The latest Amfora.
Ready for your server.

A trash, groups, passkeys, notifications and an optional virus scan.

Security: please update

Three gaps exist in every earlier version, 2.3.1 included. Install 2.4.0 soon.

• A signed in user who knew the object name of somebody else's file could register it as their own and read it. A file is now only registered under a name that starts with your own user id.
• A signed in user who knew the id of somebody else's file could add it to their own share and read it. Only your own files and folders can be added to a share now.
• The size of an upload came from the browser, so a user could store more than the limit allows. The server now measures the upload itself.

New

• Trash: deleting moves files and folders to a Trash page. Restore them, or delete for good. They leave by themselves after 30 days.
• Groups: make a group on the Users page and limit a share to its members. A new tab, Shared with me, lists what others shared with your groups.
• Sign in security: ask administrators or everyone for two step sign in, reset it for someone who lost their device, and sign in with a passkey.
• Notifications: a bell in the menu for downloads, files received, opened secrets, links that end soon and a nearly full storage.
• Limits: a storage limit per user, and a default and maximum lifetime for links. Ended links can clean themselves up.
• Optional virus scan with ClamAV. A file that is being checked or is infected cannot be downloaded.
• Figures for monitoring at /api/v1/metrics, in the Prometheus format, with examples for Prometheus and Zabbix.
• Italian, Portuguese (Brazil) and Polish join the five languages, eight in all.
• Also: release notes in Settings in your language, one calm layout with the logo for every email, and a Clear log button for administrators on the Activity page.

Changed

• The storage meter in the menu is a ring, with what is used and what is free.
• The preview under Customization is the real download page, with tabs for Download, Sign in and Receive.
• External sign in starts with Authentik, GitHub and Google. Providers that were never set up leave the list; any other OpenID Connect or OAuth 2.0 service is still added with Add provider.
• An API update without expiration no longer clears the end date. Send null to clear it.
• The switch to play video and audio on download pages is gone. They download; images, PDFs and text keep their preview.

Fixed

• A font chosen under Customization is applied again.
• The selection bar on the Shares page only acts on shares you can see.
• Deleting many files at once no longer stops halfway.
• Email switches follow the administrator's settings, and the Activity filter counts follow your search.

Upgrading

The first start adds new tables and columns to the database, all optional or with a default; your data stays in place. To go back to an older version you need the database backup from before the update.

A fix release, with select all on the Shares page.

• Deleting several shares at once works again. It removed one or two and then reported a failure, because the deletes collided in the database.
• The storage meter of an administrator counts what Amfora holds, not everything else on the same disk.
• Select all: in selection mode a box above the list picks every share the list shows.

A calmer interface, three public themes, secrets, activity and an API.

• Secrets: send a password or key behind a link that destroys itself. Encrypted in the browser, opened a set number of times, optional passphrase. Optionally open to visitors without an account.
• Activity: what happened to your links and your account, with the place of a visitor and a CSV export. The address itself is never stored.
• Emails to the maker when a share is downloaded, before a link ends and when a secret is opened. One signed webhook for other tools.
• API keys with read only or full access, under /api/v1.
• A user sees their own storage against their own limit, in the sidebar and on the dashboard.
• Three themes for the public pages: Stage, Workbench or Seal, chosen in Customization.
• Every signed-in page has the new calm layout, in five languages. Settings and sign-in load far less script.
• Download and receive pages use the full screen, with a live countdown to the end date, the total size and the number of files.

Updating shows its progress, step by step.

• Update now opens a progress dialog, the same as Pharos: requested, handing over to the server, checking the signed release, backing up your data, downloading, restarting, health check. It ends with a Reload button, or with the reason it stopped while the previous version keeps running.
• It keeps going while Amfora restarts and reopens when you return to Settings during an install.
• Nothing changes on the host: the app reads the progress from the update log the host already writes.

Your own picture on every download page, and videos that download instead of play.

Download page cover

• Upload one image under Customization, Download page: it becomes the cover of every download page, with the file name over it. Without it, your accent colour with a large file type icon.
• Files from a share are never used as the cover any more.

No playing in the browser

• New switch "Play video and audio on download pages", off by default, also for existing installations. While off there is no play or Preview button for video and audio, and the server refuses to stream them to visitors. Downloading works as always.

Link previews

• WhatsApp, Slack and similar apps show your cover, otherwise a default link preview image you upload, then your logo, then the Amfora card. Never a file from the share.

A security and install release. Update if you run 2.0.0.

Security

• The brandpack key is built into the server; a key pair of your own and a self signed pack are refused.
• Administrator checks read the account from the database on every request, so a demoted or deactivated administrator loses access at once.
• The unused /s3/* routes, which answered without a session, are removed.
• Registering the first administrator closes the setup window on the server, instead of waiting for the browser to do it.
• New tests for the administrator guard, these routes and the attachment rule for uploaded HTML and SVG.

Install

• Fresh installs without AMFORA_UID start again: the server ran as a different user than the bundled storage and could not read its credentials. CI now starts the image the way the installer does.
• The installer pulls the published image, pinned to the release: Docker with Compose v2 is enough, and a new install starts in about a minute. --source builds the release tag.
• The repository's docker-compose.yaml uses the published image; the README and docs explain how to update.

Website

• Findable by search engines, with a sitemap, a link preview image, icons and lazily loaded screenshots.
• New guide: moving from Palmr.
• Buying opens a confirmation page first; only its button starts a Stripe checkout.

Amfora 2.0.0 is a new interface, front and back, and a white-label model that lives on the server instead of in the browser.

New interface

• Public pages (sign-in, download, receive, recovery, invitations) are a statement column and a floating panel on a soft colour wash in your accent. Downloads open with a cover: an image is its own cover, anything else gets the accent gradient. Files are listed as a manifest with type tiles and a total line.
• The workspace has a tinted sidebar, page headers with a subline, and the same panels and tables everywhere. The dashboard greets by time of day and opens with Send files and Receive files. Receive links are wide rows with the received files inline.
• Family palette: accent #0079D2, ink #0C1626, Archivo for headings, Public Sans for text, JetBrains Mono for numbers. Light and dark are both finished. Tables never scroll sideways on a laptop.
• The postal artwork, envelopes, stamps and quotes are gone. Your logo replaces the mark everywhere, including the favicon and link previews.

Your brand, from the server

• Name, description, logo, accent colour, corner radius and font were already per installation. The public-page background, custom CSS and the credit setting now are too; nothing brand-related lives in the browser any more.
• New endpoints GET/POST/DELETE /app/background and PUT/DELETE /app/brandpack, admin only. The logo is served at /api/app/logo.

Brandpack

• A signed key an administrator pastes under Customization. With it, the installation can hide "Powered by Amfora", set a background image for the public pages and add custom CSS. Without one those settings are ignored by the server, whatever is stored.
• Custom CSS is sanitised on the server: imports, external URLs, expressions, behaviours and escape tricks are removed, the size is capped at 20 kB, and it can never leave its style element. Background uploads must be a real raster image.
• One organisation, unlimited installations, never expires. How to get one.

Security

• The settings routes skipped authentication on installations with a single user, which is most of them: configuration, including the SMTP password, was readable and writable without a session. Fixed; the exception now applies only during first run. Upgrade for this alone.
• Uploaded html, svg, xml or javascript files are served as attachments in a sandbox, never as a page on your origin.

Before you upgrade

Pull the image or press Update. No data changes; three app configs are seeded on start. New installations get accent #0079D2 and radius 0.5rem; existing installations keep their stored colour and radius. The per-browser background colours of 1.x are gone in favour of the server-side background image.

Amfora 1.2.0 answers a question an owner could not answer before: was my file actually collected?

Download counts

• Every file carries a download count, visible to its owner. A plain number: no address, no browser, no time, nothing about who collected it.
• The count is never part of a public share page, so a recipient cannot see how many others were there first.
• Previews, embeds and your own downloads are left out, as is seeking through a video.

Dashboard

• Recent uploads and recent shares page through the whole list instead of stopping at five.
• The running version is shown at the bottom of the menu.

Update checking

• Your installation can tell you that a newer release exists. The release manifest is signed and names an exact image, so what you are told to run is what was published.
• The check sends nothing about your installation, and one setting switches it off entirely.
• Updating from the app itself is optional and installed separately on your server. Amfora is never given control of Docker.

Before you upgrade

A download count is added to every file at startup, beginning at zero. Files collected before this release start at zero as well: there is no record of earlier downloads to recover. Nothing else changes and no configuration is needed.

Amfora 1.1.0 repairs link previews. A share link pasted into a chat now shows a real preview image, and a share holding a single image can show that image.

Link previews

• Preview images are always a real address. An uploaded logo is stored inline, and chat applications cannot read an inline image, so every link previewed as broken.
• Shares without a preview image fall back to a bundled wide card, sized for the way chat applications crop previews.
• A share holding exactly one image can show that image. Upload request links keep the card, since they hold nothing yet.

Preview safety

Preview requests arrive without a visitor. A share only shows its file when it has no password, has not expired, sets no view limit, holds no folders, holds exactly one file, that file is an image, and it is at most 5 MB. Password protected shares show the card, so nothing reaches a channel before the recipient has entered the password. View limited shares are excluded, so a preview request cannot spend one of your permitted views.

Before you upgrade

No data changes and no configuration changes. Confirm that STORAGE_URL is an address your visitors' browsers can reach, not only the container: an internal address gives a working share page whose downloads and uploads fail from outside.

Chat applications cache previews per address. An existing link may keep its old preview until it is posted again.

Amfora's first stable release brings the new login, upload and download design together with the security fixes from the release audit.

Experience

• A consistent visual identity across login, file downloads and upload requests.
• Branded transfer pages with a clear next action and Powered by Amfora credit.
• Refreshed product screenshots, installation documentation and website.

Security fixes

• Expired shares and exhausted view limits are enforced when authorizing downloads.
• Public uploads use server authorized keys, verified file sizes and atomic quotas. Accepted files cannot be overwritten by replaying an upload URL.
• Two factor authentication uses expiring login challenges. Remembered devices use protected random tokens.
• Authentication provider settings require an administrator. Password reset links use your configured application address.
• Updated JavaScript dependencies. Both production package audits reported zero known vulnerabilities on 17 September 2026.

Before you upgrade

Back up your application data. Startup adds the upload grant and login challenge tables. Previously remembered devices must sign in again. Set APP_URL to the address of your installation.

Custom upload and two factor clients need the updated authorization fields. Read the full upgrade notes before updating an integration.