Hello to all passionate selfhosting enthusiasts! Today, however, I have to ask you about a problem that can’t be fully solved by a selfhosted solution. But I believe it’s still closely related to selfhosting.
I’d like to automate mirroring some files/catalogues to different storage providers and then obtain public sharing links for each of them. So I’m looking at Rclone. It supports a variety of different storage providers, which is nice. But is there any structured information about which of them support sharing files via public links? There are just too many of them to quickly check them all.
So if there is no such data, I’ll probably also slowly try them out on my own to see which ones are suited for me, and post the results in the comments if you don’t mind! Maybe.
Well, ideally I’d certainly like to share these files with a selfhosted solution without relying on any 3rdparty «cloud» storage, but that’s not possible without either TLD and public IP or additional software besides web browser on the client side, right? So I’m looking for a somewhat pragmatic solution for now.
Also, maybe you have some useful tips on configuring Rclone for this task in general? I’m considering using union feature with create_policy = all to upload to several storages simultaneously, but is it possible to get public links in this setup?
So, let me summarize everything that I’ve figured out so far:
- There is a detailed breakdown of the optional features of all supported storage providers in the Rclone documentation, including public sharing links feature. Exactly what I was thinking about. So my initial search has now narrowed down a bit. I like how no one even tried to dig in that direction :D I appreciate you pushing me towards the hard-selfhosting path, though! Community name checks out, as they say…
- AFAIK all dynamic DNS services work like this: you install a daemon on your PC (or router), it connects to the DDNS provider’s server. That server looks at the source IP address of your request and then puts it into the
Arecord of the domain name they provide you. So it won’t work with reverse-proxying daemons like Cloudflare Zero Trust or Netbird, at least not directly. - On the other hand, these reverse-proxying solutions (TIL it called ZTNA — Zero Trust Network Access) has an option to use it with external domains. Their documentation mentions that you should set a specific
CNAMErecord for your domain. However, Cloudflare supports this setup only on the paid plans! So it turns out that Cloudflare Zero Trust isn’t suitable for this task at all. - And just out of curiosity: does Cloudflare shows the same obnoxious browser check page in front of a service behind its Zero Trust? And will it even work with a non-browser client in that case, like Nextcloud client? I know that you can set up a split-horizon DNS (such a cool name!) to open your service from within your network, I’m just curious.
- Seems like Netbird allow you to use external domain for free with their gateway. Finally, good news! You still need a DDNS provider that allows you to set
CNAMErecord for a free domain name, though. No-IP, however, provides this option only for their paid domains. So it also isn’t suitable for this task. Are there any DDNS providers that allows you to setCNAMErecord for free?
Am I missing something? Also, hope you don’t mind me overexplaining like that! It’s pretty much notes for myself, but you never know if it might be useful for someone else.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System LXC Linux Containers SSH Secure Shell for remote terminal access VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
6 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.
[Thread #164 for this comm, first seen 10th Nov 2026, 11:30] [FAQ] [Full list] [Contact] [Source code]
Either attach your home server to a VPS or NextCloud, or start building the reverse proxy and DDNS stack on your local machine. I chose the latter because I have a stable IP address and the time to futz with things.
I have Proxmox running with Authentik running in an LXC. All public traffic gets routed to it and it sorts out which service the user will receive. My other services are located on separate LXCs/VMs, which have their own public subdomains. I also installed crowdsec inside the Authentik LXC to catch the automated bots looking for open ports and unsecured admin panels.
I am not an expert. If a VPS or Nextcloud gets you what you need, I would recommend either option. At the end of the day, you’ll need to pay someone for a public address.
Another option is a $5 vps and domain. Install caddy on it with caching, and point it at your local storage using SSH. Meets your criteria of self hosting the storage, but only caches on the VPS for performance. You could even use rclone to mount the files if you want.
More manual than the other options, but much simpler mental model and an excellent platform to learn how things work. Gives you the chance to also host a static website too.
Well, while it’s probably the most sane solution, it doesn’t suit me at all, unfortunately. For me, there is a strict requirement: it must be free of charge, without any payment at all. Guess I should have mentioned it explicitly in the original post, but I did not expect such an immediate direction shift!
You want NextCloud
I know, right? But it requires a valid TLD and a public IP, so this is not an option, unfortunately.
Yeah, if you are going to self host something like this you are going to need to be able to accept connections from people one way or another. Possibly a VPN solution like Netbird or Tailscale could work, but then all your users would need to have an additional client which is probably going to be a hassle.
Realistically you may want to look into S3 providers, and if they support public pre-sig link, which is most likely what recline link uses. Basically the S3 API allows authenticating with a signature as a part of the URL that are scoped to a specific object and optionally expires.
Edit: An option could be to use a small VPS as entrapping and setup a VPN to it, or something like Cloudflare tunnels
Basically the S3 API allows authenticating with a signature as a part of the URL that are scoped to a specific object and optionally expires.
I see, like that, right? But it says expiration is rather mandatory than optional, and these pre-signed links lasts no longer than 7 days! Or is it just an Amazon’s own limitation, and other S3-compatible providers might provide unlimited expiration time?
you can serve anything through a cloudflare tunnel without public IP
Interesting… I didn’t even think it could be used that way! So I might as well consider this option for real. Can it be used with a dynamic dns TLD?
Don’t feel brave enough to selfhost a public-facing service, though…
There is also Netbird reverse proxy. Which is similar to cloudflare tunnel but wireguard tunnels instead. There are videos on making links available only, via Netbird (https://www.youtube.com/watch?v=HoaLRuIdiNU)
Yea it’s called zero trust on cloudflare. Allows you to expose a service (ip : port) on your WAN on the net via a TLD with zero trust running. It’s a sort of tunnel, and because the ip address is cloudflare it obfuscates your ip. You can’t get exposed via dns a records. You can add restrictions too. I always do geo based and only let connections local to me in.
Can you do this without a domain?
No. Need a domain to assign the endpoint to a subdomain. Cloudflare do have at cost domains so you can get them cheap and consider it the cost of the service.
No. Just buy an xyz domain. They’re like 1.99
15$ is the cheapest I can find for XYZ. But no worried.
Also for the second and following years?
Check out using ddns. It’s not perfect, but works. There are updater containers you can run. NoIP used to have freebie domains, I bought a domain a while back, then switched to cloudflare for convenience despite it being cloudflare (you can leave tell them not to use their proxy for individual sub-domains). Bonus points for using something like nginx proxy manager or cert-manager to handle acme LetsEncrypt certs, because unencrypted http is BAD.
And… how to obtain a public IP, then?
because unencrypted http is BAD.
Sorry, I don’t enjoy such blatant wordings at all. I prefer to say «supports delivering content unmodified solely by a lucky chance» :D
Edit: now, after reading @benno@sh.itjust.works’s and @bigmclargehuge@lemmy.zip’s comments, I realized that Cloudflare tunnel could be used for reverse-proxying traffic to the local daemons! You know, when you think about Cloudflare, you genuinely feels nothing but repulsion after all that endless browser check pages, and don’t even consider it as something useful. So for now, I’m trying to wrap my head around all of this to ask a meaningful question. So it’s not over yet!
This is probably a terrible idea, but I have api sites set up with cloudflared for when I want to share something with someone, like if I want to share a file through gokapi or filbrowser, or share a jellyfin access. Cloudflare access is set to bypass except for country restrictions. Anything access I grant or share is behind at least a password, and share links are only for a couple of hours or days, then they disappear.
All of my other services are restricted to me through cloudflare access, oauth, and the builtin user/pass access for each service.
Look at yggdrasil for ip address as well as end to end encryption
I know Yggdrasil, it’s pretty cool! But if I’m about to ask my audience to install some additional software, I’d rather prefer ZeroNet, as it provides built-in P2P redundancy and doesn’t even depend on my host being alive. So it likely fits better with my initial idea. Although I really don’t have confidence to ask for this, unless this hypothetical software is purposefully tailored to my use case. And for now, It doesn’t exist (yet?).
You are always behind a public IP, a dynamic DNS and domain help identify what that is to others without making manual changes every time your public IP changes.
