No Description

ghorsington 418e2ce81c Fix wrong domain on cookie set 1 year ago
.github 94bc88191e Update issue templates 2 years ago
controllers 418e2ce81c Fix wrong domain on cookie set 1 year ago
database 19e965a77a SEMICOLONS, ermahgerd (#93) 3 years ago
pages e7f2712535 Remove unused page 2 years ago
public b93d13f125 Add text to lightbult 1 year ago
routes 4bb8d157d6 Add darkmode switcher 1 year ago
views b93d13f125 Add text to lightbult 1 year ago
.gitignore 38d77fdfbb Fix 3 years ago
Dockerfile 8a75ab91a6 update deps and add dockerfile 3 years ago
LICENSE 44ca2dd53d De loli-safe (#77) 3 years ago 28bca3b195 Update 2 years ago
config.sample.js 6e73b23b2b Add new config options 2 years ago
lolisafe.js 4bb8d157d6 Add darkmode switcher 1 year ago
nginx-ssl.sample.conf 18b5d8eed9 Fixes typo of charset_Type 3 years ago
nginx.sample.conf 18b5d8eed9 Fixes typo of charset_Type 3 years ago
package.json 4bb8d157d6 Add darkmode switcher 1 year ago
real-ip-from-cf 6f7ec5d282 Updated IP's 3 years ago
yarn.lock 8a75ab91a6 update deps and add dockerfile 3 years ago

lolisafe GitHub license Chat / Support Support me Support me

lolisafe, a small safe worth protecting.

What's new in v3.0.0

  • Backend rewrite to make it faster, better and easier to extend
  • Album downloads (Thanks to PascalTemel)
  • See releases for changelog

If you're upgrading from a version prior to v3.0.0 make sure to run node database/migration.js ONCE to create the missing columns on the database.


  1. Ensure you have at least version 7.6.0 of node installed
  2. Clone the repo
  3. Rename config.sample.js to config.js
  4. Modify port, domain and privacy options if desired
  5. run npm install to install all dependencies
  6. run pm2 start lolisafe.js or node lolisafe.js to start the service

Getting started

This service supports running both as public and private. The only difference is that one needs a token to upload and the other one doesn't. If you want it to be public so anyone can upload files either from the website or API, just set the option private: false in the config.js file. In case you want to run it privately, you should set private: true.

Upon running the service for the first time, it's gonna create a user account with the username root and password root. This is your admin account and you should change the password immediately. This account will let you manage all uploaded files and remove any if necessary.

The option serveFilesWithNode in the config.js dictates if you want lolisafe to serve the files or nginx/apache once they are uploaded. The main difference between the two is the ease of use and the chance of analytics in the future. If you set it to true, the uploaded files will be located after the host like:

If you set it to false, you need to set nginx to directly serve whatever folder it is you are serving your downloads in. This also gives you the ability to serve them, for example, like this:

Both cases require you to type the domain where the files will be served on the domain key below. Which one you use is ultimately up to you. Either way, I've provided a sample config files for nginx that you can use to set it up quickly and painlessly!

If you set enableUserAccounts: true, people will be able to create accounts on the service to keep track of their uploaded files and create albums to upload stuff to, pretty much like imgur does, but only through the API. Every user account has a token that the user can use to upload stuff through the API. You can find this token on the section called Change your token on the administration dashboard, and if it gets leaked or compromised you can renew it by clicking the button titled Request new token.

Cloudflare Support

If you are running lolisafe behind Cloudflare there is support to make the NGINX logs have the user's IP instead of Cloudflare's IP. You will need to compile NGINX from source with --with-http_realip_module as well as uncomment the following line in the NGINX config: include /path/to/lolisafe/real-ip-from-cf;

Using lolisafe

Once the service starts you can start hitting the upload endpoint at /api/upload with any file. If you're using the frontend to do so then you are pretty much set, but if you're using the API to upload make sure the form name is set to files[] and the form type to multipart/form-data. If the service is running in private mode, don't forget to send a header of type token: YOUR-CLIENT-TOKEN to validate the request.

A sample of the JSON returned from the endpoint can be seen below:

	"name": "EW7C.png",
	"size": "71400",
	"url": ""

To make it easier and better than any other service, you can download our Chrome extension. That will let you configure your hostname and tokens, so that you can simply right click -> loli-safe -> send to safe on any image/audio/video file on the web.

Because of how nodejs apps work, if you want it attached to a domain name you will need to make a reverse proxy for it. Here is a tutorial on how to do this with nginx. Keep in mind that this is only a requirement if you want to access your lolisafe service by using a domain name, otherwise you can use the service just fine by accessing it from your server's IP.

Sites using lolisafe

Refer to the wiki


lolisafe © Pitu, Released under the MIT License.
Authored and maintained by Pitu. · GitHub @Pitu