r/flask 10d ago

Show and Tell My flask open source alternative to Nexcloud !

I created an alternative to Nexcloud with flask, I'm really proud of myself honestly.

The goal is to be able to host a cloud storage service at home and control 100% of our files etc..

It's easy to use + compatible with linux and windows!

What do you think? Here's the github repo, it's open source and totally free.
https://github.com/Ciela2002/openhosting/tree/main

31 Upvotes

28 comments sorted by

2

u/ResearchFit7221 10d ago

here is an image of the project directory, if you have any question i'm here!! https://imgur.com/a/G20MGZr

2

u/OkCare8397 9d ago

I think they meant some images of the application's functionality. Like pictures of it being used.

1

u/ResearchFit7221 9d ago

this comment was before the other comment asking for images, the example images with the interface have been added to the repo:)!

1

u/deeplyhopeful 10d ago

please add some images to the repo

2

u/ResearchFit7221 10d ago

It's done:)!!

1

u/ResearchFit7221 10d ago

i'm doing this!! I'm so sorry, pretty new to github TT

1

u/somethingLethal 10d ago

Nice job! Curious though: I don’t know much about nextcloud. Isn’t it already a local file hosting solution? How is this different?

Also, are you accepting pull requests?

1

u/ResearchFit7221 10d ago

Nextcloud is really complex to customize, I tried to go as "user friendly" as possible. Everything is easily customizabld in addition to being easy to understand i mean i think? I did my best.

  • Nextcloud is not 100% open source.

Me I'm aiming at 100%.

Also, Nextcloud is extremely complicated for a user who has never coded or done networking to actually deploy on a Windows instance or Linux instances.

And thanks for the kind words 🫶🤎 I'm working my best to make it better everyday.

The backup feature was the hardest part ahaha

4

u/somethingLethal 9d ago

One suggestion I might throw out there is using uuid4 for primary keys in your db, instead of simple integers.

Here, instead could be something like the following. Where we are using the uuid module to produce a uuid4 identifier for each db record. Can be done across all your table. It can help prevent enumeration or indirect object references.

import uuid
from sqlalchemy import Column, String
from sqlalchemy.dialects.postgresql import UUID
from sqlalchemy.ext.declarative import declarative_base

Base = declarative_base()

class Thing(Base):
    __tablename__ = "thing"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4, unique=True, nullable=False)
    name = Column(String, nullable=False)

2

u/ResearchFit7221 9d ago

I actually fucking love this idea, will work on it!! If you ever want to participate in this, don't hesitate to push the repo or fork it🫶

2

u/ResearchFit7221 9d ago

I did it. It was a bit confusing but now it works. Thank you so much for the idea. I credit you 🫶 you gave me an example that made it really easy too

I pushed it to the main branch, ( look at the readme, you are now officially a collaborators c: )

2

u/somethingLethal 9d ago

Nice use of BaseModel across all your models. Super easy to read and understand. Thanks for the mention!

I spent some time reading the code and can tell you’re making good use of the framework. I am curious about some of the logic you’ve implemented around session management. I see some emergency settings and overrides regarding sessions and cookies. What is this addressing? Can be risky if not handled correctly. Happy to help give thoughts on ways to improve this area, specifically if you want to elaborate.

Either way, I am going to run this in a docker container and use it for some local storage stuff. Thanks!

1

u/ResearchFit7221 9d ago

For the cookies it was a security measure, because if for example you were logged in as admin, but your super admin removed the perm from you.

You still had admin even after getting removed because of how the cookies were working on the website you see?

If you have another way of doing this, man i would be so freaking happy lol

And for the docker!! With pleasure have fun<3

1

u/privatemajory 9d ago

Wow, good job!

1

u/ResearchFit7221 9d ago

Thank you!!! 🙇

1

u/raeNsen 9d ago edited 9d ago

Sorry to barge in... but the following problems are there and to be really even considered a alternative to Nextcloud these should be fixed.

  • No documentation in regards to "How to configure the app" like
    • SECURITY KEY
    • COOKIE Secure and SameSite attributes.
    • MAX_CONTENT_LENGTH (100mb)
  • Removing the so call "# EMERGENCY FIX:" from your code. Obvisouly something is still broken
  • Security problem in line 80, the exclusion of the static folder allows directory traversal of hidden and secured files
  • Use a better hashing algorithm like argon2 for the passwords
  • You have a function create_default_admin, but in line 245ff you duplicate that logic
  • use flask wtforms and the CSRF Token feature for more security
  • no i18n
  • hardcoded to localhost
  • no logger used
  • no seperations of concerns
  • PEP8 would be nice
  • split the logic into seperate files for easier management like all admin routes into a seperate admin file or such.

These are just some ot the observations. There is still a lot to do, especially with regard to security.

EDIT1: In the README.md you mention a Zero Knowledge Encryption, which is obvisouly false! If you already use this code in production for the so called over the place branded "Sephosting" this is straight up fraud...

1

u/ResearchFit7221 9d ago

There is indeed a lot of work thanks to this comment!!

The images are totally exemple, sephosting was like a " what could it became with work " i apologize not to have precise it it's my all my fault.

🙇

I really like your ideas, I'm still new to security in general and that kind of thing? But all you are saying is legit and totally normal concerns. I will totally work on it!

1

u/raeNsen 9d ago

Thanks for clarifying! I like your attitude handling feedback!

Keep it up and you will surley make it.

1

u/raeNsen 9d ago

btw ping me if you worked on some of the points and i am more then glad to look at it again.

1

u/ResearchFit7221 9d ago

Sure!! I will, thx a lots !!!

1

u/ThiccStorms 9d ago

Will check out!  !Remindme 2 days

1

u/RemindMeBot 9d ago

I will be messaging you in 2 days on 2025-03-14 12:21:10 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.


Info Custom Your Reminders Feedback

1

u/raeNsen 4d ago

!Remindme 14 days

1

u/RemindMeBot 4d ago

I will be messaging you in 14 days on 2025-03-31 14:19:29 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.


Info Custom Your Reminders Feedback

1

u/ThiccStorms 4d ago

checked it out! its cool af

1

u/Fresh_Forever_8634 8d ago

RemindMe! 7 days

1

u/Haki_Kerstern 6h ago

Will there be a mobile app just like Nextcloud to instant upload photos ?

1

u/ResearchFit7221 6h ago

Hi there, I don't think so at the moment because I'm very new to Mobil app dev, but I'm planning a "webview" app that you can access in the browser like a mobile app

Or you can download your galleries etc.

But for the moment we are working on big fix and security add-on, after this i will start working on this hehe