atfs Docs Download
How-to guide

Expose to the internet

You will point a public HTTPS hostname at your atfs instance.

Atfs itself only ever serves plain HTTP; port 2837 by default, or 80 from the Docker image. You will need a public HTTPS hostname pointed at that port so you can use it.

Two ingress agents are already baked into the image you flashed to your SD-card: Cloudflare Tunnel and Tailscale Funnel.

Configuration for each lives in its own folder under config/ingress/ on the card’s atfs-boot partition, beside a .explain.md file describing exactly what to type into it. You can also perform your own routing from the internet to your device’s IP address on port 2837. You only need to pick one of these ingress types.

Follow your docker hosting platform’s recommendations for terminating TLS and routing web traffic to your container.

Their recommendation may be one of the approaches detailed below, or may be different.

Cloudflare Tunnel

  1. Install cloudflared on your computer. This is only needed for initial set up.
  2. Log in: cloudflared tunnel login.
  3. Create a tunnel, picking any name: cloudflared tunnel create <a-name>.
  4. Print its token — cloudflared tunnel token <a-name> — and paste the result into config/ingress/cloudflared/token on the card.
  5. Find the domain you configured Route your domain to the tunnel — cloudflared tunnel route dns <a-name> <your-domain.com>. This creates the domain’s CNAME record for you
  6. Set config/ingress/cloudflared/hostname to that same domain, and config/ingress/cloudflared/port to 2837.

Warning

Cloudflare’s free plan refuses any upload over about 100MB. This is a limit on the HTTP request body, enforced at Cloudflare’s edge before it reaches atfs. A paid plan raises the ceiling. So does raising “Maximum Upload Size” under your zone’s Network settings, up to what your plan allows. There is no way past the limit on Free otherwise.

An in-progress atfs capability sidesteps this. It moves the upload off HTTP entirely. A browser JavaScript client will build the file into IPFS blocks locally. It will then send them peer-to-peer over Bitswap, inside a plain WebSocket connection. Cloudflare does not size-limit a WebSocket the way it does a request body. That client does not exist yet. Until it ships, a Free-plan Cloudflare Tunnel stays a real ceiling on how large a file you can upload.

Tailscale Funnel

Set config/ingress/tailscale-funnel/port to 2837. That alone starts it — no token and no DNS step. Tailscale assigns the instance’s public address itself, ending in ts.net; boot the board first, read that address off its logs, and use it as the instance’s serviceDid.

Note

Tailscale Funnel only ever serves its own ts.net name. There is no custom domain option for it.

Other approaches

Other approaches should:

  • Terminate TLS
  • Route an unchanging domain name that matches the one you defined during setup to your atfs instance

Note

Whatever routes traffic to your atfs instance may impose its own request-body limit. For example, nginx’s client_max_body_size defaults to a tiny 1MiB. Make sure you set the ATFS_MAX_REQUEST_BODY environment variable to match.

Clients are able to upload larger files than this, see Upload a file over the size limit for details.