Browse, upload and download files from your machine

You can share a folder from one of your hosts and work with it from the Console: browse it, download from it, drag files into it, and rename, copy, move or delete what is in it. Every byte travels directly between your machine and your browser over an encrypted peer-to-peer connection. It never passes through DedNets servers.

That is not a policy promise: there is no relay path in the product. If your browser cannot reach the host directly, the transfer does not happen and the Console tells you so, rather than quietly routing your files through us.

What you need

• A host running dedmeshd v0.8.0 or newer. Fleets do not auto-update by default, so check dednetsctl host list and update the host if it is older.
• Access to that host’s config file. Sharing starts on the machine, not in the Console: the Console can never add a folder, and can never widen one.
• Chrome or Edge for the best download experience. Other browsers work, but see Downloads below.

1. Declare the folder on the host

Add a [files] section to the host’s dedmeshd.toml and restart it:

[files]
enabled = true
confinement = "auto"

[[files.folders]]
name = "photos"
path = "/srv/photos"
mode = "rw"        # "ro" (read only) or "rw" (read and write)

mode here is a ceiling. If it says ro, nothing in the Console can make that folder writable: not you, not an API token, not a support engineer. Setting rw does not share anything on its own either; it only raises what the Console is later allowed to grant.

The file server runs as a separate, confined child process. On Linux it is locked into the folders you declared using the kernel’s own path-pinning and sandboxing (openat2, Landlock, namespaces, and a seccomp filter that stops it opening a network socket at all), so even a total compromise of that process reaches nothing outside them. Symlinks pointing out of a folder are listed but never followed.

Two settings interact with Files and are worth knowing about:

• direct = "off" disables Files. Files only transfers over a direct connection, so a host on which you have turned the direct path off cannot serve files. You will be told immediately rather than after a timeout.

• stun narrows what the Console may point this host at. Since v0.8.0 you can pin the exact STUN servers this host will use:

  [files]
  stun = ["stun:stun.dednets.com:3478"]

  Leave it out and the built-in policy applies. Set it and it is the whole list. It is there so that a Console you no longer trust cannot aim your machine’s connection probes anywhere else.

2. Share it in the Console

Open Hosts -> your host. The Files card lists every folder the host declares. Turn one on, and pick a mode at or below the host’s ceiling.

If the card says the host does not support files, it is running an older build or has no [files] section. The card shows the exact config to paste.

3. Browse it

Open Files in the sidebar, pick the folder, and it connects. You will see “Connected directly” once the peer-to-peer connection is up, usually in under a second.

Select a file for a preview in the right-hand pane, or right-click anything for the full menu: Download, Preview, Rename, Copy to…, Move to…, Delete.

Downloads

Click Download and your browser asks where to save the file, then streams it straight to disk. A 10 GB file uses no more memory than a 10 KB one.

In a browser without the File System Access API (Firefox and Safari today), the download is buffered in memory first. The Console warns you before starting a large one, because a very large file can exhaust the tab.

Uploads

Drag files or folders onto the file list, or use the upload button. Uploads are streamed and resumable: if the connection blinks, the transfer picks up from where it got to rather than starting over.

Nothing is visible under its final name until it is complete and verified. A partial upload is a temporary file the host cleans up; it never appears as a half-written file someone else could open.

If the name is already taken, you get a dialog naming both files with their sizes, and three choices:

• Keep both saves yours under a free name such as report (2).tar.gz.
• Replace overwrites the existing file.
• Cancel skips this one file and leaves everything alone.

Answering costs nothing extra: the file is already on the host by the time the collision is discovered, so neither choice re-sends a single byte, even for a very large upload. If you close the dialog, the transfer fails and nothing on the host is touched.

Copy and move, including between hosts

Copy to… and Move to… open a destination picker listing every folder you have shared, on any host. Copying between two different hosts streams the file through your browser without ever writing it to this machine’s disk.

A move verifies the file landed correctly at the destination before it removes the source. If the verification fails, the source stays where it is and you are told.

(since v0.11.2) If the connection to either host drops part-way through a copy between hosts, the transfer now waits for it to come back and continues from where it stopped instead of failing - the same way an ordinary upload or download already did. Three things follow from that:

• If the file changes on the source host while the transfer is waiting, the copy is failed rather than finished with a mix of the old and new contents.
• Cancelling stops immediately and removes the partial file from the destination. Nothing is ever visible at the destination under its real name until the copy is complete, so a cancelled or failed copy never leaves a half-written file for someone else to find.
• If a host stays unreachable, the transfer gives up with an error rather than waiting forever.

Delete, and the Undo

Deleting asks for confirmation, names what will go, and shows the total size. Deleting a directory, or more than ten items, additionally asks you to type delete.

After you confirm, nothing happens for five seconds and an Undo button appears. Clicking it means the delete never reaches the host at all. There is deliberately no keyboard shortcut for delete.

Deleting a folder that still has things in it

(since v0.11.2) A folder that is not empty can be deleted, but you have to ask for it. The confirmation offers Delete everything inside these folders too, and it is never ticked for you. With it ticked the button says Delete everything, and you are asked to type delete again — ticking the box changes the question, so the confirmation starts over. Everything inside is removed from the host immediately and DedNets keeps no copy.

A very large folder is deleted in several passes, so one delete never ties the host up; the count updates as it goes, and a Stop button next to it ends the delete after the pass it is on. Stopping tells you how many items had already been removed — those do not come back.

If it stops on its own part-way — a file the host will not let go of, or a folder something is writing to — you are told how many items were removed, where it stopped and why, and the rest is still there. Running the delete again continues from that point rather than starting over.

If the host is older than v0.11.2 you are told to update it, and nothing is deleted. Older hosts can only remove a folder that is already empty.

Previews

Text, source code and SVG render as text in a fully sandboxed frame. Images, audio and video play inline. The file type comes from the file’s own bytes, not from its name, so a program renamed to photo.png will not be treated as an image.

PDFs download rather than preview. Rendering one needs browser capabilities the preview frame withholds on purpose, and we would rather download a file than weaken that.

Previews are size-capped per type. Over the cap you get the file’s details and a Download button instead. The cap bounds what the tab holds in memory, but the file is still transferred in full before a preview appears, so previewing a large video is not free.

If it says it cannot connect directly

You will see:

Cannot reach this folder directly. Files transfers only over a direct connection between this browser and the host, so file contents never pass through DedNets servers. This network appears to block that connection.

This is a real limitation, not a temporary glitch, and retrying on the same network will not usually help. It happens when:

• the network blocks UDP outbound (common on corporate and guest Wi-Fi),
• both your browser and the host are behind strict NAT that neither side can traverse, or
• the host has direct = "off" in its config, in which case it will say so immediately.

What actually works: try a different network (a phone hotspot is the usual quick test), or turn off a VPN on either end. If your host has a public IP or a port-forward, direct connections are essentially always available.

If an operation stops responding

(since v0.11.2) Every request your browser makes to a host has a time limit, so a listing or a transfer can no longer sit there forever if the host stops answering. You will see one of two messages:

Message	What it means
The host stopped answering this operation. Try it again.	The host is up and answering, but this one operation did not come back. Retry it; a transfer retries by itself.
The direct connection to the host stopped responding. Reconnecting…	The connection itself went quiet. Your browser reconnects on its own, and transfers resume from where they stopped.

The limit is generous on purpose - it is longer than the host’s own limit on the work it does per request - so a busy host or a large in-folder copy is never cut short; what it catches is a host that has genuinely gone quiet. Nothing here needs configuring, and nothing is lost: an upload resumes from the last byte the host acknowledged, and a download resumes from the last byte your browser wrote.

Other messages you might see, each with a different fix:

Message	Fix
This host is offline	Start the host; a file session needs it connected.
This folder is not shared	Turn it on under Hosts -> your host.
This host no longer declares this folder	Add it back to the host’s [files] config and restart it.
Permission denied	The folder is read-only on its host. Change mode in its config.
This host is busy	It is at its max_sessions limit. Try again shortly.
This session expired	Reload the page.
Not enough space	The host’s disk is full.
That name is taken	Choose Keep both or Replace in the dialog.

What DedNets can and cannot see

• We never learn your file paths. The Console stores the folder’s name and the host it lives on, never its location on disk.
• We never see file contents. They travel browser-to-host, encrypted, and never touch our servers.
• We do issue the credential that lets your browser open a session, so a compromised Console could mint one for itself. This is not end-to-end secrecy against us; it is privacy of your data in transit and at rest on our side, because there is nothing of yours on our side.

Turning it off

Three independent switches, any one of which stops everything:

1. In the Console: turn the folder off under Hosts -> your host. Live sessions are closed immediately.
2. On the host: remove the folder from [files], or set enabled = false, and restart. The Console cannot override this.
3. Platform-wide: an administrator can turn Files off for the whole installation.