vibecodeit

Build WeTransfer

YESreplaces $8/mosaves $96/yrback to the verdict

0%0 of 17 items done

Saved on this device only. Tick prerequisites first, then work the phases in order · do not start one until the checks above it pass.

Large-file transfer on a bucket you pay cents for: uploads go straight to object storage with presigned URLs, links expire and count downloads, optional passwords, and optional client-side encryption with the key in the URL fragment so the server never sees it.

estimated effort one sittingthe files for this build are in the project pack

StorageCloudflare R2 or Backblaze B2 with presigned URLsRuntimeNode 22, node:http and node:sqliteEncryptionWeb Crypto in the browser, optional

Before step 1

Everything below is assumed from the first step. Tick each one when you actually have it, not when you plan to.

  1. installfree

    Why Everything in this build runs on it: the server, the scripts, the tests.

    Get it Download the LTS installer from nodejs.org, or install with your package manager (brew install node, or nvm install 22). Restart the terminal afterwards. open ↗

    Verify node --version prints v22 or higher

  2. installfree

    Why Every step below is a command you type or a file you edit.

    Get it VS Code (code.visualstudio.com), Cursor or Zed. Open a folder for the project and use the editor's built-in terminal. open ↗

    Verify You can open a folder and run a command in its terminal

  3. installfree

    Why History for your code, and the way most hosts deploy.

    Get it Install from git-scm.com or with your package manager, then run git init in the project folder once it exists. open ↗

    Verify git --version prints a version

  4. API keycents to a few dollars a month

    Why Direct browser uploads need CORS on the bucket.

    Get it R2: create bucket, API token, and set CORS to allow PUT from your domain. B2: similar under bucket settings. open ↗

  5. about $5 a month

    Why This needs one process running all the time with a public address. The page and link table need a small always-on process.

    Get it Hetzner Cloud (from about 4 EUR), DigitalOcean or Fly.io. Ubuntu 24.04, the smallest size. You need SSH access and a public IP. Only needed for the deploy phase; develop locally first. open ↗

  6. roughly $10 a year, or free on an existing domain

    Why send.yourdomain.com

    Get it Register at Cloudflare Registrar, Porkbun or Namecheap, or use a subdomain of one you already own. You add one DNS record in the deploy phase. open ↗

  7. installfree

    Why Automatic HTTPS in front of the Node process. Without TLS the browser features this relies on (and your visitors' trust) do not work.

    Get it On the VPS: follow the install steps at caddyserver.com/docs/install for Ubuntu. One Caddyfile with your domain and a reverse_proxy line is the whole config. open ↗

    Verify caddy version prints a version on the server

Data model

Create these before the first phase that stores anything. Changing a table later is the expensive kind of change.

- transfers: id (long random slug), created_at, expires_at, downloads, max_downloads, password_hash (nullable), note
- files: id, transfer_id, key, name, size, content_type
Object keys are random, never the original filename.

Environment variables

These go in a .env file the app reads at startup. The pack's .env.example is this table as a file · copy it, never commit the filled-in version.

VariableNeededExampleWhere the value comes from
PORTrequired3000Any free port.
DATABASE_PATHrequired./data/transfers.dbSQLite file.
S3_ENDPOINTrequiredhttps://<account>.r2.cloudflarestorage.comBucket endpoint.
S3_BUCKETrequiredtransfersBucket name.
S3_ACCESS_KEY_IDsecretrequired...Bucket key.
S3_SECRET_ACCESS_KEYsecretrequired...Bucket secret.
MAX_TRANSFER_GBoptional20Total size cap per transfer.
SITE_URLrequiredhttps://send.yourdomain.comPublic base URL.

The build, in order

  1. Upload

    Presigned PUTs from the browser with progress; multipart over 100 MB; nothing touches your disk.

    1. transfers (id long random slug, created_at, expires_at, downloads, max_downloads, password_hash, note), files (id, transfer_id, key, name, size, content_type). Keys random, never the filename.

      terminal
      mkdir send && cd send && git init && npm init -y && npm pkg set type=module && npm install @aws-sdk/client-s3@3 @aws-sdk/s3-request-presigner@3
mkdir -p data && cp .env.example .env
    done when · tick each as it passes
    next phase

  2. Download

    A file list, short-lived presigned GETs, counted downloads, a limit.

    done when · tick each as it passes
    next phase

  3. Expiry and passwords

    Expired links explain themselves; objects are deleted; passwords are rate limited.

    done when · tick each as it passes
    next phase

  4. Encryption

    Key in the fragment; server never sees it.

    done when · tick each as it passes
    next phase

  5. Deploy

    Lifecycle rules as a backstop, healthz, service, README.

    2. Files README.md

    done when · tick each as it passes
    next phase
what this build does not replace
after v1, if you want it

Need the files? The project pack on the verdict page hands your agent the whole brief · more cloud storage.