Files

T

Frank 5829a0bfe8 docs: rename docs/ -> serverAppConfigs-docs/ per system-wide PROJECTNAME-docs convention

All in-repo path references (AGENTS.md, README, old scripts, report artifacts,
test code paths) rewritten in the same commit; focused-test map extended for
.gitignore, old/scripts/*, dankclaw/comfyui/*, and report/* per this repo's
own convention ('add one before committing'). Obsidian wikilinks are
title-based and unaffected.

2026-08-28 02:20:06 -07:00

3.9 KiB

Raw Blame History

Copyparty

Copyparty is a lightweight file server and media streamer that runs as a single Python binary. It handles large payloads, media streaming, resumable uploads, directory browsing, and WebDAV from one process.

Host: Dankserver — Hostname: files.dankserver.local — Docs: https://github.com/9001/copyparty

Facts

Item	Value
Latest version	v1.20.21 (2026-08)
Image	`ghcr.io/9001/copyparty:latest` (official Dockerfile in repo)
Port	3923 (host) → 3923 (container)
Volume	bind mount the shared root directory
Auth	Per-directory `.cpy` config files, HTTP basic auth, `dirkeys`, `filekeys`
Streaming	HTTP range requests, HLS, WebDAV, WOPI (Office editing)
Docker editions	`dj` (document + media), `iv` (image + video), `v` (video only)

Configuration

Environment Variables

Variable	Description
`COPAY_PASS`	Master password for the web UI
`COPAY_MODE`	Set to `rw` for read-write shares

Configuration File Options

Copyparty reads its configuration from initcfg (or config in the /data directory). Key options:

use-bwrap: n — Disable bwrap sandboxing for ffmpeg (default in Docker). Set to y to enable.
shadowing //NULL — Full unmap of a volume from the filesystem.
Config env-var expansion: Use ${VAR} syntax in [global] section for environment variable substitution.

Docker Editions

Different editions bundle different libraries:

Edition	Bundled Libraries	Use Case
`dj`	Document + image + video libraries	Full-featured server
`iv`	Image + video libraries	Image and video focused
`v`	Video only	Transcoding only, minimal footprint

The iv edition is no longer available for arm32/armv6. Use dj for maximum compatibility.

Volumes

Container path	Host path (convention)
`/data`	`/opt/copyparty/data`

Docker Compose

services:
  copyparty:
    image: ghcr.io/9001/copyparty:latest
    container_name: copyparty
    restart: unless-stopped
    environment:
      COPAY_PASS: "${COPAY_PASS}"
      COPAY_MODE: rw
    ports:
      - "3923:3923"
    volumes:
      - /opt/copyparty/data:/data
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3923/')"]
      interval: 30s
      timeout: 10s
      retries: 3

Healthcheck

A simple HTTP check on port 3923 works. The root path returns HTTP 200 with the directory listing.

WOPI Integration

Copyparty v1.20.9+ supports WOPI (Web Application Open Platform Interface) for editing Office documents in the web UI via Collabora Online. Enable with the --wopi-accs flag to limit WOPI access to specific paths.

Security Advisories

Version	CVE	Issue
v1.20.19	GHSA-phv8-wgjp-g4p9	FTP upload outside volume
v1.20.17	GHSA-x5pq-m9p8-f4vx	dirkey/filekey confusion
v1.20.9	CVE-2026-27948 / GHSA-62cr-6wp5-q43h	XSS via file upload

Upgrade to v1.20.19+ to cover all known CVEs. The dirkey fix (v1.20.17) matters if using both dirkeys and filekeys.

Gotchas

Large transfers: Disable TLS inside the app and let Caddy terminate TLS. This avoids double encryption overhead.
Dedicated share directory: Do not give Copyparty the whole disk. Mount only the intended share path.
Upload tokens scoped per folder: Prevents accidental global write access.
CSP nonces (v1.20.17+): Security hardening for JavaScript execution. May break third-party JS plugins (--js-browser / --html-head).
Custom thumbnail extractors (v1.20.19+): New thumbex framework. Requires configuration in initcfg.

3.9 KiB Raw Blame History