Run Filestash on a VPS: Secure Self-Hosted File Management

Quick answer: Filestash can provide browser-based file management for SFTP, WebDAV, S3-compatible storage, and other backends from a VPS. Run it behind HTTPS, restrict admin access, protect storage credentials, use a firewall, and test backups before relying on it for team file workflows.

A self-hosted file manager is powerful because it sits close to sensitive files. That also makes it risky when deployed casually. Do not expose a raw admin port on the public internet without a security plan. Put the service behind a reverse proxy, use a domain, document who can access it, and limit each storage connection to the minimum permissions needed.

What Filestash Is Used For

Filestash is a web-based file management interface. It can connect to storage backends such as SFTP, WebDAV, and object storage, giving users a browser workspace for browsing, uploading, downloading, and sharing files. On a Voxfor VPS, it can be part of a private tool stack for agencies, developers, documentation teams, and internal operations.

Before You Install

Decision	Why it matters	Recommended check
Storage backend	Filestash connects to storage; it is not the backup plan by itself.	Decide whether files live on SFTP, WebDAV, object storage, or another backend.
Public access	The web interface can expose sensitive files if misconfigured.	Use HTTPS and restrict admin access.
User permissions	File tools can overwrite or delete important data.	Give each user or connection only the access required.
Backups	Credentials, config, and connected storage need restore planning.	Test recovery before production use.
Updates	Self-hosted tools need maintenance.	Document image update and rollback steps.

Safer Docker Compose Layout

Docker Compose makes the deployment easier to repeat and review than a one-line docker run. Bind the service to localhost or an internal Docker network, then expose it through a reverse proxy such as Caddy, Nginx, or Traefik.

services:
  filestash:
    image: machines/filestash:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:8334:8334"
    volumes:
      - filestash-data:/app/data/state

volumes:
  filestash-data:

The exact image and volume paths should be checked against current Filestash documentation before deployment. The important pattern is the same: keep state persistent, avoid public raw ports, and place HTTPS and access controls in front of the app.

Reverse Proxy and HTTPS

Use a real domain such as files.example.com and terminate HTTPS at the reverse proxy. This protects browser sessions and avoids sending credentials through plain HTTP. If the instance is for internal use only, consider IP restrictions, VPN access, or another private access layer in addition to application authentication.

Storage Permissions and Secrets

Filestash is only as safe as the storage credentials connected to it. Use separate storage users for each workflow where possible. Avoid using root SFTP credentials. If the tool only needs a project folder, restrict the account to that folder. Store credentials in the application configuration or secret manager, not in public documentation or shared notes.

Operational Checklist

1. Create a DNS record for the file management subdomain.
2. Deploy Filestash with persistent state storage.
3. Put the service behind HTTPS through a reverse proxy.
4. Limit firewall access to SSH, HTTP, HTTPS, and approved admin paths.
5. Create storage users with limited permissions.
6. Test upload, download, share, permission denial, backup, and restore behavior.

Production Hardening Table

Before inviting users, review the deployment as if it were any other sensitive admin tool. A file manager can expose, overwrite, or delete important files, so the default should be narrow access and clear logging.

Area	Action	Reason
Admin account	Use strong credentials and limit who can create storage connections.	Storage connectors can expose broad data paths.
Domain	Use a dedicated subdomain for the file tool.	Cleaner DNS, proxy, logging, and access rules.
Uploads	Set file-size limits in the proxy and backend.	Prevents unexpected disk pressure and failed large transfers.
Logs	Keep proxy and container logs long enough for incident review.	Helps identify access attempts and failed operations.
Updates	Test image updates on a copy before changing production.	Reduces risk of breaking storage connectors.

Backup and Restore Planning

Backups should cover both the Filestash configuration and the data users expect to recover. If the actual files live on SFTP or object storage, verify that the backend has its own backup or versioning policy. Test restoration by rebuilding the service on a clean path and confirming that a user can reconnect to storage and access a sample file.

• Back up Docker Compose files, environment files, and reverse proxy configuration.
• Back up Filestash state volumes and any local storage paths.
• Document where storage credentials are kept and who can rotate them.
• Run a restore test before adding production users.

Troubleshooting Filestash on a VPS

Problem	Likely area	What to check
Login page does not load	Container, port, proxy, DNS, or firewall.	Check container status, proxy logs, DNS record, and local binding.
Storage connection fails	Credentials, network, storage permissions.	Test the same credentials from the VPS shell if possible.
Uploads fail	Storage quota, permissions, file size, proxy limits.	Check backend quota, user permissions, and proxy body-size limits.
Sharing is too broad	Access policy.	Review link expiration, user roles, and backend permissions.
Data is missing after restart	Non-persistent state.	Confirm Docker volumes and backup coverage.

When To Use Managed Help

Use managed assistance when the file workspace stores customer files, business documents, client deliverables, or production assets. The setup should be reviewed for HTTPS, firewall rules, backup coverage, restore testing, and storage permissions before inviting users.

About the Writer

Vinayak Baranwal wrote the original article. This version was manually reviewed and rebuilt by the Voxfor editorial team for safer self-hosted file management on VPS infrastructure.

Frequently Asked Questions

What is Filestash used for?

Filestash provides a browser-based file management interface for storage backends such as SFTP, WebDAV, and object storage.

Is self-hosted file management safe?

It can be safe when HTTPS, authentication, firewall rules, limited storage permissions, updates, backups, and restore testing are handled carefully.

Should Filestash be exposed on a direct public port?

No. Put it behind a reverse proxy with HTTPS and restrict access where possible.

Why run Filestash on a VPS?

A VPS gives a persistent private environment for file workflows, storage connectors, internal tools, and controlled access.

What should be backed up?

Back up Filestash state, configuration, connected storage data where applicable, credentials needed for recovery, and reverse proxy configuration.

What permissions should storage users have?

Use the narrowest permissions that match the workflow. Avoid using root or full-server credentials when the user only needs one folder or storage bucket.