Self-Hosted Files: Sync, Suite Choice, and Share-Link Hardening

Pick the job, not the brand

Some labs split: Syncthing for bulk mirrors, Nextcloud for documents — only if the split is documented.

Syncthing vs Nextcloud (sync job)

Syncthing moves folders without a mandatory central account. Nextcloud is a portal. Conflicts happen when two devices edit offline — prefer one-writer folders for camera rolls and spreadsheets.

Sync is not backup. Deletes and ransomware can replicate. Keep versioned offsite copies of irreplaceable libraries.

Nextcloud vs Seafile (platform job)

Seafile often feels stronger on large-library sync ergonomics; Nextcloud wins when one login for relatives matters. Both need DB + blob backups. Rehearse restoring one shared folder to a clean client.

[Add real environment data here]
File stack (Syncthing/Nextcloud/Seafile) + version:
Share/drop tool (if any):
Upload volume path:
Last share-link audit (date):

Hardening file drop and share links

If strangers can upload, assume malware and spam. Default to accounts or invite tokens, not anonymous eternal drops.

• Max size + quota; proxy body-size limits as backup
• Share links expire (default days, not years)
• Upload volume on a separate filesystem from DB
• Block risky executables; AV if public drop
• Auth for private shares; log downloads of sensitive folders

services:
  drop:
    image: filebrowser/filebrowser:v2.31.2
    volumes: [uploads:/srv/uploads]
    networks: [internal]
volumes:
  uploads:

Incident playbook (write before go-live)

Disable upload at proxy → revoke tokens → scan recent uploads → preserve logs → rotate keys if admin compromised. Know how to stop the bleeding before the first angry email.

Related reading

See Docker Compose hardening, Automatic SSL certificates, Restore drill playbook, Secure remote access, and Family handoff documentation.