Downloads In A Web Browser

A recipient can download shared files in a web browser, without the JetStream app. They open a page on your own domain, paste the link you sent them, type the passphrase if the share has one, and download the files.

Nothing about the share changes. The same link, the same passphrase, the same expiry, the same download limit, and the same audit trail.

Note

A browser download is a plain HTTP download. It does not use the JetStream transfer protocol, so it is slower than the app. Tell recipients who move large files to install the app.

What you must set up

You need three things.

  1. A reverse proxy on the same machine as the server, or a certificate for the server. By default the web share tier listens on the loopback address only, so nothing outside the machine can reach it except through the proxy. To run without a proxy, give --web-share-bind a non-loopback address, and give --web-share-tls-cert and --web-share-tls-key. The tier then uses TLS itself.

  2. A domain name and a TLS certificate, on the proxy or on the server. You own them. Recipients type a passphrase into this page, so it must use HTTPS.

  3. The server started with a web share port. Specifying the port is what enables the feature. Without it, the server does not start the web share tier at all.

Configure the server

Add these options to your response file, usually /etc/jetstream-server.rsp:

--web-share-port 8892
--web-share-url https://share.example.com

--web-share-port is the port the proxy forwards to. --web-share-url is the address recipients open, which the server sends to clients so the JetStream app can include it in the message a sharer copies.

Tip

You can also set --web-share-warn-size. Above this size, JetStream tells both the sharer and the recipient that a browser download of that size is slow, and that the app is faster. The recipient also sees how long the download takes. It is a message only. JetStream never blocks a download because of its size.

Configure the proxy

The server package installs a configuration file for nginx at /etc/jetstream/jetstream-webshare.nginx.conf. Include it:

server {
    listen 443 ssl;
    server_name share.example.com;

    ssl_certificate     /etc/letsencrypt/live/share.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/share.example.com/privkey.pem;

    include /etc/jetstream/jetstream-webshare.nginx.conf;
}

Include the file. Do not copy its contents into your own configuration, because a later JetStream version can correct the file, and it cannot correct your copy.

Make sure the port in the file is the same as your --web-share-port.

Warning

Do not add compression or any other feature that changes the body of a response. If you do, the response loses its Content-Length. The browser then cannot show progress, and worse, a download that stops early is reported as complete. The recipient receives a damaged file, and no log records the cause.

What a recipient sees

  1. They open the download link you sent them. Or they open your address, for example https://share.example.com, and paste the link.

  2. They type the passphrase, if the share has one, and select Open package.

  3. They see the list of files. To download one file, they select its name.

  4. To download everything, they select Download.

A share with one file downloads that file. A share with more than one item downloads a zip archive.

Limits

  • Shares that use cloud storage cannot be downloaded in a browser. The page shows the file list and tells the recipient to use the JetStream app. The sharer is told the same thing when they create the link.

  • A single-file download can continue after an interruption. An archive download can continue only when the server knows the check value of every file in it. The first complete download of a share gives the server these values.

  • The web page cannot upload files. It only downloads.

You cannot use --web-share-port together with --api-disable-shared-tokens. The server stops with an error, because the web share tier can only serve shares that use download tokens.

Warning

Before you install an older version of the server, remove all --web-share-* lines from the response file. An older server does not know these options and stops with an error at startup.

Bandwidth

Browser downloads share the outgoing bandwidth limit with JetStream transfers. Each browser download counts as one participant. If you set --outgoing-rate-limit, that limit includes browser downloads.

By default, one browser download runs at a time. --max-concurrent-weblinks sets the number, and 0 removes the limit. A download above the limit is not stopped. It continues very slowly until a place is free. This limit is separate from --max-concurrent-transfers.

See also