copyparty 1.20.26

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick copyparty 1.20.26 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Select m5.large, your key pair, a security group as above, and a subnet. Your files are stored on the root volume. If you expect to keep a lot of data, raise its size under Configure storage, or add a volume later (Step 10).

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=copyparty}]'

Connect over SSH as the ubuntu user, the default user for copyparty 1.20.26 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate, the password and copyparty's own keys, and then copyparty and nginx start. This takes a few seconds. Confirm that the services are active:

systemctl is-active copyparty-firstboot copyparty-set-host copyparty nginx

active active active active

Only SSH (22) and nginx (80, 443) listen on the network. copyparty listens on loopback port 3923. The other two listeners are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:3923 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

If nginx or copyparty is not active, first boot has not finished or has failed, and neither service starts. Check systemctl status copyparty-firstboot and journalctl -u copyparty-firstboot.

sudo cat /var/lib/sac/data/copyparty-credentials.txt

The file is root-only:

# copyparty 1.20.26 on Ubuntu 24.04 - per-instance sign-in (written by copyparty-apply-credential, firstboot)
# This credential is unique to this instance; none was baked into the image. Keep this file secret. COPYPARTY_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ COPYPARTY_USER=admin COPYPARTY_PASS=<COPYPARTY_PASS>

The URL uses the instance's public DNS name from EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too. To use your own DNS name, see Step 9.

The built-in self-test exercises the whole chain from the command line. It checks that an anonymous visitor sees nothing, a wrong password is refused, the right password signs in, an upload, download and delete round trip works, and the refusals described in this guide hold:

sudo copyparty-selftest

SELFTEST-OK https 301 + /healthz + anonymous: no permissions, upload 401 + wrong password 403 + admin sign-in + upload/download/delete round trip + 403 cross-origin upload + 400 encoded and dot-segment traversal + 400 password in URL + 403 cross-site zip + 444 unknown host

Open the COPYPARTY_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. Before you accept it, compare the fingerprint your browser shows with the one on the instance, or install your own certificate (Step 9):

sudo openssl x509 -in /etc/ssl/copyparty/copyparty.crt -noout -fingerprint -sha256

copyparty shows its sign-in page. It asks only for a password, because copyparty recognises the account by its password. Enter the COPYPARTY_PASS from Step 4 and choose login.

After you sign in, you see the shared folder, /srv/copyparty on the instance, with a folder tree on the left. The top right corner shows the permissions of your account: read, write, move, delete and admin.

To upload, open the rocket tab in the toolbar and drop files or whole folders onto the UPLOAD box, or click it to pick files. copyparty hashes each file in your browser and sends it in chunks. If the connection drops, upload the same file again and it continues where it stopped. Uploaded files are listed in the folder as soon as they finish.

Click a file to download or open it. The zip link next to a folder downloads the whole folder as one archive. The folder icon in the toolbar creates folders, and the menus on each file move, rename and delete it.

HTML, SVG and Markdown files are shown as plain text rather than run as pages on your copyparty site. See Security notes for why, and how to change it.

copyparty also answers plain HTTP requests, which is handy for scripts. This example runs from the instance itself with curl. The password goes into a private curl config file, never onto the command line:

F=/var/lib/sac/data/copyparty-credentials.txt
H=$(sudo sed -n 's#^COPYPARTY_URL=https://\([^/]*\)/.*#\1#p' $F)
W=$(mktemp -d); chmod 700 "$W" ( umask 077; printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^COPYPARTY_PASS=//p' $F)" > "$W/curl.cfg" ) printf 'Hello from sac.\n' > "$W/hello.txt" C=(curl -s -K "$W/curl.cfg" --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/copyparty/copyparty.crt) "${C[@]}" -H "Origin: https://$H" -o /dev/null -w 'PUT hello.txt -> HTTP %{http_code}\n' -T "$W/hello.txt" "https://$H/hello.txt" "${C[@]}" "https://$H/hello.txt" "${C[@]}" -H "Origin: https://$H" -o /dev/null -w 'DELETE hello.txt -> HTTP %{http_code}\n' -X DELETE "https://$H/hello.txt" rm -rf "$W"

PUT hello.txt -> HTTP 201 Hello from sac. DELETE hello.txt -> HTTP 200

A request that changes files is refused with 403 when it carries another web site's Origin, which is what a page elsewhere trying to use your signed-in browser would send. Scripts that send no Origin header, or your instance's own address as in the example, are accepted.

copyparty accepts the password as HTTP Basic authentication with any user name. This guide uses admin throughout.

copyparty serves WebDAV on the same HTTPS address with the same password, so you can mount the share as a drive or sync it with tools such as rclone. From the instance, list the shared folder over WebDAV:

F=/var/lib/sac/data/copyparty-credentials.txt
H=$(sudo sed -n 's#^COPYPARTY_URL=https://\([^/]*\)/.*#\1#p' $F)
W=$(mktemp -d); chmod 700 "$W" ( umask 077; printf 'user = "admin:%s"\n' "$(sudo sed -n 's/^COPYPARTY_PASS=//p' $F)" > "$W/curl.cfg" ) curl -s -K "$W/curl.cfg" --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/copyparty/copyparty.crt -X PROPFIND -H 'Depth: 1' -o /dev/null -w 'PROPFIND / -> HTTP %{http_code}\n' "https://$H/" rm -rf "$W"

PROPFIND / -> HTTP 207

With rclone on your own computer, rclone asks for the password and stores it obscured in its own configuration. With the self-signed certificate, add --no-check-certificate, or install your own certificate first (Step 9):

rclone config create copyparty webdav url https://<your-copyparty-host>/ vendor owncloud user admin --obscure pass <COPYPARTY_PASS> rclone ls copyparty:

On Linux, davfs2 mounts the share as a folder: sudo mount -t davfs https://<your-copyparty-host>/ /mnt/copyparty.

Windows and macOS can map the share as a network drive too, but both insist on a certificate they trust. Install a certificate from a public authority first (Step 9).

To replace the password with a new random one, run the command below. It writes the new password to the credentials file. The old password stops working at once, and every signed-in browser has to sign in again.

sudo copyparty-set-password

To choose your own (16 to 128 printable characters, no spaces, :, ,, # or \), pass it on standard input so it never appears in your shell history or the process list:

read -rs NEWPASS && printf '%s\n' "$NEWPASS" | sudo copyparty-set-password --stdin; unset NEWPASS

Point a DNS record at the instance (an Elastic IP keeps the address across stop and start), then tell copyparty its name. The command below creates a new self-signed certificate for that name, updates the nginx host rule and the cross-site guards, and keeps the name across reboots:

sudo copyparty-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/ssl/copyparty/copyparty.crt (full chain) and /etc/ssl/copyparty/copyparty.key (mode 0600, owned by root) with your own and run sudo systemctl reload nginx. Running copyparty-set-hostname again later replaces them with a new self-signed pair.

If you do not set your own name, each boot checks the instance's names. After a stop and start that changed the public address, the next boot issues a new certificate and updates the URL in the credentials file for the new name. Nothing changes on a boot where the names are the same.

copyparty shares /srv/copyparty, owned by the copyparty service user, and nothing outside it. Its own state (indexes, sessions and keys) is in /var/lib/copyparty.

To keep files on their own EBS volume:

• Attach and format the volume.
• Stop the service with sudo systemctl stop copyparty.
• Copy the folder over and mount the volume at /srv/copyparty. Add it to /etc/fstab with nofail.
• Make sure the mount point is owned by copyparty:copyparty with mode 0750, then start the service again.

The simplest complete backup is an EBS snapshot, or AWS Backup on the instance. For a file-level copy, run:

sudo tar -czf /root/copyparty-files-backup.tar.gz -C /srv copyparty

The settings are in /etc/copyparty/copyparty.conf (the server and the shared folder) and /etc/copyparty/accounts.conf (the salt and the password hash, written by copyparty-set-password). Both files are owned by root and readable only by the service. After editing, apply the change with:

sudo systemctl restart copyparty

copyparty-config-check runs before every start. It stops copyparty from starting with any of these settings, which this image keeps off: listening beyond 127.0.0.1, FTP, SFTP, SMB, TFTP, network discovery, identity provider headers, automatic sign-in by IP address, changes through plain links, an anonymous permission, or a password stored in clear text. Run it yourself after an edit to see what it would refuse:

sudo -u copyparty /usr/local/sbin/copyparty-config-check

The in-browser reload cfg button of copyparty's control panel is switched off for the same reason: a restart always runs the check first.

The copyparty documentation describes more folders, accounts and per-folder options. A new account's password must be stored as a hash made with the same salt, for example:

sudo bash -c 'T=$(mktemp -d); printf "[global]\n ah-salt: %s\n" "$(sed -nE "s/^ *ah-salt: *//p" /etc/copyparty/accounts.conf)" > $T/s.conf; read -rs PW; printf "%s\n" "$PW" | env -i PATH=/usr/bin:/bin HOME=$T XDG_CONFIG_HOME=$T /opt/copyparty/bin/copyparty -c $T/s.conf --ah-alg scrypt --ah-gen - 2>/dev/null | tail -1; rm -rf $T'

Every service is enabled, so copyparty returns after a reboot or a stop and start. Unattended security upgrades keep the operating system, Python, Jinja2 and nginx patched. Verify both:

systemctl is-enabled copyparty copyparty-set-host nginx unattended-upgrades

enabled enabled enabled enabled