Dropvale documentation

Overview and requirements

Dropvale is self-hosted client file delivery for studios, agencies and small firms. You upload finished work into projects, share it through a branded portal or a share link, close the link when the job is done, and keep a receipt for every download.

What it does

• Projects and folders: projects for each client, nested folders, a per-project accent colour in the portal.
• Roles: owner (everything), staff (only the projects they belong to) and client guests (read-only portal for their own projects). Clients are invited by email and can reset their password.
• Uploads: chunked and resumable, sized to the server's upload_max_filesize and post_max_size. An interrupted upload resumes from the missing chunks. Unfinished uploads are cleaned up after 48 hours.
• Previews: images (thumbnail via GD), PDF (browser viewer), video (poster frame with ffmpeg, placeholder without it) and text.
• Share links: for a project, a folder or one file, with expiry, password, download limit and close (revoke). Wrong passwords are throttled.
• Receipts and audit: every download is recorded with file, link, time and IP; export receipts as CSV. Uploads, links, logins and settings changes go to the audit log.
• Storage: on this server under storage/app/dropvale (never web-served; files are stored as .bin and streamed through the app) or any S3-compatible bucket.
• Quotas: per-project quotas, a default quota and a maximum file size.
• Notifications: email to project members when new files arrive and to the link creator on downloads, sent through the database queue.
• Branding: studio name, logo URL, accent colour, welcome line and contact email; envelope portal style or plain white-label style. Light and dark mode.
• Demo mode: DEMO=true refuses every write in a web request and drops mail.

Requirements

• PHP 8.2+ with bcmath, ctype, curl, fileinfo, intl, mbstring, openssl, pdo, tokenizer, xml, zip and sodium; gd for image previews
• MySQL 8 or MariaDB 10.6+
• Writable storage/ and bootstrap/cache/
• One cron entry (every minute)
• Optional: ffmpeg for video poster frames

The zip includes production vendor/ and built assets in public/build. No Node, Redis or SSH is needed on the host.

Demo

Try the read-only demo at https://dropvale-demo.aucip.com.

Installation

Web installer (cPanel)

1. Create a MySQL database and user (cPanel → MySQL Databases).
2. Upload the zip and extract it. You get a dropvale/ folder.
3. Point the domain or subdomain document root at dropvale/public/.
4. Open https://your-domain/. A fresh upload is sent to /install.
5. Work through the steps: server check, site and licence (licence key, studio name, site URL), database, owner account (tick the box to load demo data if you want to explore first), then install.
6. When it finishes, the installer locks itself and /install answers 404.
7. Add the cron entry (every minute):

* * * * * php /home/USER/dropvale/artisan schedule:run >> /dev/null 2>&1

It drains the database queue (emails and previews), cleans up unfinished uploads and runs the licence check.

Command line

cp .env.example .env    # set the DB_* values first
php artisan dropvale:install --name="Your Studio" --url=https://files.example.com \
  --admin-name="Your Name" --admin-email=you@example.com --admin-password='change-me-now' \
  [--license=YOUR-LICENCE-KEY] [--demo]

The command writes APP_ENV=production, APP_DEBUG=false and TRUSTED_HOSTS for your domain.

Reopening the installer

Run php artisan dropvale:install-token and open /install?token=… with the token it prints. Without the token the installer stays closed.

Updating

• One click: Admin → Updates → Check for updates, then Install. A code backup is taken first and migrations run. Update packages are checksum-verified before install.
• Manual: Admin → Updates → Upload update zip, or upload the files over the old ones (keep .env and storage/) and run php artisan migrate --force. Check the zip first: sha256sum dropvale-x.y.z.zip must match the SHA-256 published with the download.

Installation is a paid add-on.

Configuration

Admin → Settings

.env

Licence

Admin → Licence shows the install type (local, staging or production), the licence status and activations, and lets you activate or deactivate this install. On a local host it shows Local mode and needs no key.

Usage

Deliver a project

1. Projects → New project: name, client name and an optional accent colour. Add staff and client guests as members.
2. Pack the files: open the project in the portal and drop files or folders on the uploader. Large files upload in chunks; if the connection drops, the upload picks up from the missing chunks.
3. New share link: choose expiry (14 days by default), a download limit (10 by default) and an optional password. Copy the link or send it to the client.
4. Close the link when the job is done. A closed or expired link shows "This link has been closed" with a button to email the studio.

Client portal

Client guests sign in at /login and see only their own projects: files, folders and previews, with a download button on each file.

Receipts and audit

Download receipts lists every download with file, link, time and IP; Export CSV gives the same list as a file. Audit log records uploads, share links, logins, file changes and settings changes.

Files

Files in the admin lets owners and staff rename, move and delete files; project usage is recalculated.

Licence FAQ

Which licence do I need?

• Regular licence: use in one end product that end users are not charged for. Free updates while licensed and 6 months of support (renewable).
• Extended licence: use in one end product that end users are charged for (for example a paid SaaS or paid membership). Free updates while licensed and 6 months of support (renewable).

One licence = one end product. Free local installs (localhost/.test) plus up to 3 staging installs on staging subdomains per licence; staging doesn't count against your production domain. Each additional end product needs another licence.

Support is through Aucip tickets, typically within 1–2 business days.

Is installation included?

Installation is a paid add-on.

What does Dropvale send to aucip.com?

Only licence and update checks are sent to aucip.com. Activation, the licence check and update downloads send the licence key, product, domain, a random install id, the version and production/staging. If a licence answer fails its replay check, a short report with only the domain, product, version and endpoint is sent. No client files, no client data and no telemetry. Every answer is signed and checked against a key built into the code.

How are updates delivered?

Update packages are checksum-verified before install. The signed update answer carries a SHA-256 checksum and an https download link, and the zip is refused if the checksum doesn't match. For manual installs, run sha256sum on the zip and compare it with the SHA-256 published with the download before you upload it.

What counts as staging?

Staging is decided by the host name only. Common patterns: staging.*, stage.*, dev.*, test.*, uat.*, preview.*, and tunnels such as ngrok. The full list is in the code: LicenseClient::STAGING_PATTERNS and LicenseClient::TUNNEL_SUFFIXES in vendor/aucip/starter/src/License/LicenseClient.php.

Local hosts (localhost, *.test, *.local, 127.0.0.1 and private IPs) are free, need no licence key and make no licence calls. Admin → Licence shows "Local mode: local installs are free and need no licence key."

What if I already have 3 staging installs?

aucip.com refuses the fourth with a clear message. Deactivate one from its own Admin → Licence page, then try again. As an aucip.com server rule, a tunnel seat that has not been used for 7 days expires and frees the slot; this is decided on aucip.com, not in the script.

What happens if the licence can't be verified?

After the 14-day grace period (counted only from dates signed by aucip.com), admin settings and updates lock. Projects, files, share links, downloads and the client portal keep working.

Changelog

1.0.0

First release.

• Web and command-line installers; the web installer locks itself after install.
• Owner, staff and client guest roles; client invites and password reset.
• Projects, nested folders and per-project portal accent colours.
• Chunked, resumable uploads sized to the server's PHP limits.
• Previews for images, PDF, video posters and text.
• Share links with expiry, password (throttled), download limit and close; friendly closed and expired pages.
• Download receipts with CSV export, and an audit log.
• Local or S3-compatible storage, quotas and a maximum file size.
• Email notifications through the database queue.
• Branded portal (envelope or plain style), light and dark mode, read-only demo mode.