Drop WeTransfer for Erugo

WeTransfer was the lazy answer for years. Upload, copy the link, move on. The problem is what sits in between. The file, the filename, the recipient email, my IP, all of it on someone else’s machine. None of that has to be.

I run Erugo instead.

What I needed

• OIDC so it plugs into my SSO
• A working invitation system for teammates
• Email pipeline (share notifications, password reset)
• Folder uploads
• Per-share expiry and download caps
• One container behind my existing reverse proxy

Why Erugo

Same shape as WeTransfer: paste a file, get a link, set an expiry. On top of that: OIDC, real invitations, folder uploads, and reverse shares for when someone needs to send me a file. The branding panel takes a logo and one color, and the install stops looking like a default in about five minutes.

Setup

Always check the releases page for the current tag before copying any of this. v0.2.15 is the latest at time of writing. The image is multi-arch and Alpine-based, so arm64 pulls native on a Pi or on Apple silicon, no qemu.

Minimal compose

The smallest thing that works. Drop it in a folder, docker compose up -d, browse to http://localhost:8080.

1
services:
2
  app:
3
    image: wardy784/erugo:v0.2.15
4
    container_name: erugo
5
    restart: unless-stopped
6
    ports:
7
      - '8080:80'
8
    volumes:
9
      - './storage:/var/www/html/storage'

What I actually run

Hardened, no published ports. The container sits on a Docker network shared with Pangolin’s Traefik, which reaches it on port 80 directly.

1
networks:
2
  pangolin:
3
    external: true
4
services:
5
  app:
6
    image: wardy784/erugo:v0.2.15 # pin a tag, never ':latest'
7
    container_name: erugo
8
    restart: unless-stopped
9
    init: true
10
    security_opt:
11
      - no-new-privileges:true
12
    pids_limit: 200
13
    mem_limit: 512m
14
    volumes:
15
      - './storage:/var/www/html/storage'
16
    expose:
17
      - 80
18
    networks:
19
      - pangolin
20
    healthcheck:
21
      test: ['CMD', 'curl', '-fsS', 'http://localhost/']
22
      interval: 30s
23
      timeout: 5s
24
      retries: 3
25
      start_period: 60s
26
    logging:
27
      driver: json-file
28
      options:
29
        max-size: '10m'
30
        max-file: '3'

init: true runs tini above supervisord, which makes the container shut down cleanly on SIGTERM. pids_limit and mem_limit keep a misbehaving PHP-FPM worker from taking the host down with it, and the logging block stops Docker from filling the disk one log line at a time. The healthcheck hits the home page; once Laravel and the DB are reachable, it returns 200.

What is worse

The stack is PHP, Laravel and Vue. It works, but it eats more RAM than a single-binary alternative would. No AV scan in the box either, so if you accept uploads from people you do not fully trust, bolt one on.

When not to pick this

• One-person setup with no SSO or invitations. A caddy file_server with basic auth or Picoshare gives you the same drop story for less.
• A single-board ARM with under 1 GB of RAM. PHP plus Laravel plus Vue idles around 200 MB. Pick something lighter and you keep room to breathe.
• Hard compliance requirement for server-side virus scanning. You can wire ClamAV next door, but it is not first-class here. A tool that ships scanning in the box fits the audit trail better.

Verdict

Several months in. The container restarts on its own when I bump the image, my colleagues open shares without asking what tool that is, and I have stopped thinking about retention windows. The first time a 5 GB client archive expired exactly when I had told it to, I felt the small relief that justifies the whole self-hosting habit. Keep.

Alternatives worth a look

The space has more than one good answer. If Erugo does not fit, these are the ones I would investigate next:

• Picoshare: Go single binary with SQLite, almost nothing to configure. The minimal-fuss option when you only need a drop link for yourself.
• Plik: Go server with a CLI and a web UI, multi-user out of the box, well-maintained.
• PsiTransfer: Node.js, simple to host, clean enough UI for casual sharing.
• Palmr: Node.js Fastify with a NextJS UI, ships OIDC, 2FA, password protection and custom links. Closest profile to Erugo in feature scope.
• Papra: More an archiving platform than a drop-in. Full-text search, email-to-import, organizations. Pick it if you want a personal document base and not just a share link generator.