS IP address, for example
           192.168.1.50. Share links use this address.


        4. More settings, like file size limits, S3 storage, branding and SSO
           sign-in, are listed on the SkySend page at
           https://icestore.hsinghhira.me/app/skysend/ (Variables tab). You
           can add them now or later in the app settings.


        5. Start the installation.


        6. Wait about half a minute for the first start.


        7. Open SkySend from the Zima OS dashboard.


        8. Upload a small file to check that everything works.
  index: /
  port_map: "6159"
  scheme: http
  is_uncontrolled: false
  version: "v3.2.0"
  update_at: "2026-10-25"
  release_notes:
    en_US: |-
      - Moved to IceStore, now on port 6159
      - Updated to skyfay/skysend v3.2.0: file requests, notes made of blocks and new themes
      - DEFAULT_THEME now picks graphite, aurora or midnight; dark, light or system go in DEFAULT_COLOR_SCHEME
      - Optional settings moved to the Variables tab on the IceStore page; blank ones are no longer passed to SkySend
  repo: "https://github.com/Skyfay/SkySend"
  support: "https://github.com/Skyfay/SkySend/issues"
  docs: "https://docs.skysend.app"

SkySend

Web App

Features

How to use

Before you install

In the app settings

Files

Notes

File requests

Features

Server

Branding

Sign in with SSO (OIDC)

S3 storage

ZimaOS

CasaOS

Homeio