floe.one: the web app, the signaling server, and an optional TURN relay. The standard setup is Docker Compose, which pulls two published images and starts the stack with one command. Unraid templates and a plain Node.js run are covered too.
What you are hosting
The signaling server introduces two devices to each other and then steps aside. File data never passes through it. Technically, it passes the WebRTC connection details between the two peers (offer, answer, and ICE candidates), and once a relay is set up it also issues relay credentials that last 24 hours. Transfers go peer-to-peer over encrypted WebRTC data channels. A relay is optional, and it carries the (still encrypted) traffic only when a firewall or NAT rules out a direct connection, or when a transfer is set to use the relay.Components
Those are the ports inside the containers. In production you normally put both
behind a single domain, so your users never see either one. See
Run behind one domain.
By default both images follow the newest release, and a running instance moves only when you pull.
That is not what floe.one runs: floe.one serves the web app from the newest code, which is what the web-app pages of these docs describe. Until the next
release, your instance can word some things differently, and
What an older web app shows lists each place.
What the web app on your domain serves
The client image serves the same site as floe.one, under your address:- The transfer page, and the page a request link opens, under
/r/. - floe.one’s other pages, unchanged:
/download,/how-it-works,/privacy, and/terms. The privacy policy and the terms describe floe.one and the servers its maintainers run, not your instance, and no setting replaces them. - The CLI install scripts, at
/install.shand/install.ps1. /docs, which sends visitors on to the same page of floe.one’s documentation instead of serving the documentation itself.
frame-ancestors 'none'
policy and X-Frame-Options: DENY. A dashboard that embeds apps in a frame shows a blank frame
for Floe, so open it in its own tab. The headers are fixed when the image is built, and no setting
changes them.
Who can connect
One instance serves every Floe client. They share one wire protocol, so any two of them can transfer with each other on your server.
Both peers must be on the same server. Servers do not talk to each other.
The CLI and Floe Desktop need no setting on the server:
CLIENT_URL governs browsers only. A
reverse proxy in front of the server has to pass the Host header through for them, as
Origins the server accepts explains.
Off until you turn it on
Two features need setup before a new instance has them. A new instance has no TURN relay. Two devices that cannot reach each other directly do not connect. A transfer that insists on the relay stops with a message before it starts: Hide my IP address in Floe Desktop, Hide my IP on a request link’s page, or--relay-only on the CLI. See
TURN relay.
Request links are off. Until a policy file turns them on,
Make link in Floe Desktop answers “Request links are off on this server”. See
Turn on request links.
Run one instance, not several
The signaling server keeps rooms, room codes, open request links, and its rate limiters in the memory of a single process. One instance goes a long way. File data never passes through it, so it is brokering a handshake and then getting out of the way. If you need redundancy, use a failover pair rather than a load-balanced set, and accept that the switch loses every room and room code the old instance held, as a restart does.Contents
Docker quickstart
Get the stack running with Docker Compose in minutes.
Without Docker
Run the client and signaling server straight from Node.
Unraid
Install the client and signaling server on Unraid from Floe’s two container templates.
Container images
The prebuilt images on ghcr.io: tags, pinning a version or digest, and supported architectures.
Configuration
Environment variable reference for all settings.
How the client finds the server
Runtime
SOCKET_URL resolution, and the site URL that is still baked in at build time.Reverse proxy
Serve the client and signaling server from one domain, with Caddy and nginx examples.
TURN relay
Use Cloudflare’s managed TURN or add coturn to support peers behind strict NAT or CGNAT.
Turn on request links
Let Floe Desktop users on your server make request links, with a policy file you can switch without a restart.
Production deployment
HTTPS, custom domains, and the two-subdomain layout.
Operations
Day-to-day commands, updates, and health checks.