Self-hosted Seafile: a file sync and share server you control

Is Seafile right for you, and which edition?

Seafile does one job and does it lean: it keeps folders, which it calls libraries, in sync between a server and everyone's devices, lets you share them with links or groups, and adds online documents through its SeaDoc editor. Under the hood it cuts each file into pieces that average about 8 MB and stores each piece only once, so a big file you edit every day does not fill your disk with full copies of every version.

If you also want calendars, contacts and a shelf of add-on apps, a broader suite may suit you better: our guide to running Nextcloud yourself covers that route. If fast, dependable sync is the point, read on.

The Community Edition is open source: the server core is under the AGPLv3 and the web interface under Apache 2.0, with the desktop client under GPLv2. The Pro Edition adds features on top and, according to the manual, needs no paid licence for up to three users; more people need a licence bought from Seafile. For a family or a three-person studio, Pro may cost nothing; for a growing team, start on Community and move up when a Pro feature earns its place.

How big a server do you need?

Start from storage, then check the processor and memory floor the manual gives for each edition:

• Community Edition: 2 GB of memory and 2 cores, ideally faster than 2 GHz. At least 10 GB of free disk, and the manual recommends more than 50 GB.
• Pro Edition with its standard search engine (Elasticsearch): 4 cores and 4 GB.
• Pro Edition using the lighter SeaSearch, or with Elasticsearch on another machine: back down to 2 cores and 2 GB.
• Add-ons such as OnlyOffice: the manual says to go above these figures.

These are floors, not targets. Your storage figure is your team's files plus the history Seafile keeps for them, so leave plenty of room to grow. Seafile's images also run on ARM64 processors as well as the usual x86.

The server that fits

A dedicated server gives Seafile a whole physical machine: all of its cores, memory and disks, with root access and no other customer on the hardware. Nobody meters the port, so the day everyone installs the client and pulls down every library at once costs you nothing extra. A ready server is handed over within 30 minutes of your payment being approved.

• Lots of files? Look at storage servers, or have one built with as many as 24 drive bays and the RAID level you choose. A machine built for you arrives within 4-24 hours once review has cleared, if the parts are already on our shelves, or in 5 to 10 working days if something must be ordered in.
• Locked yourself out? Rack servers, blades, and the m510 or m710x cartridge each include a console screen and power button you open yourself, even when the system will not start.
• IPv6 comes at no charge alongside your IPv4 address.
• No contract. It is month to month, so you can move to a bigger machine when the files outgrow it.

Installing it, step by step

1. Point a DNS name, say files.yourcompany.com, at the server's address, and install Docker using its official guide.
2. Download the four files Seafile's manual lists into /opt/seafile and make the settings file readable by root alone (commands below).
3. Open .env and fill in your hostname, https as the protocol, a long random JWT_PRIVATE_KEY (32 characters or more), the two database passwords, and your admin email and password.
4. Start the stack and watch the log until it reports the admin account was created.
5. Visit https://files.yourcompany.com and sign in as that admin.

mkdir /opt/seafile
cd /opt/seafile
wget -O .env https://manual.seafile.com/13.0/repo/docker/ce/env
wget https://manual.seafile.com/13.0/repo/docker/ce/seafile-server.yml
wget https://manual.seafile.com/13.0/repo/docker/seadoc.yml
wget https://manual.seafile.com/13.0/repo/docker/caddy.yml
chmod 600 .env     # passwords live here: root only
nano .env
docker compose up -d
docker logs seafile -f
# data: /opt/seafile-data, /opt/seafile-mysql, /opt/seafile-caddy, /opt/seadoc-data

Since Seafile 12.0 you no longer set SERVICE_URL yourself: the address that clients and share links use is built from the hostname and protocol lines in .env (SEAFILE_SERVER_HOSTNAME, SEAFILE_SERVER_PROTOCOL).

Keeping the admin password out of sight

Seafile does not let the first visitor claim the server. The admin is created on the very first start from INIT_SEAFILE_ADMIN_EMAIL and INIT_SEAFILE_ADMIN_PASSWORD in .env, and if you leave them alone you get me@example.com with the password asecret. Change both before you run the stack for the first time.

Typing the password into the file rather than a command keeps it out of your shell history and the process list, and chmod 600 keeps other accounts from reading it. Once you are in, change the admin password from the web interface, then put a long random string in place of INIT_SEAFILE_ADMIN_PASSWORD in .env. Never leave either line empty: seafile-server.yml quietly fills in asecret for an empty password and me@example.com for an empty email, and a fresh start on wiped volumes would then make an admin with those values. The file labels the INIT_ settings as used only on first start-up, and we read that as Seafile ignoring them afterwards. If you ever lose the admin login, run the reset-admin.sh script inside the seafile container with docker exec -it; it asks for the new login interactively.

Locking the doors: HTTPS and the firewall

You do not need to touch certificates. The stack includes Caddy, a web server that, once the protocol is https, requests a certificate for your hostname and keeps it renewed. Caddy is also the only part that listens publicly, on ports 80 and 443; the database and cache talk to Seafile over a private Docker network.

One thing catches people out. Ports that Docker publishes skip the ufw firewall, because Docker adds its own rules underneath it. Here that only affects 80 and 443, which must be open anyway, but it means you should never uncomment an extra port in the compose files; if you need one for a quick test, tie it to 127.0.0.1. Docker may or may not listen on IPv6 depending on how it is set up, so look at ss -tlnp once everything is running. For everything else, switch ufw on for both IPv4 and IPv6:

grep IPV6 /etc/default/ufw    # expect IPV6=yes
ufw default deny incoming
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw --force enable    # skips the y/n prompt when pasted
ufw status verbose

Getting everyone's devices syncing

Each person installs a Seafile app and signs in with your https address. There are four to choose from:

• The desktop sync client, which keeps chosen libraries mirrored in a folder on the computer.
• SeaDrive, which shows your libraries as a virtual drive and lets you keep chosen folders available offline.
• The Android app.
• The iOS app.

By default the apps check the server for changes on a timer. If you want edits to show up straight away, Seafile offers an optional notification server that pushes library updates as they happen. It works with the desktop client from version 8.0.11, SeaDrive from 3.0.1 and the web interface; the phone apps keep checking on their timer.

Backups you can actually restore

We do not sell a backup product, so this part is yours to own. Seafile keeps your data in two places: three MariaDB databases (ccnet_db, seafile_db and seahub_db) and the folder /opt/seafile-data/seafile. We also save /opt/seadoc-data (SeaDoc's logs) plus .env and the compose files; that part is our addition to the manual's list. Save the databases first and the files second. The manual explains why: in that order nothing in the database points at a file the backup missed, so libraries come back intact, at worst slightly out of date. Keep each night's dumps for at least a week, and copy /backup to another machine, since a copy that lives on the server's own drives is lost along with them.

# save as /root/seafile-backup.sh and run with: bash /root/seafile-backup.sh
set -euo pipefail
umask 077    # new files readable by root alone
NOW=$(date +%Y-%m-%d-%H%M)
mkdir -p /backup/databases /backup/data /backup/config
# the password comes from .env (unquoted value), not from the command line
export MYSQL_PWD="$(sed -n 's/^SEAFILE_MYSQL_DB_PASSWORD=//p' /opt/seafile/.env)"
for name in ccnet_db seafile_db seahub_db; do
  docker exec -e MYSQL_PWD seafile-mysql \
    mariadb-dump -u seafile --opt "$name" > "/backup/databases/$name.sql.$NOW"
done
rsync -az /opt/seafile-data/seafile /opt/seadoc-data /backup/data/
cp -a /opt/seafile/.env /opt/seafile/*.yml /backup/config/    # secrets inside

The manual's examples type the password after -p and use docker exec -it; a password typed like that is visible to anyone listing processes, and -it fails in cron because there is no terminal. The script avoids both. The /backup/config copy carries every password of the stack, so keep it readable by root only, here and wherever you copy it off the server. Restoring is the reverse: load each dump back into its database, copy the folder back with rsync, then run Seafile's seaf-fsck.sh check to repair any small mismatch between the two.

Housekeeping and updates

Deleting files in Seafile does not shrink the disk on its own, because chunks can be shared by other files. A clean-up job called garbage collection frees them. Try it first in preview mode: inside the seafile container, from /opt/seafile/seafile-server-latest, run ./seaf-gc.sh --dry-run, then repeat without the flag. Libraries sitting in the admin trash are only cleaned once the trash is emptied. Since version 12.0 the Community Edition can run garbage collection while Seafile keeps running.

For a small update within the same version, fetch the newer image, then bring the stack down and up again. For a jump such as 12.0 to 13.0, take a backup, read that version's upgrade notes, and follow the Docker upgrade steps: they replace seafile-server.yml (and notification-server.yml, elasticsearch.yml, seasearch.yml or seadoc.yml if you use them), add new settings to .env and remove obsolete ones from the old config files. From 13.0 the Community Edition is no longer supported as a binary package, and the manual recommends Docker.

Questions people ask

What happened to SERVICE_URL in the settings?

Seafile 12.0 removed it. Set SEAFILE_SERVER_HOSTNAME and SEAFILE_SERVER_PROTOCOL in .env and Seafile builds its address from them.

How many people can use Seafile Pro for free?

Up to three, according to the manual. Above that you buy a licence from Seafile. The Community Edition has no such cap.

Why is my disk still full after I deleted files?

Seafile keeps the underlying chunks until garbage collection runs, because other files or older versions may still use them. A preview run of seaf-gc.sh (the --dry-run flag) shows what would be freed; the real run drops the flag. Empty the admin trash first if whole libraries were deleted.

Do I have to use Caddy for HTTPS?

It is the default and the easiest path, since it gets and renews the certificate for you. The manual also explains how to use your own certificate with Caddy, or put a different reverse proxy in front if you already run one.