YOUR FILES. YOUR RULES. Secure file access for teams — without the weight of Nextcloud.
Mount any volume, assign permissions per group and path, share files with expiring links, and keep a full audit trail. All in one container.
Everything ops needs.
Nothing ops doesn't.
No plugin store. No sync engine. No photo albums. Just secure, audited file access — exactly as configured.
Use the SSO you already have
OIDC works with Keycloak, Authentik, Auth0, Azure AD out of the box. LDAP available for on-prem. No local users to manage or passwords to rotate.
OIDC · LDAP · SSOAccess exactly where needed
Give dev write access to /public without exposing /secret. Per-path rules within a volume, group-based. Most specific rule wins.
Share files without sharing access
Generate a signed link for any file. Set it to expire in 24h, limit to one use, add a password. No account needed to receive. Every access logged.
EXPIRING LINKS · PASSWORDKnow who did what, when
Every download, upload, delete, rename, failed login and permission denial is recorded. Filter by user, volume or action. Export as CSV for compliance.
FULL AUDIT · CSV EXPORTMount volumes in your OS
WebDAV endpoint for every volume. macOS Finder, Windows, Cyberduck, rclone — connect natively without extra software. Same permissions, same audit trail.
WEBDAV · NATIVE MOUNTVersion-control your permissions
The entire access model lives in a single YAML file. Commit it, review it, roll it back. Restart the container — config applied. No database migrations.
YAML · GITOPSRight-sized
for the job.
FileBrowser is too limited. Nextcloud is too heavy. Astrot fills the gap.
| Astrot THIS | FileBrowser | Nextcloud | |
|---|---|---|---|
| // Access & Identity | |||
| OIDC / SSO | ✓native | ✗ | ✓via plugin |
| LDAP | ✓ | ✗ | ✓ |
| Per-path permissions | ✓path prefix rules | ✗volume-level only | partialshares only |
| Group-based access control | ✓ | ✗ | ✓ |
| // File Sharing | |||
| Expiring share links + max uses | ✓ | basic | ✓ |
| Password-protected links | ✓ | ✗ | ✓ |
| WebDAV native mount | ✓ | ✗ | ✓ |
| // Operations | |||
| Full audit log + CSV export | ✓ | ✗ | partial |
| Declarative YAML config (GitOps) | ✓ | JSON only | ✗ |
| Single container, no DB server | ✓ | ✓ | ✗requires PostgreSQL |
| Memory footprint | <30 MB | ~50 MB | 512 MB+ |
Nothing goes
unrecorded.
Every file operation, every failed login, every share link access — attributed, timestamped, exportable. Filter by user, volume, action or date range.
Running in
three steps.
Write your config
Define volumes, groups and permissions in a single YAML file. Commit it to git — that's your source of truth.
- name: app1
path: /app1
permissions:
- group: dev
read: true
write: true
Deploy the container
Mount your storage, pass your OIDC config, expose port 8080. One command and it's live.
-v /srv/app1:/app1 \
-v ./astrot.yaml:/etc/astrot/config.yaml \
-e OIDC_ISSUER=https://auth.corp \
-p 8080:8080 astrot/gateway
Your team logs in
Users authenticate via your identity provider. Groups map automatically. They see exactly what they're allowed to — nothing more.
✓ OIDC: auth.corp.com
✓ WebDAV ready at /dav/app1/
✓ Listening on :8080
→ https://files.corp.com