Penombre

A self-hosted drive. All the convenience of cloud storage, on hardware you own, with a bill of exactly zero.

Read the docs Watch the video Desktop & mobile Screenshots Source on GitHub Docker Hub

Penombre in the browser: the drive with its sidebar, shared drives and volumes — **Your files, on your own server.** A drive for files, music, video and documents, in a browser tab, on a box you already run.

At a glance

What it is

Penombre is a file storage and sharing platform for people who want their files back. Drop it on a box, mount a volume, and you get a modern web drive: uploads that survive a reload, generated thumbnails, previews that open in place, notes on any file, share links with an expiry, shared drives for a team, automatic categories, recoverable soft-trash and OAuth logins, without renting the disk from anyone.

It runs on SQLite out of the box: one container, one volume, no database server to run alongside it. PostgreSQL stays supported the day you outgrow that.

Your files stay files. Storage is a plain directory tree on disk, not a block store with a database index, so ls, rsync and Syncthing all still work on it. The documents you write in it are Word, Excel and PowerPoint files, so they stay files too.

And it no longer stops at the browser tab. There is a desktop sync app and a phone app, both talking to the same server, both free.

On your desktop and your phone

Penombre Sync, the desktop app, syncing two folders with per-file progress — **Penombre Sync** A small tray app for macOS, Windows and Linux. Pair a local folder with your drive, a shared drive or a volume, and it keeps both sides the same, both ways. Underneath it is `rclone bisync` over WebDAV, so I didn't reinvent a sync engine and neither do you have to trust one.

The Penombre mobile app: the drive and the full music player with its waveform — **The mobile app** Native, for Android and iOS. Browse your drive and shared drives, play music and video, upload from the camera or scan a document straight into a PDF. It is early, and it is not in the stores yet: an APK for Android, an unsigned IPA for iOS, both attached to every release.

Folders that stay in sync

Several folders, each to its own place. A folder already synced by one pair is left out of any pair containing it, so nothing downloads twice.

Browser sign-in, no password

The desktop app opens your browser, you approve, it mints its own API key and keeps it in Keychain, Credential Manager or Secret Service.

Exclusions and pause

Pick a folder or write a pattern (*.bak, node_modules/) and it stops syncing, deleting nothing. Pause survives a restart.

It knows when the server is down

Nothing syncs, a banner says since when, and it retries every 30 seconds. One notification for a real outage, none for a quick restart.

Updates itself

Stable or canary channel, checked against a published SHA-256 before it replaces itself. Homebrew users get brew upgrade instead.

Scan the code, you're in

Get the apps in the web interface shows a QR code. Point the phone at it and it's signed in. No server address to type on a phone keyboard.

A real player in your pocket

The waveform scrubber, the queue, playback that keeps going while you browse. Videos too, with a quality picker for bad connections.

Uploads from the camera

Take a photo, pick files, or scan a document into a single PDF, straight into the folder on screen.

Everything the web settings do

Account, sessions, two-factor, notifications, appearance, in thirteen languages. Your accent and font follow you between phone and browser.

All of it starts from Get the apps in your profile menu, which hands you the build matching your server's version. The details are in the desktop guide and the mobile guide.

Showcase

Every screenshot below comes out of the repo, not a design tool: Playwright drives a real instance seeded with one file of each supported kind, and the run fails rather than publishing a screen that stopped rendering. Light or dark follows your system, because appearance is a per-account setting and both are the real thing.

The Penombre drive in grid view, showing generated thumbnails — **The drive** Grid view, with thumbnails generated at upload time: video frames, PDF first pages, and waveforms drawn from peak data so they follow your accent colour.

The drive in list view, with per-type icons, sizes and dates — **List view** Per-type icons, size, date and track length on every row. A folder or a category can run to tens of thousands of files (a Reaper project’s media folder, say), so it loads a page at a time, infinite scroll or prev/next, sorted on the server.

An image open in the preview dialog, with notes and full screen one click away — **Previews and notes** Files open in place. Images, video, PDFs and highlighted source get a notes thread one click away and a full-screen viewer one click further; on a track or a video a note pins to a moment, and clicking the timestamp moves the playhead there.

The Penombre music player with a waveform progress bar — **Music** Audio plays in a persistent bottom player whose progress bar is the waveform itself, filling with the accent colour as the track runs. Click anywhere on it to seek. Speed changes the tempo without touching the pitch, and pitch transposes by up to an octave.

A Word document in the editor — **Documents** A `.docx` with the menus and toolbar of a word processor, comments in the margin, and the initials of whoever else has it open.

An Excel workbook in the sheet editor — **Sheets** A real workbook: formulas, several sheets as tabs, and references that follow rows and columns as they move. Saved as an `.xlsx` Excel opens as is.

A presentation in the slide editor — **Presentations** Designed on the slide itself, with shapes, pictures and freehand drawing. A `.pptx`, with a presenter view and a PDF export.

The presentation templates — **Templates** Ten of them, so a deck doesn’t start from a blank white rectangle.

The images category view — **Categories** Files sort themselves as they land: images, video, music, documents, code, archives and 3D objects, with no tagging to do.

Appearance settings, showing typeface, corner and accent options — **Appearance** Three attributes on `<html>` (typeface, corners and accent) re-theme the whole app, including the aurora behind it.

Storage settings: your usage, a breakdown by category and a cleanup card — **Your storage** Your share of the disk, what each category weighs, and a cleanup card with what’s sitting in the trash and your largest files.

The Penombre admin dashboard — **Administration** Users, files, bytes stored, share links and activity at a glance, disk use across every account, and storage per user.

The admin activity log — **Audit log** Who created, updated or deleted what, and when. File and folder names are deliberately never recorded.

Recent, shared, trash and the rest are in the full showcase, all of it generated the same way.

Features

Modern web UI

SvelteKit 5, TailwindCSS 4 and shadcn-svelte. Responsive, fast, keyboard-friendly.

Previews in place

Images, video, audio, PDFs and syntax-highlighted source open in a dialog, not a download prompt.

Notes on any file

A thread beside the preview. On a track or a video a note pins to a timestamp, and every timestamp is drawn on the waveform as a dot you can hover to read and click to jump to — in the player, the preview and the full-screen viewer alike.

A real music player

Persistent bottom player, waveform-as-progress-bar drawn from cached peak data, speed and pitch controls, keeps playing while you browse.

Full screen, properly

An image, a video or a track opens in Penombre’s own viewer rather than the browser’s bare built-in player: name, size, download, real transport controls and the notes thread beside it. A track has no picture to fill a screen with, so it gets a now-playing panel with the waveform where the artwork would have been.

Documents, sheets and presentations

New makes a .docx, an .xlsx or a .pptx. Not a Penombre format with an export button: the Office files themselves, which Word, LibreOffice, Keynote and every phone open as they are. Leave Penombre and you keep files, not an archive to convert.

Office files, saved as themselves

A Word, Excel or PowerPoint file from anywhere else opens in the same editors and saves back as itself, same file, same place. Only the part you edited is rewritten: untouched cells keep their formulas and formatting, slides keep their layouts and theme.

A formula engine of its own

Excel’s functions, workbooks with sheet tabs, ranges, fill, undo, and references that follow inserts and deletes. A formula you type is written as a real formula, so Excel recalculates it on open.

Slides you design

A WYSIWYG editor: ten templates, shapes, pictures, freehand drawing, themes, presenter view and PDF export. Old Markdown decks keep their Marp editor.

Comments and who’s here

Threads on text, cells or slides, with replies and resolve. View or edit mode, view-only sharing, and the initials of everyone else who has the file open.

Download as anything

A document comes out as PDF, Word, a web page, Markdown or text; a sheet as Excel or CSV; a presentation as PowerPoint or PDF.

Signatures

File → Ask for signatures freezes the document to PDF and sends each signer a one-time link, account or not. They sign on a phone, and everyone gets the signed PDF with a certificate and an audit trail. A simple electronic signature, not a qualified one, and the docs say so.

Sharing, two ways

Public links with optional password, expiry and sign-in requirement, or per-user grants at view, edit or full access.

Shared drives

A drive that belongs to a group instead of a person: one tree, one trash, manager / editor / viewer roles. Files belong to the drive rather than to whoever happened to upload them, so a project folder survives the person who started it.

Notifications

A bell for the things other people did, a comment on your file, something shared with you, a signature completed, and nothing you did yourself. Opt in per account to have them emailed too, once an admin has configured SMTP.

Smart categories

Images, video, music, documents, code, archives and 3D objects sort themselves as files land.

Uploads that survive a reload

Transfers run in a Web Worker with the queue in IndexedDB, so a multi-gigabyte video keeps going and picks itself back up.

Mounted volumes

Point VOLUME_*_PATH at a NAS share or an existing tree and it appears in the sidebar as one library everyone browses, optionally read-only. A background pass keeps it in sync with what’s actually on disk, and a Rescan button in its header forces one on demand.

Soft trash

Deletion is recoverable, because everyone deletes the wrong folder eventually.

Yours to look at

Typeface, corner radius and accent colour are per-account settings that re-theme the entire app, light or dark.

Admin panel

Instance and per-user storage, invites, roles, bans, sign-up and security policy, OIDC providers added without touching the environment, and an audit log that records no file names.

Real auth

Better Auth: session cookies, OAuth providers, passkeys, two-factor, and API keys for scripts.

REST API

OpenAPI-documented /api/v1 endpoints with API-key auth, generated from Zod contracts.

Simple mode

Run it as a bare shared file browser: mount a volume, share the login, browse together.

One container, no database server

SQLite with Drizzle by default off the published orochibraru/penombre image. Point DATABASE_URL at Postgres if you’d rather.

An alternative to what, exactly

Nobody wakes up wanting a self-hosted drive. They want out of something specific. So here is where Penombre actually sits, including where it loses.

Nextcloud alternative

Nextcloud is a groupware suite that also stores files: PHP, a database server, an app store, calendars, chat, and a cron job you will eventually debug. Penombre is the drive and nothing else, in one container. If you want the calendar and the chat, keep Nextcloud.

Seafile & ownCloud alternative

Seafile’s block storage is fast, but your files stop being files: the tree on disk is chunks and a database. Penombre keeps a plain directory under STORAGE_PATH, so a backup is rsync and an escape hatch is cp -r.

Google Drive alternative

The same shape, grid, previews, share links, documents, sheets and slides, on a disk you own, with nothing reading your files to improve anything. Google Docs is still more capable than Penombre’s editors, but what it saves is a Google Doc; what Penombre saves is a .docx.

Dropbox alternative

Dropbox is sync first. Penombre is a drive first that now syncs too: Penombre Sync keeps folders on macOS, Windows and Linux in two-way sync with it. Dropbox's client is more polished and syncs faster. It also doesn't let you own the server.

iCloud Drive alternative

iCloud stops at the edge of the Apple fence and bills monthly for the privilege. Penombre runs on the box in your closet, opens in any browser on any OS, has an app for the phone in your pocket whatever it runs, and costs the price of the disk you already bought.

OneDrive, Box & pCloud alternative

Per-seat pricing, quota upsells, and an account that can be suspended with your files inside it. Here the quota is the filesystem and the only way to lose access is to unplug the machine yourself.

DocuSign alternative, for the everyday stuff

A lease addendum, a band agreement, a quote. Penombre gets signatures on those without a per-envelope bill. It does not do qualified signatures or identity checks; when the other side requires them, pay the people who do.

File Browser & Filestash alternative

Both are excellent thin browsers over a directory. Penombre does that too — it’s called simple mode — and adds accounts, sharing, notes, thumbnails and an admin panel when you want them.

Synology Drive & FileRun alternative

One wants you to buy the NAS, the other wants a licence key. Penombre is MIT, runs on whatever Linux box you have, and will happily mount the NAS share you already own as a volume.

Since we’re being honest about search: people get here looking for a Nextcloud alternative, Google Drive alternative, ownCloud alternative, Seafile alternative, iCloud alternative, Dropbox alternative, OneDrive alternative, Box alternative, pCloud alternative, MEGA alternative, Proton Drive alternative, Synology Drive alternative, FileRun alternative, Filestash alternative, a DocuSign alternative or a File Browser alternative. That is the list. It is a self-hosted drive, and it is free.

Run it

Docker run

docker run -d --name penombre \
  -p 3000:3000 \
  -v penombre_data:/data \
  -e AUTH_SECRET=$(openssl rand -hex 32) \
  -e ORIGIN=https://drive.example.com \
  orochibraru/penombre:latest

Docker Compose

services:
  penombre:
    image: orochibraru/penombre:latest
    restart: unless-stopped
    ports:
      - 3000:3000
    volumes:
      - penombre_data:/data
    environment:
      AUTH_SECRET: a-long-random-string
      ORIGIN: https://drive.example.com

volumes:
  penombre_data:

Either way it comes up on http://localhost:3000. One volume holds the lot: the SQLite database under /data/db, your files under /data/storage. Those two variables are the only ones required on a first run — a setup screen creates the administrator account the first time anyone opens it, so no default password ever ships in an env file.

The getting started guide walks through it properly, and the env reference covers everything else: OAuth providers, SMTP, Redis, Postgres, mounted volumes, simple mode.

The apps

The server needs nothing extra. Open Get the apps in your profile menu, or on macOS and Linux:

brew install orochibraru/tap/penombre-sync
brew services start penombre-sync

Penombre Sync needs rclone on your PATH; Homebrew installs it for you. The phone app installs from the .apk or .ipa on each release.

How it’s built

Frontend: SvelteKit with Svelte 5, TailwindCSS 4, shadcn-svelte
Backend: SvelteKit +server.ts routes with Zod-validated contracts that also emit the OpenAPI spec
Database: SQLite with Drizzle ORM, PostgreSQL optional, chosen from the DATABASE_URL scheme
Storage: plain local filesystem, so your files stay files
Documents: OOXML read and written in place, a formula engine of its own, pdfmake and pdf-lib for exports and signed PDFs
Auth: Better Auth
Desktop: Penombre Sync in Rust, driving rclone bisync over WebDAV
Mobile: Kotlin Multiplatform, native on Android and iOS
Screenshots: Playwright, run against a seeded instance, published straight to the docs

MIT licensed. Free, and staying that way. Here’s why.