{"id":22436957,"url":"https://github.com/c2FmZQ/photos","last_synced_at":"2025-08-01T15:31:51.726Z","repository":{"id":41264386,"uuid":"349855223","full_name":"c2FmZQ/c2FmZQ","owner":"c2FmZQ","description":"Securely encrypt, store, and share files, including but not limited to pictures and videos.","archived":false,"fork":false,"pushed_at":"2024-10-24T14:18:29.000Z","size":4855,"stargazers_count":40,"open_issues_count":3,"forks_count":5,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-10-25T17:48:21.978Z","etag":null,"topics":["client-side-encryption","cse","encryption","end-to-end-encryption","files","fuse","fuse-filesystem","passkeys","photos","privacy","progressive-web-app","pwa","security","self-hosted","sharing","storage","videos","webauthn","webpush","zero-trust"],"latest_commit_sha":null,"homepage":"https://c2FmZQ.org","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/c2FmZQ.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-03-20T23:14:38.000Z","updated_at":"2024-10-24T14:18:23.000Z","dependencies_parsed_at":"2023-11-24T18:25:29.335Z","dependency_job_id":"c8d1aaf4-e365-44a6-8217-d7ba047836be","html_url":"https://github.com/c2FmZQ/c2FmZQ","commit_stats":{"total_commits":465,"total_committers":3,"mean_commits":155.0,"dds":0.008602150537634357,"last_synced_commit":"70451b14234bef27c47de48b812d4308a08f68f3"},"previous_names":[],"tags_count":38,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c2FmZQ%2Fc2FmZQ","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c2FmZQ%2Fc2FmZQ/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c2FmZQ%2Fc2FmZQ/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/c2FmZQ%2Fc2FmZQ/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/c2FmZQ","download_url":"https://codeload.github.com/c2FmZQ/c2FmZQ/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":228389159,"owners_count":17912189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["client-side-encryption","cse","encryption","end-to-end-encryption","files","fuse","fuse-filesystem","passkeys","photos","privacy","progressive-web-app","pwa","security","self-hosted","sharing","storage","videos","webauthn","webpush","zero-trust"],"created_at":"2024-12-06T00:10:22.462Z","updated_at":"2025-08-01T15:31:46.126Z","avatar_url":"https://github.com/c2FmZQ.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"`echo -n safe | base64`\n\n# c2FmZQ\n\n* [Overview](#overview)\n* [Notes about security and privacy](#security)\n* [c2FmZQ Server](#c2FmZQ-server)\n  * [Connecting the Stingle Photos app to this server](#stingle)\n  * [Scale and performance](#scale)\n  * [How to run the server](#run-server)\n  * [DEMO / test drive](#demo)\n  * [Experimental features](#experimental)\n    * [Progressive Web App (PWA)](#webapp)\n    * [Multi-Factor Authentication](#mfa)\n    * [Decoy / duress passwords](#decoy)\n* [c2FmZQ Client](#c2FmZQ-client)\n  * [Mount as fuse filesystem](#fuse)\n  * [View content with Web browser](#webbrowser)\n  * [Connecting to stingle.org account](#connect-to-stingle)\n\n# \u003ca name=\"overview\"\u003e\u003c/a\u003eOverview\n\nc2FmZQ is an application that can securely encrypt, store, and share\nfiles, including but not limited to pictures and videos.\n\nThere is a command-line client application, a server application, and an\nexperimental Progressive Web App that can run in most modern browsers.\n\nThe server is the central repository where all the encrypted data can be stored.\nIt has no way to access the client's plaintext data.\n\nThe PWA and the command-line clients are used to import, export, organize, and share files.\n\nThey use an API that's compatible with the Stingle Photos app\n(https://github.com/stingle/stingle-photos-android) published by [stingle.org](https://stingle.org),\nwhich can also be used with c2FmZQ.\n\n_This project is **NOT** associated with stingle.org. This is not the code used\nby stingle.org. The code in this repo was developed by studying the client app's code and\nreverse engineering the API. Stingle eventually released their [server code](https://github.com/stingle/stingle-api)\nin April 2023._\n\n---\n\n# \u003ca name=\"security\"\u003e\u003c/a\u003eNotes about security and privacy\n\n**This software has not been reviewed for security.** Review, comments, and\ncontributions are welcome.\n\nThe server has no way to decrypt the files that are uploaded by the clients.\nIt only knows how many files you have, how big they are, and who they're\nshared with.\n\nThe clients have to trust the server when sharing albums. The server provides\nthe contact search feature (/v2/sync/getContact), which returns a User ID and \na public key for the contact. Then, the album is shared with that User ID and\npublic key (via /v2/sync/share).\n\nA malicious server _could_ replace the contact's User ID and public key with\nsomeone else's, and make the user think they're sharing with their friend while\nactually sharing with an attacker. The command-line client application lets the\nuser verify the contact's public key before sharing.\n\nWhen viewing a shared album, the clients have to trust that the shared content is\n\"safe\". Since the server can't decrypt the content, it has no way to sanitize it\neither. A malicious user _could_ share content that aims to exploit some unpatched\nvulnerability in the client code.\n\nOnce an album is shared, there is really no way to completely _unshare_ it. The\npermissions on the album can be changed, but it is impossible to control what\nhappens to the files that were previously shared. They could have been downloaded,\nexported, published to the New York Times, etc.\n\nSince c2FmZQ is compatible with the Stingle Photos API, it uses the\n[same cryptographic algorithms](https://stingle.org/security/) for authentication,\nclient-server communication, and file encryption, namely:\n\n* [Argon2](https://en.wikipedia.org/wiki/Argon2) for password key derivation on the\nclient side; [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) on the server side,\n* [NaCl](https://en.wikipedia.org/wiki/NaCl_(software)) (Curve25519/XSalsa20/Poly1305)\nfor client-server authentication and encryption,\n* [Chacha20+Poly1305](https://ieeexplore.ieee.org/document/7927078) and\n[Blake2b](https://en.wikipedia.org/wiki/BLAKE_(hash_function)#BLAKE2) for file\nencryption and key derivation.\n\nAdditionally, it uses [AES256-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode) and\n[AES256-CBC](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC) with\n[HMAC-SHA256](https://en.wikipedia.org/wiki/HMAC) to encrypt its own metadata, and\n[PBKDF2](https://en.wikipedia.org/wiki/PBKDF2) for the passphrase key derivation.\n\n---\n\n# \u003ca name=\"c2FmZQ-server\"\u003e\u003c/a\u003ec2FmZQ Server\n\nc2FmZQ-server is an API server with a relatively small footprint. It can run\njust about anywhere, as long as it has access to a lot of storage space, and a modern\nCPU. It must be reachable by the clients via HTTPS.\n\nThe server needs at least two pieces of information: the name of the directory where\nits data will be stored, and a passphrase to protect the data. The passphrase\ncan be read from a file or retrieved with an external command, otherwise the server\nwill prompt for it when it starts.\n\nFor TLS, the server also needs the TLS key, and certificates. They can be read from\nfiles, or directly from letsencrypt.org.\n\n---\n\n## \u003ca name=\"stingle\"\u003e\u003c/a\u003eConnecting the Stingle Photos app to this server\n\nStarting with v2.10.2, the [Stingle Photos](https://play.google.com/store/apps/details?id=org.stingle.photos) app can connect to this server without any code changes.\n\nOn the _Welcome Screen_, click the setting button at the top right corner and then enter the URL of your server.\n\n---\n\n## \u003ca name=\"scale\"\u003e\u003c/a\u003eScale and performance\n\nThe server was designed for personal use, not for large scale deployment or speed.\nOn a modern CPU and SSD, it scales to 10+ concurrent users with tens of thousands of\nfiles per album, while maintaining a response time well under a second (excluding\nnetwork I/O).\n\nOn a small device, e.g. a raspberry pi, it scales to a handful of concurrent\nusers with a few thousand files per album, and still maintain an acceptable response time.\n\n---\n\n## \u003ca name=\"run-server\"\u003e\u003c/a\u003eHow to run the server\n\nThe server is self-contained. It doesn't depend on any external resources. It\nstores all its data on a local filesystem.\n\nIt can run on AWS ([Howto](HOWTO-AWS.md)) or any other cloud providers. It can run\nin a docker container. It can run on Linux, MacOS, Windows. It can run on a\nraspberry pi, or on a NAS. It can run pretty much on anything that has at least\n1 GB of RAM.\n\n--- \n\n### Pull the docker image\n\nYou can find the c2fmzq-server image on [hub.docker.com](https://hub.docker.com/r/c2fmzq/c2fmzq-server/tags).\n\n```\ndocker pull c2fmzq/c2fmzq-server:latest\n```\n\nThen run the server with something like:\n```\ndocker run \\\n    --name=c2fmzq-server \\\n    -d \\\n    -u 1000:1000 \\\n    -p 8080:80 \\\n    -p 8443:443 \\\n    -e C2FMZQ_DOMAIN=\"${DOMAIN}\" \\\n    -e C2FMZQ_PASSPHRASE_FILE=\"\" \\\n    -e C2FMZQ_PASSPHRASE=\"\u003cpassphrase\u003e\" \\\n    -v ${DATABASEDIR}:/data \\\n    c2fmzq/c2fmzq-server:latest\n```\n\nThe TLS credentials are fetched from [letsencrypt.org](https://letsencrypt.org) automatically.\n\n`${DATABASEDIR}` is where all the encrypted data will be stored. The database passphrase can\nstored in a file, or passed in an environment variable. `${DOMAIN}` is the domain or hostname to\nuse.\n\nThe domain or hostname must resolve to the IP address where the server will be running,\nand firewall and/or port forwarding rules must be in place to allow TCP connections to\nports 80 and 443 inside the container. The clients will connect to `https://${DOMAIN}/`.\n\n---\n\n### Or, build your own docker image\n\n```bash\ndocker build -t c2fmzq/c2fmzq-server .\n```\n\n---\n\n### Or, build it, and run it locally\n\n```bash\ncd c2FmZQ/c2FmZQ-server\ngo build\n./c2FmZQ-server help\n```\n```txt\nNAME:\n   c2FmZQ-server - Run the c2FmZQ server\n\nUSAGE:\n   c2FmZQ-server [global options]  \n\nGLOBAL OPTIONS:\n   --database DIR, --db DIR         Use the database in DIR (default: \"$HOME/c2FmZQ-server/data\") [$C2FMZQ_DATABASE]\n   --address value, --addr value    The local address to use. (default: \"127.0.0.1:8080\") [$C2FMZQ_ADDRESS]\n   --path-prefix value              The API endpoints are \u003cpath-prefix\u003e/v2/... [$C2FMZQ_PATH_PREFIX]\n   --base-url value                 The base URL of the generated download links. If empty, the links will generated using the Host headers of the incoming requests, i.e. https://HOST/. [$C2FMZQ_BASE_URL]\n   --redirect-404 value             Requests to unknown endpoints are redirected to this URL. [$C2FMZQ_REDIRECT_404]\n   --tlscert FILE                   The name of the FILE containing the TLS cert to use. [$C2FMZQ_TLSCERT]\n   --tlskey FILE                    The name of the FILE containing the TLS private key to use. [$C2FMZQ_TLSKEY]\n   --autocert-domain domain         Use autocert (letsencrypt.org) to get TLS credentials for this domain. The special value 'any' means accept any domain. The credentials are saved in the database. [$C2FMZQ_DOMAIN]\n   --autocert-address value         The autocert http server will listen on this address. It must be reachable externally on port 80. (default: \":http\") [$C2FMZQ_AUTOCERT_ADDRESS]\n   --allow-new-accounts             Allow new account registrations. (default: true) [$C2FMZQ_ALLOW_NEW_ACCOUNTS]\n   --auto-approve-new-accounts      Newly created accounts are auto-approved. (default: true) [$C2FMZQ_AUTO_APPROVE_NEW_ACCOUNTS]\n   --verbose value, -v value        The level of logging verbosity: 1:Error 2:Info 3:Debug (default: 2 (info)) [$C2FMZQ_VERBOSE]\n   --passphrase-command COMMAND     Read the database passphrase from the standard output of COMMAND. [$C2FMZQ_PASSPHRASE_CMD]\n   --passphrase-file FILE           Read the database passphrase from FILE. [$C2FMZQ_PASSPHRASE_FILE]\n   --passphrase value               Use value as database passphrase. [$C2FMZQ_PASSPHRASE]\n   --htdigest-file FILE             The name of the htdigest FILE to use for basic auth for some endpoints, e.g. /metrics [$C2FMZQ_HTDIGEST_FILE]\n   --max-concurrent-requests value  The maximum number of concurrent requests. (default: 10) [$C2FMZQ_MAX_CONCURRENT_REQUESTS]\n   --enable-webapp                  Enable Progressive Web App. (default: true) [$C2FMZQ_ENABLE_WEBAPP]\n   --licenses                       Show the software licenses. (default: false)\n```\n\n---\n\n### Or, build a binary for another platform, e.g. windows, raspberry pi, or a NAS\n\n```bash\ncd c2FmZQ/c2FmZQ-server\nGOOS=windows GOARCH=amd64 go build -o c2FmZQ-server.exe\nGOOS=linux GOARCH=arm go build -o c2FmZQ-server-arm\nGOOS=darwin GOARCH=arm64 go build -o c2FmZQ-server-darwin\n```\n\n---\n\n## \u003ca name=\"demo\"\u003e\u003c/a\u003eDEMO / test drive\n\nFor DEMO or testing purpose, the server can be launched on a github codespace.\n\nCreate a [codespace](https://github.com/codespaces) for the `c2FmZQ/c2FmZQ` repository, open the terminal, and run:\n```\ncd c2FmZQ\ngo run ./c2FmZQ-server --passphrase=test\n```\nSelect `Open in Browser` to open the PWA, or connect the android app to the same URL.\n\nPlease note that this is **NOT** a secure configuration. Do not use this to store anything you care about.\n\n---\n\n## \u003ca name=\"experimental\"\u003e\u003c/a\u003eExperimental features\n\nThe following features are experimental and could change or disappear in the future.\n\n### \u003ca name=\"webapp\"\u003e\u003c/a\u003eProgressive Web App\n\nThe PWA is a full-featured client app for c2FmZQ implemented entirely in HTML and javascript.\n\nAll the cryptographic operations are performed in the browser using \n[Sodium-Plus](https://github.com/paragonie/sodium-plus), and the app\nimplements the same protocol as the c2FmZQ client and the Stingle Photos app.\n\nTo access the PWA:\n\n* Open your server URL in a browser: `https://${DOMAIN}/${path-prefix}/`. This requires `--enable-webapp` to be set on the server. Or,\n* Open https://c2fmzq.org/pwa/ and enter your server URL in the `Server` field. This works with or without `--enable-webapp`, Or,\n* Clone https://github.com/c2FmZQ/c2FmZQ.github.io, and publish it on your own web site.\n\nCurrently implemented:\n\n* All account management features (account creation, recovery, etc).\n* All album management features (creating, sharing, moving files, etc).\n* Browsing albums with photos and videos with local encrypted caching for speed or offline conditions.\n* Uploading files with streaming encryption.\n* Photo editing, using a local [Filerobot Image Editor](https://scaleflex.github.io/filerobot-image-editor/)\n* Optional push notification when new content or new members are added to shared albums.\n\nPush notification is disabled by default on the server. To enable it, use the `inspect edit ps`\ncommand, and set the top-level `enable` option to `true` and set `jwtSubject` to a\nvalid `mailto:` or `https://` URL \\([rfc8292](https://www.rfc-editor.org/rfc/rfc8292#section-2.1)).\nSome push services require a valid email address or web site address.\n\nEnabling push notification for the Microsoft Edge browser on Windows requires [extra effort](https://learn.microsoft.com/en-us/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview).\n```\ngo run ./c2FmZQ-server/inspect edit ps\n```\nor,\n```\nsudo docker exec -it c2fmzq-server inspect edit ps\n```\n\n### \u003ca name=\"mfa\"\u003e\u003c/a\u003eMulti-Factor Authentication\n\n[WebAuthn](https://webauthn.guide/) and [One-time passwords](https://en.wikipedia.org/wiki/Time-based_One-Time_Password) can\nbe used as an extra layer of protection for sensitive operations, e.g. login, password changes, account recovery, etc.\nA strong password is still required to protect the user's main encryption key.\n\nExternal security keys (e.g. yubikeys), [passkeys](https://developers.google.com/identity/passkeys), and\n[OTP](https://en.wikipedia.org/wiki/Time-based_one-time_password) keys can be added from the `Profile` window\non the progressive web app.\n\nWhen push notifications are enabled, the progressive web app can also be used to authenticate other clients that\ndon't have native support for MFA, e.g. the android app. In that case, a notification will appear in the\nprogressive web app to ask the user to approve or deny the operation.\n\nTo use OTP, the user needs an authenticator app like [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2)\nor [Authy](https://play.google.com/store/apps/details?id=com.authy.authy).\n\n---\n\n### \u003ca name=\"decoy\"\u003e\u003c/a\u003eDecoy / duress passwords\n\nDecoy passwords can be associated with any normal account. When a\ndecoy password is used to login, the login is successful, but the user\nis actually logged in with a different account, not their normal account.\n\nNote that logging in with decoy passwords is not as safe as normal accounts\nbecause the passwords have to be known by the server. So, someone with access to\nthe server metadata could access the files in any decoy account.\n\nTo enable, use the `inspect decoy` command.\n\n```\ndocker exec -it c2fmzq-server inspect decoy\n```\n\n---\n\n# \u003ca name=\"c2FmZQ-client\"\u003e\u003c/a\u003ec2FmZQ Client\n\nThe c2FmZQ client can be used by itself, or with a remote (\"cloud\") server very\nsimilarly.\n\nSharing only works when content is synced with a remote server.\n\nTo connect to a remote server, the user will need to provide the URL of the\nserver when _create-account_, _login_, or _recover-account_ is used.\n\nTo run it:\n\n```bash\ncd c2FmZQ/c2FmZQ-client\ngo build\n./c2FmZQ-client\n```\n```txt\nNAME:\n   c2FmZQ - Keep your files away from prying eyes.\n\nUSAGE:\n   c2FmZQ-client [global options] command [command options] [arguments...]\n\nCOMMANDS:\n   Account:\n     backup-phrase    Show the backup phrase for the current account. The backup phrase must be kept secret.\n     change-password  Change the user's password.\n     create-account   Create an account.\n     delete-account   Delete the account and wipe all data.\n     login            Login to an account.\n     logout           Logout.\n     recover-account  Recover an account with backup phrase.\n     set-key-backup   Enable or disable secret key backup.\n     status           Show the client's status.\n     wipe-account     Wipe all local files associated with the current account.\n   Albums:\n     create-album, mkdir  Create new directory (album).\n     delete-album, rmdir  Remove a directory (album).\n     rename               Rename a directory (album).\n   Files:\n     cat, show           Decrypt files and send their content to standard output.\n     copy, cp            Copy files to a different directory.\n     delete, rm, remove  Delete files (move them to trash, or delete them from trash).\n     list, ls            List files and directories.\n     move, mv            Move files to a different directory, or rename a directory.\n   Import/Export:\n     export  Decrypt and export files.\n     import  Encrypt and import files.\n   Misc:\n     licenses  Show the software licenses.\n   Mode:\n     mount             Mount as a fuse filesystem.\n     shell             Run in shell mode.\n     webserver         Run web server to access the files.\n     webserver-config  Update the web server configuration.\n   Share:\n     change-permissions, chmod  Change the permissions on a shared directory (album).\n     contacts                   List contacts.\n     leave                      Remove a directory (album) that is shared with us.\n     remove-member              Remove members from a directory (album).\n     share                      Share a directory (album) with other people.\n     unshare                    Stop sharing a directory (album).\n   Sync:\n     download, pull   Download a local copy of encrypted files.\n     free             Remove the local copy of encrypted files that are backed up.\n     sync             Upload changes to remote server.\n     updates, update  Pull metadata updates from remote server.\n\nGLOBAL OPTIONS:\n   --data-dir DIR, -d DIR        Save the data in DIR (default: \"$HOME/.config/.c2FmZQ\") [$C2FMZQ_DATADIR]\n   --verbose value, -v value     The level of logging verbosity: 1:Error 2:Info 3:Debug (default: 2 (info))\n   --passphrase-command COMMAND  Read the database passphrase from the standard output of COMMAND. [$C2FMZQ_PASSPHRASE_CMD]\n   --passphrase-file FILE        Read the database passphrase from FILE. [$C2FMZQ_PASSPHRASE_FILE]\n   --passphrase value            Use value as database passphrase. [$C2FMZQ_PASSPHRASE]\n   --server value                The API server base URL. [$C2FMZQ_API_SERVER]\n   --auto-update                 Automatically fetch metadata updates from the remote server before each command. (default: true)\n```\n\n---\n\n## \u003ca name=\"fuse\"\u003e\u003c/a\u003eMount as fuse filesystem\n\nThe c2FmZQ client can mount itself as a fuse filesystem. It supports read and\nwrite operations with some caveats.\n\n* Files can only be opened for writing when they are created, and all writes must\n  append. The file content is encrypted as it is written.\n* Once a new file is closed, it is read-only (regardless of file permissions).\n  The only way to modify a file after that is to delete it or replace it. Renames\n  are OK.\n* While the fuse filesystem is mounted, data is automatically synchronized with the\n  cloud/remote server every minute. Remote content is streamed for reading if a local\n  copy doesn't exist.\n\n```bash\nmkdir -m 0700 /dev/shm/$USER\n# Create a passphrase with with favorite editor.\n echo -n \"\u003cINSERT DATABASE PASSPHRASE HERE\u003e\" \u003e /dev/shm/$USER/.c2fmzq-passphrase\nexport C2FMZQ_PASSPHRASE_FILE=/dev/shm/$USER/.c2fmzq-passphrase\n```\n```bash\nmkdir $HOME/mnt\n./c2FmZQ-client mount $HOME/mnt\n```\n```txt\nI0604 144921.460 fuse/fuse.go:43] Mounted $HOME/mnt\n```\n\nOpen a different terminal. You can now access all your files. They will be decrypted on demand as they are read.\n```bash\nls -a $HOME/mnt\n```\n```txt\ngallery  .trash\n```\nBulk copy in and out of the fuse filesystem should work as expected with:\n\n* cp, cp -r, mv\n* tar\n* rsync, with --no-times\n\nWhen you're done, hit `CTRL-C` where the `mount` command is running to close and unmount the fuse filesystem.\n\n---\n\n## \u003ca name=\"webbrowser\"\u003e\u003c/a\u003eView content with a Web Browser\n\nThe c2FmZQ client can export your files via HTTP so that they can be accessed with a Web Browser\n\n```bash\n./c2FmZQ-client webserver\n\n```\n\nThe web server can be configured with `webserver-config`\n\n```bash\n./c2FmZQ-client webserver-config -h\n```\n\n```text\nNAME:\n   c2FmZQ-client webserver-config - Update the web server configuration.\n\nUSAGE:\n   c2FmZQ-client webserver-config [command options]  \n\nCATEGORY:\n   Mode\n\nOPTIONS:\n   --address value           The TCP address to bind, e.g. :8080\n   --password value          The password to access the files\n   --export-path value       The file path to export\n   --url-prefix value        The URL prefix to use for each endpoint\n   --allow-caching           Allow http caching (default: true)\n   --clear                   Reset the web server configuration to default values (default: false)\n   --autocert-domain value   Enable autocert with this domain\n   --autocert-address value  Use this network address for autocert. It must be externally reachable on port 80\n   --help, -h                show help (default: false)\n```\n\nFor example, to export album `Foo` on port `8080` with password `foobar`, use:\n\n```bash\n./c2FmZQ-client webserver-config --export-path=Foo --address=:8080 --password=foobar\n./c2FmZQ-client webserver\n```\n\n---\n\n## \u003ca name=\"connect-to-stingle\"\u003e\u003c/a\u003eConnecting to stingle.org account\n\nTo connect to your stingle.org account, `--server=https://api.stingle.org/` with _login_ or _recover-account_.\n\n```bash\nmkdir -m 0700 /dev/shm/$USER\n# Create a passphrase with with favorite editor.\n echo -n \"\u003cINSERT DATABASE PASSPHRASE HERE\u003e\" \u003e /dev/shm/$USER/.c2fmzq-passphrase\nexport C2FMZQ_PASSPHRASE_FILE=/dev/shm/$USER/.c2fmzq-passphrase\n```\n```bash\n./c2FmZQ-client --server=https://api.stingle.org/ login \u003cemail\u003e\n```\n```txt\nEnter password: \nLogged in successfully.\n```\n```bash\n./c2FmZQ-client ls -a\n```\n```txt\n.trash/\ngallery/\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc2FmZQ%2Fphotos","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fc2FmZQ%2Fphotos","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fc2FmZQ%2Fphotos/lists"}