Gokapi

Open Marketplace in the Azure Portal, search for Gokapi, select the SecureAnyCloud publisher entry, and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. The group must also allow TCP 80 from the client networks that will use the file-sharing UI and download links.

The admin surface on port 80 is protected by a per-VM Basic Auth password, but you should still restrict source ranges. Add TLS (port 443) before sharing anything sensitive, as described in Step 9.

Click Review + create, wait for validation, and then click Create. Deployment takes around two minutes.

RG="gokapi-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:gokapi-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name gokapi-01 \
  --image sac1647283583153:gokapi-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Allow SSH (22) and the web UI + download links (80) from your trusted ranges az vm open-port --resource-group "$RG" --name gokapi-01 --port 22 --priority 1001 az vm open-port --resource-group "$RG" --name gokapi-01 --port 80 --priority 1002

Replace <publisher>:<offer>:<sku> with the URN shown on the Marketplace listing's Usage Information tab.

ssh azureuser@<vm-public-ip>

Use the private key that matches the public key you supplied at deploy time. The login user for this image is azureuser.

Confirm that the Gokapi server and the nginx proxy are running, and check the listening sockets. Gokapi binds to 127.0.0.1:53842 only, so it is reachable from outside the VM solely through nginx on port 80. The AGPL-3.0 licence ships with the image.

gokapi --version systemctl is-active gokapi nginx
sudo ss -ltn | grep -E ':80 |:53842' head -2 /usr/local/share/gokapi/LICENSE.md

Expected output:

Gokapi v2.2.4 active active LISTEN 0 4096 127.0.0.1:53842 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:* GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007

On the first boot of your virtual machine, gokapi-firstboot.service generated two secrets that are unique to your instance. They are the Gokapi admin login password and the nginx Basic Auth password for the admin surface. The service wrote both to a root-only file. Retrieve them with this command:

sudo cat /root/gokapi-credentials.txt

The file reports the URL, the Basic Auth credential that guards the admin surface, and the Gokapi admin login:

gokapi.url=http://<vm-public-ip>/ gokapi.basicauth.user=admin gokapi.basicauth.pass=<generated-per-vm> gokapi.admin.user=admin gokapi.admin.pass=<generated-per-vm>

A shipped self-test confirms the whole credential model without printing any secret. It proves that the public surface is open, that the admin surface rejects missing and wrong Basic Auth, and that the per-VM admin login round-trips:

sudo bash /usr/local/sbin/gokapi-credcheck.sh

Expected output:

OK

Gokapi is a file-sharing server, so its download links are public. Recipients fetch them with no login.

Everything that can change state is protected. The admin surface requires the per-VM HTTP Basic Auth password, and then Gokapi's own admin login on top. You can see both halves with curl:

BASIC_PW=$(sudo grep '^gokapi.basicauth.pass=' /root/gokapi-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'public /login -> HTTP %{http_code}\n' http://127.0.0.1/login
curl -s -o /dev/null -w '/admin no auth -> HTTP %{http_code}\n' http://127.0.0.1/admin
curl -s -o /dev/null -w '/admin wrong pw -> HTTP %{http_code}\n' -u 'admin:definitely-wrong' http://127.0.0.1/admin
curl -s -o /dev/null -w '/admin per-VM -> HTTP %{http_code}\n' -u "admin:$BASIC_PW" http://127.0.0.1/admin

Expected output:

public /login -> HTTP 200 /admin no auth -> HTTP 401 /admin wrong pw -> HTTP 401 /admin per-VM -> HTTP 200

In a browser, go to http://<vm-public-ip>/admin. The browser first prompts for HTTP Basic Auth. Enter user admin and the gokapi.basicauth.pass value from Step 5.

Gokapi then shows its own login page. Sign in with user admin and the gokapi.admin.pass value from Step 5:

After you sign in, you land on the Upload panel. Drag files onto the drop zone, or click to select them, and set an optional download limit, expiry and password.

Each uploaded file appears in the table below with its own share ID and a set of actions: copy the share URL, open the share dialog, download, edit or delete.

Share the link Gokapi generates (for example http://<vm-public-ip>/d/<id>/<filename>). Recipients open it in any browser with no login and see a clean download page for just that file:

You can automate the same flow with the Gokapi API. Create an API key in the API menu of the admin panel, and then upload and share files programmatically. The uploaded file's UrlDownload resolves anonymously through nginx:

# On any client, with an API key created in the admin panel's API menu:
curl -s -H "apikey: <your-api-key>" -F 'file=@report.pdf' \
  http://<vm-public-ip>/api/files/add | jq -r .FileInfo.UrlDownload
# -> http://<vm-public-ip>/d/<id>/report.pdf (open with no login)

The UI and download links are served over plain HTTP on port 80. Before you share anything sensitive, terminate TLS in front of Gokapi. Add a Let's Encrypt certificate to the bundled nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

First, point your DNS A record at the VM's public IP and open port 443 in the network security group. Certbot updates the bundled nginx vhost in place and preserves the access model.

After you add a custom domain, update Gokapi's own external URL so that generated links use it:

sudo -u gokapi GOKAPI_CONFIG_DIR=/etc/gokapi GOKAPI_DATA_DIR=/var/lib/gokapi/data \
  /usr/local/bin/gokapi --reconfigure
# follow the prompts, or edit ServerUrl in /etc/gokapi/config.json
sudo systemctl restart gokapi

To rotate the Basic Auth password on the admin surface, update the htpasswd file and then reload nginx:

sudo htpasswd /etc/nginx/.gokapi.htpasswd admin
sudo systemctl reload nginx

To rotate the Gokapi admin login password non-interactively:

sudo -u gokapi GOKAPI_CONFIG_DIR=/etc/gokapi GOKAPI_DATA_DIR=/var/lib/gokapi/data \
  /usr/local/bin/gokapi --deployment-password '<new-password>'
sudo systemctl restart gokapi

By default, files are stored on the VM's local disk with metadata in SQLite. To store files in an S3-compatible object store instead, run Gokapi's reconfigure wizard and provide your bucket, region, keys and endpoint:

sudo systemctl stop gokapi
sudo -u gokapi GOKAPI_CONFIG_DIR=/etc/gokapi GOKAPI_DATA_DIR=/var/lib/gokapi/data \
  /usr/local/bin/gokapi --reconfigure sudo systemctl start gokapi

See the Gokapi cloud storage documentation for the exact S3 settings, including the CORS configuration that encrypted downloads require.

# Status and logs systemctl status gokapi --no-pager sudo journalctl -u gokapi -n 100 --no-pager
# Restart after changing configuration
sudo systemctl restart gokapi
# nginx (the reverse proxy)
sudo nginx -t && sudo systemctl reload nginx