Plik

Search the Marketplace for Plik on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network. Also allow TCP 443 (the web UI and API) from the networks and users that need to share files. Port 80 only issues an HTTPS redirect.

RG="plik-prod"; LOCATION="eastus"; VM_NAME="plik-01" IMAGE_URN="sac1647283583153:plik-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name plik-vnet --address-prefix 10.90.0.0/16 --subnet-name plik-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name plik-nsg az network nsg rule create -g "$RG" --nsg-name plik-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name plik-nsg --name allow-https --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:plik-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name plik-vnet --subnet plik-subnet --nsg plik-nsg --public-ip-sku Standard

Connect to the VM over SSH with your admin user and key:

ssh azureuser@<vm-ip>

Plik listens on loopback 127.0.0.1:8080, and nginx fronts it with TLS on port 443. The /healthz endpoint is public for load balancer probes. The web UI and API require your per-VM credentials.

sudo systemctl is-active plik nginx plik-firstboot ss -tln | grep -E '127.0.0.1:8080|:443 ' curl -ks -o /dev/null -w 'healthz HTTP %{http_code}\n' https://127.0.0.1/healthz cat /opt/plik/VERSION

You should see the services active, plikd listening on loopback with nginx on 443, healthz HTTP 200, and the installed Plik version.

The web UI is served over TLS at https://<your-vm-ip>/. The certificate is self-signed per VM, so your browser warns on first visit. Accept the exception, or trust /etc/nginx/tls/plik.crt, to reach the page. Because authentication is forced, you see a sign-in screen rather than an open upload form.

The administrator account and API token were generated on this VM's first boot and stored in a root-only file. Read them and keep them secret. Then confirm that an unauthenticated upload is rejected and that the per-VM token is accepted.

sudo cat /root/plik-info.txt echo "anonymous -> HTTP $(curl -ks -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1/upload -d '{}')" echo "wrong token -> HTTP $(curl -ks -o /dev/null -w '%{http_code}' -X POST -H 'X-PlikToken: wrong' https://127.0.0.1/upload -d '{}')"
PLIK_TOKEN=$(sudo grep '^PLIK_API_TOKEN=' /root/plik-info.txt | cut -d= -f2-)
echo "per-VM tok -> HTTP $(curl -ks -o /dev/null -w '%{http_code}' -X POST -H "X-PlikToken: $PLIK_TOKEN" -H 'Content-Type: application/json' https://127.0.0.1/upload -d '{}')"

The info note holds PLIK_ADMIN_LOGIN, PLIK_ADMIN_PASSWORD and PLIK_API_TOKEN. It is owned by root:root with mode 0600. An anonymous upload returns 400 anonymous uploads are disabled, a wrong token returns 403 invalid token, and only your per-VM token returns 200.

Load your token into a shell variable, create an upload and add a file. Plik returns a shareable link and gives you the file back on download. Authenticate every request with the X-PlikToken header.

PLIK_TOKEN=$(sudo grep '^PLIK_API_TOKEN=' /root/plik-info.txt | cut -d= -f2-) printf 'Q3 revenue report - sac demo\n' > /tmp/report.txt
UPID=$(curl -ks -X POST -H "X-PlikToken: $PLIK_TOKEN" -H 'Content-Type: application/json' https://127.0.0.1/upload -d '{}' | jq -r '.id')
FILE=$(curl -ks -X POST -H "X-PlikToken: $PLIK_TOKEN" -F "file=@/tmp/report.txt" https://127.0.0.1/file/$UPID)
FID=$(echo "$FILE" | jq -r '.id');
FNAME=$(echo "$FILE" | jq -r '.fileName')
echo "share link: https://<your-vm-ip>/#/?id=$UPID" curl -ks -H "X-PlikToken: $PLIK_TOKEN" https://127.0.0.1/file/$UPID/$FID/$FNAME

The upload is created, and the file uploads over TLS with status uploaded. You get a share link that expires with the upload, and downloading it returns the original content byte for byte.

Sign in at https://<your-vm-ip>/ with the PLIK_ADMIN_LOGIN and PLIK_ADMIN_PASSWORD from your info note. Drag a file onto the upload area, or click to select one. Choose an expiry and any options, such as one-shot or password protection, then select Upload.

Plik returns a shareable link and an admin link for the upload, along with a QR code, a zip archive of all files, and a preview of each file. Share the link with anyone who needs the file. It stops working when the upload expires.

Set "oneShot": true when you create an upload, and the file self-destructs after a single download. This suits sending a secret or a one-time file. Combine it with a short time to live for links that expire quickly.

PLIK_TOKEN=$(sudo grep '^PLIK_API_TOKEN=' /root/plik-info.txt | cut -d= -f2-) printf 'one time secret - sac demo\n' > /tmp/secret.txt
UPID=$(curl -ks -X POST -H "X-PlikToken: $PLIK_TOKEN" -H 'Content-Type: application/json' https://127.0.0.1/upload -d '{"oneShot":true,"ttl":3600}' | jq -r '.id')
FILE=$(curl -ks -X POST -H "X-PlikToken: $PLIK_TOKEN" -F "file=@/tmp/secret.txt" https://127.0.0.1/file/$UPID)
echo "one shot upload $UPID created, expires in 1 hour, file self destructs after the first download"
echo "$FILE" | jq -r '"file: \(.fileName) status: \(.status)"'

The default and maximum time to live are 30 days. The appliance also supports password-protected and removable uploads through the same API and the web UI.

Your account is an administrator, so the Admin menu opens a dashboard. It shows the server configuration and live statistics, and it lets you manage users and uploads. The statistics show anonymous uploads at zero, because authentication is forced.

The metadata database and the uploaded files live on the dedicated data disk mounted at /var/lib/plik, so uploads survive reboots and the disk is captured into the image. Confirm the mount, and confirm that authentication is forced:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/plik df -h /var/lib/plik | tail -1 sudo ls /var/lib/plik curl -ks https://127.0.0.1/config | jq '{feature_authentication, maxFileSize, defaultTTL}'

The data disk is ext4, mounted at /var/lib/plik, and holds plik.db (the SQLite metadata database) and the files store. The /config endpoint reports feature_authentication: forced.

The appliance ships with a self-signed certificate generated per VM. For production, point a DNS record at the VM and replace it with a CA-signed certificate. Use Certbot to obtain one, then copy it into the nginx TLS paths:

sudo apt-get update && sudo apt-get install -y certbot
sudo certbot certonly --standalone -d your-domain.example.com
sudo cp /etc/letsencrypt/live/your-domain.example.com/fullchain.pem /etc/nginx/tls/plik.crt
sudo cp /etc/letsencrypt/live/your-domain.example.com/privkey.pem /etc/nginx/tls/plik.key
sudo systemctl reload nginx

Clients can then verify the certificate normally instead of using -k.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Plik. Select the SecureAnyCloud listing and choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The data volume is attached automatically.

Select Launch instance. First-boot initialisation takes well under a minute after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Plik Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=plik}]'

The administrator account and API token are generated uniquely on the first boot of your instance and written to a root-only file. Read them over SSH:

sudo cat /root/plik-info.txt

The file contains the web URL, the admin login and password, and the API token. Keep the file secret, because anyone with the API token can upload to your instance. Confirm the installed version and that both services are running:

sudo cat /opt/plik/VERSION systemctl is-active plik nginx

You should see plik 1.4.2 and both services reported as active.

Confirm that the Plik server is bound to loopback only and that nginx is the sole network-facing listener on ports 80 and 443:

sudo ss -tlnp | grep -E ':(80|443|8080)\b'

plikd listens on 127.0.0.1:8080 (loopback only), while nginx listens on 0.0.0.0:80 and 0.0.0.0:443.

Now confirm that anonymous uploads are rejected. Authentication is forced, so an unauthenticated upload request returns an error:

curl -ks -o /dev/null -w '%{http_code}\n' -X POST https://127.0.0.1/upload -H 'Content-Type: application/json' -d '{}'

This returns 400, and the response body reads anonymous uploads are disabled. Every upload must present the per-instance account or API token.

Browse to https://<instance-public-ip>/ over HTTPS. The TLS certificate is self-signed and generated uniquely for your instance, so your browser warns about it until you install a certificate from a trusted certificate authority (see Bring your own domain and certificate below). Because authentication is forced, you go straight to the sign-in page.

Sign in with the login admin and the password from /root/plik-info.txt. You land on the upload page. Drag in files and choose your upload options: one-shot self-destruct, streaming, removable, end-to-end encryption, password and comment. Set an expiration up to the configured maximum.

Select Upload to create the share. Plik generates a short share link to send to recipients and a separate admin URL for managing the upload. It shows when the share expires, and it offers actions to download a zip archive, show a QR code, add more files or delete the upload.

The API token lets you upload from scripts and pipelines without the browser. The commands below create an upload, add a file to it, and download the file back to prove the round trip. Replace <your-plik-token> with the PLIK_API_TOKEN value from /root/plik-info.txt.

TOKEN='<your-plik-token>' echo 'hello from sac' > /tmp/plik-demo.txt
UPID=$(curl -ksf -X POST -H "X-PlikToken: $TOKEN" -H 'Content-Type: application/json' https://127.0.0.1/upload -d '{}' | jq -r .id)
FJSON=$(curl -ksf -X POST -H "X-PlikToken: $TOKEN" -F "file=@/tmp/plik-demo.txt" https://127.0.0.1/file/$UPID)
FID=$(echo "$FJSON" | jq -r .id);
FNAME=$(echo "$FJSON" | jq -r .fileName)
curl -ksf -H "X-PlikToken: $TOKEN" "https://127.0.0.1/file/$UPID/$FID/$FNAME"

The final command prints hello from SecureAnyCloud, downloaded back through the share link. This is a full authenticated upload and download round trip over TLS. The plik command-line client is also bundled under /opt/plik/clients for scripted uploads with a friendlier interface.

Open the admin menu in the web interface to review your account configuration and usage statistics. The configuration covers maximum file size, maximum user size, and default and maximum time to live. Manage your API tokens under the Tokens tab.