Skip to content

README.md

Latest commit

 

History

History
72 lines (56 loc) · 2.74 KB

README.md

File metadata and controls

72 lines (56 loc) · 2.74 KB
Raw

Stackt

A self-hosted Google Drive clone — folders, uploads, search, and sharing, built on FastAPI and Supabase.

Python Frontend Database License

Features

  • Auth — email/password sign-up and sign-in, handled by Supabase Auth
  • Folders — create, rename, move, and delete nested folders
  • Uploads — drag-and-drop or click-to-upload, multiple files at once
  • File preview — images, PDFs, video, audio, and text files open inline
  • Search — fuzzy filename search across your whole drive
  • Sharing — share a file or folder by email (view or edit) or generate a public link, with optional expiry
  • Dark mode — toggle in the sidebar, remembers your choice
  • Row-level security — every query is scoped by Postgres RLS, not just application-level checks

Tech stack

Layer Choice
Backend Python, FastAPI
Frontend Plain HTML/CSS/JS — no framework, no build step
Auth Supabase Auth (JWT, verified server-side via JWKS)
Database Supabase Postgres, with Row Level Security policies
File storage Supabase Storage (private bucket, signed URLs)
Deployment Docker (backend), any static host (frontend)

Project structure

gdrive-clone/
├── backend/            FastAPI app (auth, folders, files, shares, search)
├── frontend/            Static site (login, dashboard, share viewer)
├── supabase/             SQL schema + storage policies
└── docker-compose.yml    Local dev, backend + frontend together

Quick start

git clone https://github.com/NEKOZAM-I/Stackt.git
cd gdrive-clone
docker compose up --build

Then open http://localhost:5500.

You'll need a free Supabase project first — see SETUP.md for the full walkthrough (Supabase setup, environment variables, running without Docker, and deploying to production).

How it works

Auth happens entirely in the browser via supabase-js — the backend never touches passwords. Every API request carries the user's Supabase access token, which the backend verifies against Supabase's public JWKS endpoint and uses to scope a per-request database client, so Postgres Row Level Security enforces access control rather than the application code alone. File bytes live in a private Supabase Storage bucket and are only ever exposed via short-lived signed URLs. Shares are just rows in a shares table with a random token — a public link needs nothing but that token to resolve.

License

MIT — see LICENSE.