~horsieshare

Secure file hosting with horses.

Features

Encryption at rest with AES-256-GCM (per-file keys)
PAM authentication on every request — no session tokens
Brute-force protection (per-IP lockout after failed attempts)
Automatic EXIF stripping from images
Hardware-aware media compression (images & video via FFmpeg)
Video thumbnails for Discord/Telegram/social embeds
oEmbed support with per-user custom embed colors
ShareX compatible (Base64 auth token support)
Secure file shredding on deletion/expiry (7-pass, exceeds DoD 5220.22-M)
Configurable file retention (1-168 hours)
Per-user retention quota with authenticated deletion
Exclusive to tilde.horse members

API Usage

Basic upload:

curl -F "file=@/path/to/file" \
-u username:password \
https://share.tilde.horse/api/upload

With options:

curl -F "file=@/path/to/file" \
-u username:password \
-H "X-Retention: 48" \
-H "X-Skip-Compression: 1" \
https://share.tilde.horse/api/upload

Request headers:

X-Retention: retention period in hours (default: 24)

X-Skip-Compression: any value skips compression (faster upload)

Response headers:

X-Retention-Hours: actual retention applied

X-Quota-Used / X-Quota-Total / X-Quota-Remaining: quota in MB

Check retention quota:

curl -u username:password \
https://share.tilde.horse/api/quota

Returns JSON with used/total/remaining bytes for currently retained files

Delete files:

curl -X DELETE \
-u username:password \
https://share.tilde.horse/api/delete/FILENAME.EXT

You can only delete your own files

Set custom embed color (Discord, Telegram, etc.):

curl -X POST \
-u username:password \
-H "Content-Type: application/json" \
-d '{"color": "#ff5733"}' \
https://share.tilde.horse/api/embed/color

Supports hex colors: #4a9eff, 4a9eff, #fff, fff

Get your current embed color:

curl -u username:password \
https://share.tilde.horse/api/embed/color

Returns your custom color or the default branding color

Get raw file (no preview page, for direct embedding):

https://share.tilde.horse/raw/FILENAME.EXT

No auth required — use for direct links in embeds or scripts

Upload Script

CLI script with fzf integration and custom retention:

examples/upload.sh

Setup:

export HORSE_TOKEN=$(echo -n "username:password" | base64)

Usage (outputs URL to stdout for piping):

# Upload and copy to clipboard (Wayland)
./upload.sh /path/to/file | wl-copy

# Upload and copy to clipboard (X11)
./upload.sh /path/to/file | xclip -selection clipboard

# Upload from stdin
cat file.txt | ./upload.sh | wl-copy

# Interactive mode (requires fzf)
./upload.sh | wl-copy

Limits

Default retention: 24 hours

Max file size: 100MB

Retention quota: 512MB per user (total of non-expired files)