Teldock v1.1.0

Teldock v1.1.0

Self-hosted cloud storage that uses your own Telegram bot and private channel as the backend.

Added

• Public share page. Share links now open a real page at /s/:token instead of bouncing to the landing page. Recipients get a password prompt when needed, see the file's name, size, and upload date, and can download it without an account.
• Video previews. POST /api/previews/generate accepts video/* alongside images and returns a 640x360 JPEG thumbnail with the video duration. Requires FFmpeg; videos above the 25 MB preview cap return 413.
• Documentation site. Complete bilingual (English / Bahasa Indonesia) docs built with VitePress, published to GitHub Pages and deployed automatically on every push to main.
• End-to-end tests. A self-contained Playwright suite under e2e/ covering the public share flow, including the wrong-password path.
• Frontend tests. Vitest and Testing Library, covering the share page and the public share API client.

Changed

• BCRYPT_ROUNDS is read from the environment instead of being hardcoded. Values outside the safe 4-15 range fall back to 12 with a warning.
• WebDAV rate limiting is split into a generous general limit (5000 requests / 15 minutes, configurable via WEBDAV_RATE_LIMIT_MAX) and a separate 20-per-15-minute cap on failed authentication attempts, so mounted clients are no longer throttled.
• Backend test suite grew from 36 to 114 tests.
• Removed the unused form-data and multer dependencies and the dead multer upload machinery.

Fixed

• Share links could not be created twice in the same second. Tokens contained no unique nonce, so two links for the same file created within one second produced byte-identical JWTs and the second request failed with 500. Tokens now include a random jti.
• CORS did not allow PATCH, which blocked file rename, move, and favorite from the browser.
• sanitizeFilename did not neutralize path separators or bare directory tokens, despite being documented as preventing security issues.
• FRONTEND_URL was missing from .env.example, producing relative share links.
• Documentation described features no code implemented (a Redis-backed preview queue, FFmpeg video thumbnails, and the TELEGRAM_API_URL / TELEGRAM_API_SERVER_URL settings).

Upgrade notes

• FFmpeg is now optional-but-real. Video previews need it on PATH; without it they return 503 while image previews keep working.
• WEBDAV_RATE_LIMIT_MAX is a new optional variable (default 5000). The previous blanket 20-requests-per-15-minutes limit is gone.
• FILE_ACCESS_TOKEN_EXPIRE is now documented in .env.example (it was already read by the code).

Documentation

• https://chaerulcp.github.io/Teldock/
• Changelog
• API reference

Full diff: v1.0.0...v1.1.0

Teldock is a non-commercial educational project. Using Telegram's Bot API as general-purpose storage is not an intended use of the platform and may violate Telegram's Terms of Service. Keep independent backups.

Teldock v1.0.0

Initial stable release

• Store large files through bounded, chunked Telegram uploads and streaming downloads.
• Protect previews and downloads with short-lived, file-scoped signed URLs while preserving Bearer-token compatibility.
• Add API-boundary validation, protected sharing controls, download quotas, and Telegram 429 retry backoff.
• Provide version history, folders, tags, smart folders, multi-bot pools, previews, statistics, and Rclone-compatible WebDAV access.
• Add backend tests, linting, GitHub Actions continuous integration, and complete project documentation.

Verification

• Backend tests: passed.
• Backend lint: no errors.
• Frontend production build: passed.
• GitHub Actions CI: passed.