v3.0.0

A modern, lightning-fast file sharing platform built for self-hosting

✨ New Features and Changes

Flare 3.0 is here! I know 2.0 came out barely a month ago, so another major version already is a little weird. I've just been super motivated to put some work into Flare, and this update grew into something that deserves 3.0. There's a lot here, from a full role system and stronger sign-in security to archive tools and a much nicer way to move through a large library.

There are real compatibility changes behind the version number too: roles replace the old user/admin model, custom dashboard clients need updated account fields, and everyone will sign in again after upgrading. I've covered those below and in the upgrade guide.

• Roles and permissions: create your own roles, assign several to an account, and choose exactly who can upload, share, moderate, manage users, change settings, or configure integrations. Everyone supplies the baseline, with hierarchy and delegation rules for additional roles. Existing administrators keep full access.
• Two-factor authentication and passkeys: set up an authenticator app with recovery codes, or sign in with your device or security key. An optional Require passkey to sign in setting blocks password and SSO sign-in for your account and provides a separate emergency recovery set. Adding a passkey alone keeps your other sign-in methods available.
• Sessions and login history: see where you're signed in, review successful and failed sign-ins, revoke one browser, or sign out everywhere from Profile. API and uploader credentials remain separate.
• Audit log: investigate uploads, sharing, deletions, authentication, permissions, settings, integrations, archives, and invites. Search by filename or actor, filter outcomes, and inspect recorded details, even after the original file or account is gone.
• Archive tools: browse ZIP, TAR, TAR.GZ/TGZ, and GZIP files, search their paths, preview text and images, and download individual entries. Extract into your library with the folder structure preserved, or package selected files into ZIP or TAR.GZ. Shared archive pages have browsing and entry downloads too. New outputs start private; you can explicitly choose an upload profile instead.
• A continuous file library: scroll through your whole library with a date rail for jumping straight to older uploads. Only nearby rows are rendered, selections survive scrolling, and opening a file then going Back restores your place. Desktop, mobile, keyboard navigation, and existing filters all work together.
• Invite links: let people create an account while public registration stays closed. Set uses, expiration, and optional roles, revoke links, and see who joined. Invitations start administrator-only; you can enable them for selected roles or everyone.
• Release-matched docs: browse dated handbook archives, compare releases, and explicitly open rolling documentation. Documentation in Settings and Setup guide during setup take you to the guides for your installed version.
• Storage reliability and fixes: account deletion now queues recoverable cleanup that survives restarts and retries failures, with recorded upload destinations helping it target the right storage. Avatar cleanup is safer too. Empty S3 thumbnails and moderator previews of private/password-protected images are fixed, alongside account-switch privacy, selected-file metadata, and dependency updates.

The goal I have for Flare going forward is a file vault you can really make yours, configurable right down to the smallest details for whatever use case you have. That might be a personal screenshot host, a family library, or a shared workspace with its own permissions and workflows. I want strong, easy defaults out of the box, with more room to customize as you need it. Appearance, uploads, sharing, access, and automation are all part of that direction.

There's plenty more I want to build, so expect more updates. Keep the suggestions coming, especially the little things that would make Flare fit how you actually use it.

📸 Demo

I've included development captures of each new workflow below, using isolated demonstration accounts and real server operations. Version labels in these captures predate 3.0. Passkey recordings use a browser's virtual authenticator; the phone demo shows the real app at mobile width. Handbook screenshots show local site previews. Each linked walkthrough includes a written transcript.

Roles and delegated administration

Choose permissions for a role, then combine roles on an account.

Watch create and assign a role · Guide and transcript

Authenticator 2FA, passkeys, and emergency recovery

Enroll an authenticator, add a passkey, or explicitly require passkeys for your account. Secret values are concealed in the demonstrations.

Watch authenticator setup and recovery · Watch passkey registration and sign-in · Watch required-passkey sign-in and recovery

Security guide · Written walkthroughs

Active sessions and login history

Review signed-in browsers and sign-in attempts, revoke another browser, then sign out everywhere.

Watch session management · Guide and transcript

Investigating instance activity

Find a deleted file's history, inspect the recorded actor and details, and filter denied operations.

Watch the audit investigation · Guide and transcript

Browsing, extracting, creating, and sharing archives

Inspect an archive before importing it, extract its folder tree, or package selected files with an explicitly chosen upload profile.

Watch browse and extract · Watch create an archive · Watch browse a shared archive

Archive guide · Written walkthroughs

Moving through years of uploads

Scroll, jump through dates, retain selections, and search a demonstration library containing 12,000 files. The seeded dates and contents are fixtures; the browser interactions and requests are real.

Watch the desktop library · Watch the mobile layout · Guide and transcripts

Inviting people to a closed instance

Create a link with a role assignment, join through it, and manage member invitations within the instance's limits.

Watch administrator invites · Watch joining an instance · Watch member invites

Invite guide · Written walkthroughs

The right documentation for your installation

Open the handbook from Settings or setup, choose a dated release, compare changes, or explicitly read the rolling preview.

Browse versions and changes · First-run setup guide

Working previews and recoverable storage cleanup

Library previews work for public, private, and protected images, including animated GIFs. Moderators can preview content using their own permitted browser session.

Account cleanup runs in the background after deletion commits. Inspect pending cleanup and follow the recovery steps; older objects with unknown storage history need an operator to verify their original location.

❤️ Thanks

Huge thanks to everyone testing rolling builds, reporting bugs, and sharing ideas. The requests and feedback have given me a lot to work with, and I've really enjoyed putting this update together. If anything's giving you trouble, lmk!

⬆️ Updating

Back up your database and uploads first, preserve your existing secrets, and stop old application replicas before upgrading. The Docker image runs migrations automatically. Everyone will need to sign in again. Existing accounts, files, links, and uploader credentials remain supported; former administrators receive Admin, and Everyone preserves existing personal capabilities.

• Custom dashboard clients must replace the old role field with roleIds for writes, roles for responses, and roleId for filtering. Named tokens keep their scopes and also follow their owner's current permissions.
• Authenticator 2FA and required-passkey sign-in stay off until you enable them. Invitations start administrator-only. Keep NEXTAUTH_SECRET unchanged; it protects newly enrolled authenticator secrets.
• Restart unfinished multipart uploads that began before the storage-provenance migration. Historical cleanup jobs with unknown destinations wait for operator verification.
• Audit history starts with this feature and has no automatic retention cutoff. Archive processing has fixed size and format limits; RAR, 7z, and encrypted archives are unsupported.
• Rollback requires the old image and its matching pre-upgrade database and file backup. Changing the image alone cannot undo the role migration.

Upgrade guide: 2.1 → 3.0 · Full changelog: v2.1.0 → v3.0.0

📦 Download & Deploy

AMD64 and ARM64 images:

# Docker Hub
docker pull docker.io/flintsh/flare:3.0.0

# GitHub Container Registry
docker pull ghcr.io/flintsh/flare:3.0.0