S3Drive

https://docs.s3drive.app/
Admin
S3Drive is an encrypted personal cloud storage client compatible with Amazon S3, WebDAV, and over 70...
Tokens:14,843
Snippets:190
Trust Score:6.9
Update:1 month ago
Show doc for...
Tokens:
Raw
### Koofr Vault configuration

Source: https://docs.s3drive.app/setup/rclone

Example configuration for a Koofr Vault setup, requiring a reference to the existing Koofr integration.

```ini
[my-safe-box]
type = crypt
remote = koofr_dhbw:/My safe box
password = U2shMYIe-BOcc1TkC7FQub9dRrryuSXXzA
password2 = G7KxdOzdGeFxHadwcwf6KfedVQWZug19kq0e8AsrK
```

--------------------------------

### Run S3Drive AppImage

Source: https://docs.s3drive.app/install?q=

Downloads, makes executable, and runs the S3Drive AppImage. Requires FUSE to be installed for the app to start.

```bash
wget https://github.com/s3drive/appimage-app/releases/latest/download/S3Drive-x86_64.AppImage
chmod +x S3Drive-x86_64.AppImage
./S3Drive-x86_64.AppImage
```

--------------------------------

### Install and Run S3Drive via Flathub

Source: https://docs.s3drive.app/install?q=

Installs and runs S3Drive on Linux via Flathub. Requires FUSE and a keyring service; for Flathub releases, configure org.freedesktop.secrets.service.

```bash
flatpak install flathub io.kapsa.drive
flatpak run io.kapsa.drive
```

--------------------------------

### Install Rclone globally on Linux

Source: https://docs.s3drive.app/advanced/v2support?q=

Install the built Rclone binary globally on Linux.

```bash
sudo mv rclone /usr/bin/rclone
which rclone
```

--------------------------------

### Import Multiple Buckets Configuration

Source: https://docs.s3drive.app/setup/import

Example JSON structure for importing multiple bucket configurations in a single file.

```json
[
    {
        "bucketName": "bucket-movies",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.us-west-004.backblazeb2.com",
    },
    {
        "bucketName": "another-bucket",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.eu-west-1.amazonaws.com",
        "encryptionKey": "cG90YXRv",
    }
]
```

--------------------------------

### Sample WebDAV Rclone configuration

Source: https://docs.s3drive.app/setup/rclone

An example of a manual Rclone configuration section for a WebDAV provider.

```ini
[webdav_mwk1]
type = webdav
vendor = other
pass = JZKmgIRILPtE5zSjpNdQd4DI2vo5mQ
url = https://www.dlp-test.com/webdav_pub
user = WebDAV
```

--------------------------------

### Install FUSE on Debian/Ubuntu

Source: https://docs.s3drive.app/install?q=

Installs FUSE (libfuse2) on Debian/Ubuntu, required for S3Drive to start due to virtual drive/mount support.

```bash
sudo apt-get update && sudo apt-get install -y libfuse2
```

--------------------------------

### Install S3Drive via Winget

Source: https://docs.s3drive.app/install?q=

Installs S3Drive on Windows using the Winget package manager. Requires the Visual C++ Redistributable and WinFSP with the 'FUSE for Cygwin' option enabled for file mount functionality.

```powershell
winget install S3Drive.S3Drive
```

--------------------------------

### Install FUSE on CentOS/Red Hat

Source: https://docs.s3drive.app/install?q=

Installs FUSE on CentOS/Red Hat, required for S3Drive to start due to virtual drive/mount support.

```bash
sudo yum install fuse
```

--------------------------------

### Install S3Drive .deb Package

Source: https://docs.s3drive.app/install?q=

Downloads and installs the S3Drive .deb package on Debian/Ubuntu. The final command fixes any dependency issues.

```bash
wget https://github.com/s3drive/deb-app/releases/latest/download/s3drive_amd64.deb
sudo dpkg -i s3drive_amd64.deb
sudo apt-get install -f
```

--------------------------------

### Install Keyring Dependencies on ArchLinux

Source: https://docs.s3drive.app/install?q=

Installs keyring dependencies on ArchLinux for the AppImage release. Without keyring, S3Drive throws 'libsecret_error: Failed to unlock the keyring' and starts in failsafe, less secure mode.

```bash
sudo pacman -Sy gnome-keyring xdg-desktop-portal-gtk
```

--------------------------------

### Example PEM certificate format

Source: https://docs.s3drive.app/advanced/self-signed-ssl

A sample of the expected PEM certificate format for your.domain.com.crt.

```text
-----BEGIN CERTIFICATE-----
MIIEHDCCAwSgAwIBAgIUW4npm6z6oloneZUu3E2Q+arYVQAwDQYJKoZIhvcNAQEL
BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE9rbGFob21hMRMwEQYDVQQHDApT
dGlsbHdhdGVyMRMwEQYDVQQKDApNeSBDb21wYW55MRQwEgYDVQQLDAtFbmdpbmVl
cmluZzEYMBYGA1UEAwwPeW91ci5kb21haW4uY29tMB4XDTI0MDQyNzEyNTEyOFoX
DTI1MDQyNzEyNTEyOFowejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE9rbGFob21h
MRMwEQYDVQQHDApTdGlsbHdhdGVyMRMwEQYDVQQKDApNeSBDb21wYW55MRQwEgYD
VQQLDAtFbmdpbmVlcmluZzEYMBYGA1UEAwwPeW91ci5kb21haW4uY29tMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmkC0+WzKckQzhnqhO2O8i6W2OcT
xODGZbjo9EbFFmrzZPGdGzckf3/7bAQY86+RyRYpm/VELFxOPlI//5hdcQJejeF3
xfqyTDSgJRKNrJ03rmLwhxQ/iJfSBJrT67X4nhAL4qIhohrszLtTXOQrFcBhecF8
psf5KhL6Zjb0/6eC5Pyo/D0xoFhqIKyf1vY9z3htr7k51as0VZbuRWA3/226olAL
UIHzLdUGC9mI5VvHvU+eTaIRKYpCEZu6UPr/JFkdbX1mwJYOezMBKYEnt3wQ37SN
HBGaX/QjSm2hBHmYSYA45RJvF5j3rs/gDqDIviPMstVKWsAl2NSTKn/BcQIDAQAB
o4GZMIGWMAwGA1UdEwQFMAMBAf8wHQYDRV0OBBYEFB8itC1jONnlP7Y7w6VP4ajQ
33mqMAsGA1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEw
GgYDVR0RBBMwEYIPeW91ci5kb21haW4uY29tMB8GA1UdIwQYMBaAFESrxmEbR7Q5
a/CbggrNJfbPeOIwMA0GCSqGSIb3DQEBCwUAA4IBAQBWPBRXfKsqWdvU6iJsuCHa
p31WRmTqeVfRQyUPLORwsE9C4G4wlYp/1sgKBr1nh8mcplbMLO0dKSfEL9eee8lO
vVaJbZjTJFhvfMvJ+JTv575uU+inehyNFk4YQfzo9OqAPjZABx8MkJX4y3oqrqiL
3kUNXccG8vkd8+2BgWmpo53eIBs/ZZKo9mrZisvNkQndPzEZnX1w0tapcAPJp+2c
zJToD8zAxUiItZkIjRh2U63qM9pE88siVJM2c6VHhOqiEpu8Y8Gej6XLbUyy6J+D
o4c3OFJWzgQYB3VK6IDpr/DQdS2YfEPh5FQw46xvU4SdD6LwXlM1D1I83tt2j/8C
-----END CERTIFICATE-----
```

--------------------------------

### Example self-signed certificate (PEM)

Source: https://docs.s3drive.app/advanced/self-signed-ssl?q=

Example self-signed certificate (your.domain.com.crt) in PEM format that can be imported into S3Drive. This is the output of the OpenSSL commands and is shown as an example certificate.

```pem
-----BEGIN CERTIFICATE-----
MIIEHDCCAwSgAwIBAgIUW4npm6z6oloneZUu3E2Q+arYVQAwDQYJKoZIhvcNAQEL
BQAwejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE9rbGFob21hMRMwEQYDVQQHDApT
dGlsbHdhdGVyMRMwEQYDVQQKDApNeSBDb21wYW55MRQwEgYDVQQLDAtFbmdpbmVl
cmluZzEYMBYGA1UEAwwPeW91ci5kb21haW4uY29tMB4XDTI0MDQyNzEyNTEyOFoX
DTI1MDQyNzEyNTEyOFowejELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE9rbGFob21h
MRMwEQYDVQQHDApTdGlsbHdhdGVyMRMwEQYDVQQKDApNeSBDb21wYW55MRQwEgYD
VQQLDAtFbmdpbmVlcmluZzEYMBYGA1UEAwwPeW91ci5kb21haW4uY29tMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmkC0+WzKckQzhnqhO2O8i6W2OcT
xODGZbjo9EbFFmrzZPGdGzckf3/7bAQY86+RyRYpm/VELFxOPlI//5hdcQJejeF3
xfqyTDSgJRKNrJ03rmLwhxQ/iJfSBJrT67X4nhAL4qIhohrszLtTXOQrFcBhecF8
psf5KhL6Zjb0/6eC5Pyo/D0xoFhqIKyf1vY9z3htr7k51as0VZbuRWA3/226olAL
UIHzLdUGC9mI5VvHvU+eTaIRKYpCEZu6UPr/JFkdbX1mwJYOezMBKYEnt3wQ37SN
HBGaX/QjSm2hBHmYSYA45RJvF5j3rs/gDqDIviPMstVKWsAl2NSTKn/BcQIDAQAB
o4GZMIGWMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFB8itC1jONnlP7Y7w6VP4ajQ
33mqMAsGA1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEw
GgYDVR0RBBMwEYIPeW91ci5kb21haW4uY29tMB8GA1UdIwQYMBaAFESrxmEbR7Q5
a/CbggrNJfbPeOIwMA0GCSqGSIb3DQEBCwUAA4IBAQBWPBRXfKsqWdvU6iJsuCHa
p31WRmTqeVfRQyUPLORwsE9C4G4wlYp/1sgKBr1nh8mcplbMLO0dKSfEL9eee8lO
vVaJbZjTJFhvfMvJ+JTv575uU+inehyNFk4YQfzo9OqAPjZABx8MkJX4y3oqrqiL
3kUNXccG8vkd8+2BgWmpo53eIBs/ZZKo9mrZisvNkQndPzEZnX1w0tapcAPJp+2c
zJToD8zAxUiItZkIjRh2U63qM9pE88siVJM2c6VHhOqiEpu8Y8Gej6XLbUyy6J+D
o4c3OFJWzgQYB3VK6IDpr/DQdS2YfEPh5FQw46xvU4SdD6LwXlM1D1I83tt2j/8C
-----END CERTIFICATE-----
```

--------------------------------

### Import Encrypted Bucket Configuration

Source: https://docs.s3drive.app/setup/import

Example JSON structure for an encrypted bucket. The encryptionKey must be a base64-encoded plaintext password.

```json
[
    {
        "bucketName": "another-bucket",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.eu-west-1.amazonaws.com",
        "encryptionKey": "Y29uZmlkZW50aWFs",
    }
]
```

--------------------------------

### Import Unencrypted Bucket Configuration

Source: https://docs.s3drive.app/setup/import

Example JSON structure for importing a standard S3 bucket without encryption.

```json
[
    {
        "bucketName": "bucket-movies",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.us-west-004.backblazeb2.com",
    },
]
```

--------------------------------

### Encrypted chunker configuration

Source: https://docs.s3drive.app/setup/rclone

An advanced configuration example that uses a chunker to split files into 128MiB encrypted segments, distributed across four Google Drive accounts via a union remote.

```ini
[chunker]
type = chunker
remote = crypt_union:
chunk_size = 128Mi

[crypt_union]
type = crypt
filename_encryption = standard
password = FQtZ1IPes8CpH88R9HzcP1GlmT06dQ
remote = union:
suffix = none
directory_name_encryption = true
filename_encoding = base64

[union]
type = union
upstreams = google1: google2: google3: google4:
create_policy = epmfs

[google1]
type = drive
client_id =
client_secret =
token =

[google2]
type = drive
client_id =
client_secret =
token = 

[google3]
type = drive
client_id =
client_secret =
token = 

[google4]
type = drive
client_id =
client_secret =
token = 
```

--------------------------------

### Verify Rclone build with version command

Source: https://docs.s3drive.app/advanced/v2support?q=

Verify the built Rclone binary works by checking its version output.

```bash
$ ./rclone  --version
rclone v1.73.5-with-v2-cipher
- os/version: ubuntu 25.10 (64 bit)
- os/kernel: 6.17.0-22-generic (x86_64)
- os/type: linux
- os/arch: amd64
- go/version: go1.25.0
- go/linking: dynamic
- go/tags: cmount
```

--------------------------------

### Generate SSL certificate using OpenSSL

Source: https://docs.s3drive.app/advanced/self-signed-ssl

Commands to create a root CA and a domain-specific certificate using OpenSSL.

```bash
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -subj "/C=US/ST=Oklahoma/L=Stillwater/O=My Company/OU=Engineering/CN=your.domain.com" -keyout rootCA.key -out rootCA.crt
openssl genrsa -out "your.domain.com.key" 2048
openssl req -new -key your.domain.com.key -out your.domain.com.csr -config openssl.cnf
openssl x509 -req -days 365 -in your.domain.com.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -extensions v3_req -extfile openssl.cnf -out your.domain.com.crt
```

--------------------------------

### Sample Rclone configuration for S3Drive

Source: https://docs.s3drive.app/advanced

A sample configuration file showing both the S3 remote and the crypt remote. Ensure filename_encoding is set to base64 and suffix is set to none for compatibility.

```ini
[s3drive_remote]
type = s3
provider = Other
access_key_id = <access_key_id>
secret_access_key = <secret_access_key>
endpoint = <endpoint>
region = <region>

[s3drive_crypt]
type = crypt
filename_encoding = base64
remote = s3drive_remote:<bucket_name>
password = <obscuredPassword>
filename_encryption = standard
directory_name_encryption = true
suffix = none
```

--------------------------------

### OpenSSL configuration file (openssl.cnf)

Source: https://docs.s3drive.app/advanced/self-signed-ssl

Configuration file used to define certificate details and extensions for SAN IP and DNS.

```ini
[req]
default_bits = 2048
encrypt_key  = no # Change to encrypt the private key using des3 or similar
default_md   = sha256
prompt       = no
utf8         = yes

# Specify the DN here so we aren't prompted (along with prompt = no above).

distinguished_name = req_distinguished_name

# Extensions for SAN IP and SAN DNS

req_extensions = v3_req

# Be sure to update the subject to match your organization.

[req_distinguished_name]
C  = US
ST = Oklahoma
L  = Stillwater
O  = My Company
OU = Engineering
CN = your.domain.com

# Allow client and server auth. You may want to only allow server auth.
# Link to SAN names.

[v3_req]
basicConstraints     = CA:TRUE
subjectKeyIdentifier = hash
keyUsage             = digitalSignature, keyEncipherment
extendedKeyUsage     = clientAuth, serverAuth
subjectAltName       = @alt_names

# Alternative names are specified as IP.# and DNS.# for IP addresses and
# DNS accordingly.

[alt_names]
DNS.1 = your.domain.com
```

--------------------------------

### Build Rclone with V2 cipher on Windows

Source: https://docs.s3drive.app/advanced/v2support?q=

Build Rclone with V2 cipher support on Windows. Requires WinFsp (including development package).

```bash
go run bin/resource_windows.go -version v1.73.5-with-v2-cipher -syso resource_windows_`go env GOARCH`.syso

# WinFsp needs to be installed (incl. development package)
SET CPATH=C:\Program Files (x86)\WinFsp\inc\fuse
go build -v --ldflags "-s -X github.com/rclone/rclone/fs.Version=v1.73.5-with-v2-cipher" -tags "cmount" -buildmode exe
```

--------------------------------

### Build Rclone with V2 cipher on Linux

Source: https://docs.s3drive.app/advanced/v2support?q=

Build Rclone with V2 cipher support on Linux. Requires libfuse-dev.

```bash
sudo apt-get install libfuse-dev
go build -v --ldflags "-s -X github.com/rclone/rclone/fs.Version=v1.73.5-with-v2-cipher" -tags "cmount"
```

--------------------------------

### Clone Rclone with V2 cipher support

Source: https://docs.s3drive.app/advanced/v2support?q=

Fetch the latest Rclone source with V2 cipher support and check out the required branch.

```bash
git clone https://github.com/s3drive/rclone.git
cd rclone
git checkout envelope_encryption_7192_17_1.73.5
```

--------------------------------

### Display Rclone config file location

Source: https://docs.s3drive.app/advanced

Use this command to find the location of your Rclone configuration file.

```bash
rclone config file
```

--------------------------------

### Multiple buckets JSON

Source: https://docs.s3drive.app/setup/import?q=

JSON array for importing multiple S3 buckets in one import. Each bucket object can have its own encryptionKey.

```json
[
    {
        "bucketName": "bucket-movies",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.us-west-004.backblazeb2.com",
    },
    {
        "bucketName": "another-bucket",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.eu-west-1.amazonaws.com",
        "encryptionKey": "cG90YXRv",
    }
]

```

--------------------------------

### Unencrypted bucket JSON

Source: https://docs.s3drive.app/setup/import?q=

JSON array for importing a single unencrypted S3 bucket. Required fields: bucketName, keyId, applicationKey, endpoint.

```json
[
    {
        "bucketName": "bucket-movies",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.us-west-004.backblazeb2.com",
    },
]

```

--------------------------------

### Obscure Rclone password

Source: https://docs.s3drive.app/advanced

Use this command to generate an obscured password string for your Rclone configuration.

```bash
echo "YourPlaintextPassword" | rclone obscure -
```

--------------------------------

### Encrypted bucket JSON

Source: https://docs.s3drive.app/setup/import?q=

JSON array for importing an encrypted S3 bucket. The encryptionKey must be base64-encoded plaintext password; filepathEncryptionEnabled controls filepath encryption.

```json
[
    {
        "bucketName": "another-bucket",
        "keyId": "keyId",
        "applicationKey": "applicationKey",
        "endpoint": "https://s3.eu-west-1.amazonaws.com",
        "encryptionKey": "Y29uZmlkZW50aWFs",
    }
]

```
Tokens:
Raw