Enterprise file management without the enterprise price tag.

Multi-tenant file management and compliance platform built with Rust and React.
Self-host it. Own your data. Stop paying $25/user/month.

Quick Start • Features • Screenshots • Contributing • Hosted Version

Dashboard — HIPAA compliance monitoring, activity charts, file analytics	File Browser — Folders, file groups, quick access, department filtering
Company Settings — Compliance modes, storage quotas, retention policies	Security Alerts — Real-time monitoring for suspicious activity
User Management — Roles, departments, status tracking	Performance — System metrics and API monitoring

Enterprise file management has become absurdly expensive:

Storage costs based on ~500GB usage. Scales with actual usage, not user count.

Most small businesses need 80% of enterprise features at 10% of the cost. ClovaLink delivers exactly that.

Want the features without the infrastructure? ClovaLink.com offers a fully managed hosted version for enterprise teams (10+ users).

Real-time monitoring for unusual activity patterns:

Email notifications automatically sent for Critical and High severity alerts.

Run this single command to install ClovaLink:

curl -fsSL https://raw.githubusercontent.com/ClovaLink/ClovaLink/main/install.sh | bash

The installer will:

• Check if Docker is installed
• Download the configuration files
• Generate secure secrets automatically
• Start all services
• Show you the login URL

That's it! Follow the prompts and you'll be running in minutes.

curl -fsSL https://raw.githubusercontent.com/ClovaLink/ClovaLink/main/install.sh | bash -s -- --update

This will back up your config, pull the latest images, and restart services. Migrations run automatically.

docker --version
# Should show: Docker version 24.x or higher

# Create a folder for ClovaLink
mkdir clovalink
cd clovalink

# Download the configuration files
curl -LO https://raw.githubusercontent.com/ClovaLink/ClovaLink/main/infra/compose.yml
curl -LO https://raw.githubusercontent.com/ClovaLink/ClovaLink/main/infra/.env.example

# Create your config file from the example
mv .env.example .env

# Open it in a text editor
nano .env    # Linux/Mac
# Or: notepad .env    # Windows

docker compose up -d

# Check if everything is running
docker compose ps

# View logs (if something isn't working)
docker compose logs -f

# Stop ClovaLink
docker compose down

# Restart ClovaLink
docker compose restart

# Update to latest version
docker compose pull
docker compose up -d

sudo usermod -aG docker $USER

git clone https://github.com/ClovaLink/ClovaLink.git
cd ClovaLink/infra
cp .env.example .env
nano .env
docker compose up -d

git clone https://github.com/ClovaLink/ClovaLink.git
cd ClovaLink/infra
cp .env.example .env
docker compose -f compose.yml -f compose.build.yml up -d --build

# GitHub Container Registry (default)
image: ghcr.io/clovalink/clovalink-backend:latest

# Docker Hub (alternative)
image: clovalink/clovalink-backend:latest

Change these credentials immediately in production!

flowchart TB
    subgraph Clients[" "]
        direction LR
        Browser[Browser] ~~~ Mobile[Mobile] ~~~ API_Client[API Client]
    end

    subgraph Frontend[Frontend - Nginx]
        direction LR
        Static[React SPA] ~~~ Proxy[Reverse Proxy]
    end

    subgraph Backend[Backend - Rust/Axum]
        direction LR
        API[REST API] --> Auth[Auth] --> RateLimit[Rate Limiter]
    end

    subgraph Persistence[" "]
        direction LR
        subgraph Data[Data Layer]
            PG[(PostgreSQL)]
            Redis[(Redis)]
        end
        subgraph Storage[Storage Layer]
            S3[S3/Wasabi/B2]
            Local[Local FS]
        end
    end

    Clients --> Frontend
    Frontend --> Backend
    Backend --> Data
    Backend --> Storage

Extensions: UI extensions, file processors (webhooks), and scheduled jobs run sandboxed with permission grants.

Create backend/.env from the example:

cp backend/.env.example backend/.env

DATABASE_URL=postgres://user:pass@localhost:5432/clovalink
REDIS_URL=redis://localhost:6379
JWT_SECRET=generate-a-64-char-random-string-here

STORAGE_TYPE=local
UPLOAD_DIR=./uploads

STORAGE_TYPE=s3
S3_BUCKET=your-bucket-name
AWS_ACCESS_KEY_ID=your-key
AWS_SECRET_ACCESS_KEY=your-secret
AWS_REGION=us-east-1
USE_PRESIGNED_URLS=true

STORAGE_TYPE=s3
S3_BUCKET=your-bucket-name
AWS_ACCESS_KEY_ID=your-key
AWS_SECRET_ACCESS_KEY=your-secret
AWS_REGION=us-east-1
S3_ENDPOINT=https://s3.wasabisys.com
USE_PRESIGNED_URLS=true

STORAGE_TYPE=s3
S3_BUCKET=clovalink
AWS_ACCESS_KEY_ID=minioadmin
AWS_SECRET_ACCESS_KEY=minioadmin
AWS_REGION=us-east-1
S3_ENDPOINT=http://localhost:9000
S3_PATH_STYLE=true

For enterprise durability, ClovaLink supports asynchronous replication of uploaded files to a secondary S3 bucket. This provides disaster recovery and geographic redundancy.

Two Modes:

REPLICATION_ENABLED=true
REPLICATION_ENDPOINT=https://s3.us-west-2.amazonaws.com
REPLICATION_BUCKET=clovalink-backup
REPLICATION_REGION=us-west-2
REPLICATION_ACCESS_KEY=your-access-key
REPLICATION_SECRET_KEY=your-secret-key
REPLICATION_MODE=backup
REPLICATION_RETRY_SECONDS=60
REPLICATION_WORKERS=4

Replication is fully async and non-blocking — uploads complete immediately while replication jobs are queued in the background with automatic retries.

ClamAV integration scans all uploads for malware:

CLAMAV_ENABLED=true
CLAMAV_HOST=clamav
CLAMAV_PORT=3310

See Virus Scanning Documentation for quarantine, auto-suspend, and monitoring details.

SSO is configured per-tenant through the admin UI (Settings → SSO). Both OIDC and SAML 2.0 are supported. The following environment variables are only needed if you plan to use SSO:

# Required for SSO
SECRETS_ENCRYPTION_KEY=base64-encoded-32-byte-key   # For encrypting IdP client secrets
# OIDC callback and frontend URLs are derived from BASE_URL automatically.
# SAML ACS URL and SP Entity ID are derived from BASE_URL automatically.
# Make sure BASE_URL is set correctly (the installer does this for you).

Provider-specific settings (issuer URL, client ID/secret, IdP certificates, email domains) are configured in the admin UI, not in environment variables. SAML SP metadata is available at /api/auth/saml/metadata/:provider_id.

See Deployment Guide for detailed setup instructions.

clovalink/
├── backend/
│   ├── crates/
│   │   ├── api/            # HTTP handlers, routes, middleware
│   │   ├── auth/           # JWT, passwords, 2FA
│   │   ├── core/           # Models, DB, mailer, cache, security
│   │   ├── extensions/     # Extension runtime
│   │   └── storage/        # S3/local storage abstraction
│   └── migrations/         # SQL schema files
├── frontend/
│   └── src/
│       ├── components/     # Reusable UI components
│       ├── context/        # React contexts (Auth, Tenant, Theme)
│       └── pages/          # Route components
└── infra/
    ├── compose.yml         # Docker Compose config
    └── Dockerfile.*        # Container builds

RUST_LOG=warn
JWT_SECRET=<64-character-cryptographically-random-string>
DATABASE_URL=postgres://...
REDIS_URL=redis://...
STORAGE_TYPE=s3
USE_PRESIGNED_URLS=true
CORS_ALLOWED_ORIGINS=https://yourdomain.com

All require Authorization: Bearer <token> header.

See backend/README.md for complete API documentation.

Security is a core focus of ClovaLink. Key measures include:

• Tenant Isolation: Row-level tenant_id enforcement on every table
• JWT Hardening: Short expiry, issuer/audience validation, key rotation support
• Rate Limiting: Atomic Redis-based limiting on sensitive endpoints
• SQL Safety: Compile-time query validation with SQLx
• Content-Disposition: Filename sanitization prevents header injection
• Zip Slip Prevention: Path validation on archive extraction
• CORS Lockdown: Explicit origin allowlisting in production
• OIDC SSO: State/nonce CSRF protection, encrypted client secrets, lockout prevention
• SAML SSO: XML signature verification (pure Rust), assertion replay protection, time window validation, audience restriction
• Document Approval: Atomic approve/reject operations, tenant-isolated policies, role-based access control, audit logging

See Security Documentation for complete security documentation and hardening guide.

• Multi-tenant architecture
• HIPAA/SOX/GDPR compliance modes
• Role-based access control
• Extension system
• Security alerts dashboard
• Email notifications for alerts
• AI-powered document features (summarization, Q&A)
• File Groups (virtual collections)
• Company Folders (org-wide sharing)
• Office document preview (Excel, PowerPoint)
• OIDC Single Sign-On (Google, Microsoft, Okta)
• SAML 2.0 Single Sign-On (ADFS, Azure AD, Okta)
• IdP attribute/claim mapping (roles & departments)
• Document approval workflow (per-tenant, policy-based)
• Mobile apps (iOS/Android)
• WebDAV support
• Real-time collaboration
• Slack/Teams integration

# Check if PostgreSQL is running
docker compose ps postgres

# View logs
docker compose logs postgres

# Verify DATABASE_URL in .env matches compose.yml

client_max_body_size 100M;

# Check Redis is running
docker compose ps redis

# Test connection
docker compose exec redis redis-cli ping
# Should return: PONG

docker compose restart frontend

# Generate the new checksum
sha256sum backend/migrations/003_oidc_sso.sql

# Update it in the database (replace the hash with your output)
psql $DATABASE_URL -c "UPDATE _sqlx_migrations SET checksum = E'\\x<new_hash>' WHERE version = 3;"

psql $DATABASE_URL -c "DELETE FROM _sqlx_migrations WHERE version = 3;"
# Restart the backend — it will re-apply the migration
docker compose restart backend

Contributions are welcome! Here's how:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

# Backend (Rust)
cd backend
cargo run

# Frontend (React)
cd frontend
npm install
npm run dev

• Rust: cargo fmt and cargo clippy
• TypeScript: ESLint + Prettier (configured in project)

MIT License — use it however you want. See LICENSE for details.

Stop renting your file management. Own it.

Back to Top ↑