Stackt

A self-hosted Google Drive clone — folders, uploads, search, and sharing, built on FastAPI and Supabase.

Features

• Auth — email/password sign-up and sign-in, handled by Supabase Auth
• Folders — create, rename, move, and delete nested folders
• Uploads — drag-and-drop or click-to-upload, multiple files at once
• File preview — images, PDFs, video, audio, and text files open inline
• Search — fuzzy filename search across your whole drive
• Sharing — share a file or folder by email (view or edit) or generate a public link, with optional expiry
• Dark mode — toggle in the sidebar, remembers your choice
• Row-level security — every query is scoped by Postgres RLS, not just application-level checks

Tech stack

Layer	Choice
Backend	Python, FastAPI
Frontend	Plain HTML/CSS/JS — no framework, no build step
Auth	Supabase Auth (JWT, verified server-side via JWKS)
Database	Supabase Postgres, with Row Level Security policies
File storage	Supabase Storage (private bucket, signed URLs)
Deployment	Docker (backend), any static host (frontend)

Project structure

gdrive-clone/
├── backend/            FastAPI app (auth, folders, files, shares, search)
├── frontend/            Static site (login, dashboard, share viewer)
├── supabase/             SQL schema + storage policies
└── docker-compose.yml    Local dev, backend + frontend together

Quick start

git clone https://github.com/NEKOZAM-I/Stackt.git
cd gdrive-clone
docker compose up --build

Then open http://localhost:5500.

You'll need a free Supabase project first — see SETUP.md for the full walkthrough (Supabase setup, environment variables, running without Docker, and deploying to production).

How it works

Auth happens entirely in the browser via supabase-js — the backend never touches passwords. Every API request carries the user's Supabase access token, which the backend verifies against Supabase's public JWKS endpoint and uses to scope a per-request database client, so Postgres Row Level Security enforces access control rather than the application code alone. File bytes live in a private Supabase Storage bucket and are only ever exposed via short-lived signed URLs. Shares are just rows in a shares table with a random token — a public link needs nothing but that token to resolve.

License

MIT — see LICENSE.