Update now opens a progress dialog, the same as Pharos and Ostia: requested, handing over to the server, checking the signed release, backing up your data, downloading, restarting, health check. It ends with a Reload button, or with the reason it stopped while the previous version keeps running.
It keeps going while Amfora restarts and reopens when you return to Settings during an install.
Nothing changes on the host: the app reads the progress from the update log the host already writes.
RELEASE
Amfora 2.1.0
Your own picture on every download page, and videos that download instead of play.
Download page cover
Upload one image under Customization, Download page: it becomes the cover of every download page, with the file name over it. Without it, your accent colour with a large file type icon.
Files from a share are never used as the cover any more.
No playing in the browser
New switch "Play video and audio on download pages", off by default, also for existing installations. While off there is no play or Preview button for video and audio, and the server refuses to stream them to visitors. Downloading works as always.
Link previews
WhatsApp, Slack and similar apps show your cover, otherwise a default link preview image you upload, then your logo, then the Amfora card. Never a file from the share.
RELEASE
Amfora 2.0.1
A security and install release. Update if you run 2.0.0.
Security
The brandpack key is built into the server; a key pair of your own and a self signed pack are refused.
Administrator checks read the account from the database on every request, so a demoted or deactivated administrator loses access at once.
The unused /s3/* routes, which answered without a session, are removed.
Registering the first administrator closes the setup window on the server, instead of waiting for the browser to do it.
New tests for the administrator guard, these routes and the attachment rule for uploaded HTML and SVG.
Install
Fresh installs without AMFORA_UID start again: the server ran as a different user than the bundled storage and could not read its credentials. CI now starts the image the way the installer does.
The installer pulls the published image, pinned to the release: Docker with Compose v2 is enough, and a new install starts in about a minute. --source builds the release tag.
The repository's docker-compose.yaml uses the published image; the README and docs explain how to update.
Website
Findable by search engines, with a sitemap, a link preview image, icons and lazily loaded screenshots.
Buying opens a confirmation page first; only its button starts a Stripe checkout.
RELEASE
Amfora 2.0.0
Amfora 2.0.0 is a new interface, front and back, and a
white-label model that lives on the server instead of in the
browser.
New interface
Public pages (sign-in, download, receive, recovery,
invitations) are a statement column and a floating panel on a
soft colour wash in your accent. Downloads open with a cover:
an image is its own cover, anything else gets the accent
gradient. Files are listed as a manifest with type tiles and a
total line.
The workspace has a tinted sidebar, page headers with a
subline, and the same panels and tables everywhere. The
dashboard greets by time of day and opens with Send files and
Receive files. Receive links are wide rows with the received
files inline.
Family palette: accent #0079D2, ink #0C1626, Archivo for
headings, Public Sans for text, JetBrains Mono for numbers.
Light and dark are both finished. Tables never scroll
sideways on a laptop.
The postal artwork, envelopes, stamps and quotes are gone.
Your logo replaces the mark everywhere, including the favicon
and link previews.
Your brand, from the server
Name, description, logo, accent colour, corner radius and
font were already per installation. The public-page
background, custom CSS and the credit setting now are too;
nothing brand-related lives in the browser any more.
New endpoints GET/POST/DELETE /app/background
and PUT/DELETE /app/brandpack, admin only. The
logo is served at /api/app/logo.
Brandpack
A signed key an administrator pastes under Customization. With
it, the installation can hide "Powered by Amfora", set a
background image for the public pages and add custom CSS.
Without one those settings are ignored by the server,
whatever is stored.
Custom CSS is sanitised on the server: imports, external URLs,
expressions, behaviours and escape tricks are removed, the
size is capped at 20 kB, and it can never leave its style
element. Background uploads must be a real raster image.
One organisation, unlimited installations, never expires.
How to get one.
Security
The settings routes skipped authentication on installations
with a single user, which is most of them: configuration,
including the SMTP password, was readable and writable without
a session. Fixed; the exception now applies only during first
run. Upgrade for this alone.
Uploaded html, svg, xml or javascript files are served as
attachments in a sandbox, never as a page on your origin.
Before you upgrade
Pull the image or press Update. No data changes; three app
configs are seeded on start. New installations get accent
#0079D2 and radius 0.5rem; existing installations keep their
stored colour and radius. The per-browser background colours of
1.x are gone in favour of the server-side background image.
Amfora 1.2.0 answers a question an owner could not answer
before: was my file actually collected?
Download counts
Every file carries a download count, visible to its owner. A
plain number: no address, no browser, no time, nothing about
who collected it.
The count is never part of a public share page, so a recipient
cannot see how many others were there first.
Previews, embeds and your own downloads are left out, as is
seeking through a video.
Dashboard
Recent uploads and recent shares page through the whole list
instead of stopping at five.
The running version is shown at the bottom of the menu.
Update checking
Your installation can tell you that a newer release exists.
The release manifest is signed and names an exact image, so
what you are told to run is what was published.
The check sends nothing about your installation, and one
setting switches it off entirely.
Updating from the app itself is optional and installed
separately on your server. Amfora is never given control of
Docker.
Before you upgrade
A download count is added to every file at startup, beginning at
zero. Files collected before this release start at zero as well:
there is no record of earlier downloads to recover. Nothing else
changes and no configuration is needed.
Amfora 1.1.0 repairs link previews. A share link pasted into a
chat now shows a real preview image, and a share holding a
single image can show that image.
Link previews
Preview images are always a real address. An uploaded logo is
stored inline, and chat applications cannot read an inline
image, so every link previewed as broken.
Shares without a preview image fall back to a bundled wide
card, sized for the way chat applications crop previews.
A share holding exactly one image can show that image. Upload
request links keep the card, since they hold nothing yet.
Preview safety
Preview requests arrive without a visitor. A share only shows
its file when it has no password, has not expired, sets no view
limit, holds no folders, holds exactly one file, that file is an
image, and it is at most 5 MB. Password protected shares show
the card, so nothing reaches a channel before the recipient has
entered the password. View limited shares are excluded, so a
preview request cannot spend one of your permitted views.
Before you upgrade
No data changes and no configuration changes. Confirm that
STORAGE_URL is an address your visitors' browsers
can reach, not only the container: an internal address gives a
working share page whose downloads and uploads fail from
outside.
Chat applications cache previews per address. An existing link
may keep its old preview until it is posted again.
Amfora's first stable release brings the new login, upload and
download design together with the security fixes from the
release audit.
Experience
A consistent visual identity across login, file downloads and
upload requests.
Branded transfer pages with a clear next action and Powered by
Amfora credit.
Refreshed product screenshots, installation documentation and
website.
Security fixes
Expired shares and exhausted view limits are enforced when
authorizing downloads.
Public uploads use server authorized keys, verified file sizes
and atomic quotas. Accepted files cannot be overwritten by
replaying an upload URL.
Two factor authentication uses expiring login challenges.
Remembered devices use protected random tokens.
Authentication provider settings require an administrator.
Password reset links use your configured application address.
Updated JavaScript dependencies. Both production package
audits reported zero known vulnerabilities on 17 September
2026.
Before you upgrade
Back up your application data. Startup adds the upload grant and
login challenge tables. Previously remembered devices must sign
in again. Set APP_URL to the address of your
installation.
Custom upload and two factor clients need the updated
authorization fields. Read the full upgrade notes before
updating an integration.
68 automated tests, security regressions, a real 101 MiB
multipart transfer, concurrent quota checks, local email
delivery and desktop and mobile browser checks.
Back up your data and keep your existing volume mounts, ports and
environment settings. Updates are applied from your Docker host.
See the guide for builds from source.
In your existing Compose service, set image to the
version below and remove the build section:
image: ghcr.io/solutionmax/amfora:1.2.0
Then pull and start that service, keeping its persistent data:
docker compose pull amfora
docker compose up -d --no-build amfora
These commands assume the service is named amfora.
Keep a tested backup and your previous image. Reverting an image
alone does not undo database changes.