Just some personal planning I am sharing in case it is useful to others

[T313C0mun1s7]

Note: This is just some personal planning I am doing for my own deployment using an old workstation I have. I have put some serious thought into this and hope my planning might potentially provide some guidance for others.

Copyparty File Server Deployment Summary

System Overview

• OS: AlmaLinux 10 (x86_64-v2, production-ready, long-term support)
• Hardware: HP Z820 workstation with dual Xeons, 128 GB RAM
• Storage Layout:
  • OS: SATA SSD
  • Bulk Storage: 4 × 6 TB SAS HDDs in a ZFS RAIDZ pool
  • Cache: M.2 (NVMe or mSATA via PCIe adapter) as L2ARC cache

Access Model - Public Access

• Access Point: https://files.yourdomain.com
• Frontend: Caddy reverse proxy
• Copyparty Public Instance:
  • Root: /srv/files/public
  • Bind: 127.0.0.1:3923
  • Flags: --anon-root, --banpwr, --ssnkey, --ssnalg
• Security: TLS, rate limiting, headers via Caddy; Copyparty sharing features

Access Model - Private Access

• Access Point: http://z820.ts.net:3924
• Copyparty Private Instance:
  • Root: /srv/files
  • Bind: Tailscale IP or 127.0.0.1:3924
  • Auth: -a admin:secret:ard:/
• Security: Accessible only via Tailscale

Link Sharing Model

• Private instance uses --share-prefix to generate public links
• Links point to https://files.yourdomain.com/
• Files must reside in /srv/files/public
• Supports password-protected, token-based, and upload-only links

Server & Service Management

• Cockpit Web UI (optional): system management, ZFS, SMART monitoring
• systemd: Each Copyparty instance managed as a service

Operational Highlights

• Storage Resilience: ZFS RAIDZ + L2ARC
• Private vs. Public Access: Strict separation for security
• Secure by Default: Tailscale, TLS, rate limiting, hardened sessions
• Flexible Sharing: Per-folder rules, expiring/public/private links
• Minimal Attack Surface: Public instance scoped and hardened
• Performance-Friendly: Lightweight, multithreaded, resource-efficient
• Maintainability: Enterprise LTS + option

Possible Caddy configuration for the reverse proxy with some hardening:

files.example.com {
    reverse_proxy localhost:3923
    encode zstd gzip
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        X-XSS-Protection "1; mode=block"
    }
    rate_limit copyparty {
        zone copyparty_zone {
            key {remote_ip}
            window 1m
            burst 20
            rate 10r/m
        }
        match_path /
    }
}

[Silverdev2482]

Probably don't put this in the issue tracker, maybe put it in the discord server?

[hellypi]

Probably don't put this in the issue tracker, maybe put it in the discord server?

If this was in the discord I would have never seen this. This is a million times better than any discord information blackhole server.

[Silverdev2482]

I forgot about discussions, this is the perfect place to put it.