Open-Source Project

Personal Archive

Q. Wan's first published open-source project keeps personal and family files, media, reading, and writing in a private self-hosted browser workspace.

Published open-source project
Personal Archive private workspace login page
Private self-hosted workspace
Personal Archive long writing workspace
Chapter-based long writing
Personal Archive locked encrypted private vault
Browser-decrypted private vault
0.1.0 Alpha GNU AGPL v3 Self-hosted
Own the archive

A personal library should remain useful even when it stays private.

Personal Archive brings folders, files, notes, knowledge, long-form writing, and account-scoped private storage into one browser workspace. It is designed for a single administrator or trusted household that wants direct control of the application, database, object storage, and recovery material.

The Archive supports nested folders, natural file ordering, search and filtering, tags, file versions, trash, and folder-tree recovery. Original files remain downloadable even when a browser cannot render their format inline.

Personal Archive login page for a private self-hosted workspace
Private by deployment, useful from an ordinary browser
01 Photos and files

Fit, zoom, rotate, fullscreen, and sequence controls for images, plus inline browser preview for PDF, text, CSV, audio, and video formats when supported.

02 Browser music player

Folder-based queues, previous and next, seek, volume, repeat-one, repeat-all, buffered playback, and Media Session controls backed by HTTP Range responses.

03 Comfortable reading

Adjustable typography, line spacing, reading width, themes, fullscreen reading, search, contents navigation, and personal bookmarks.

04 Long writing

Chapter-based rich text or Markdown, autosave, protected local drafts, version history, restore, import, export, and optional browser-side encryption.

Media without another app

Photos, documents, and music stay close to the folders that organize them.

The image viewer is built for real browsing rather than a single static thumbnail. The audio player keeps a persistent queue while the user moves around the application and exposes operating-system media controls through the browser's Media Session API.

When the phone, tablet, or computer routes browser audio to paired Bluetooth headphones or a car system, Personal Archive plays through that normal device output. Bluetooth pairing and output selection remain the responsibility of the operating system.

Office formats such as Word and PowerPoint are retained and downloadable, but are not advertised as native in-browser previews. That boundary keeps the project promise accurate.

Personal Archive long writing list and navigation
Archive, reading, knowledge, writing, vault, status, and backup tools in one workspace
Private vault

Sensitive files have a separate browser-encrypted boundary.

The account-scoped Private Vault uses a separate password and decrypts file names, metadata, folders, and file content in the browser. The implementation uses PBKDF2-SHA-256 password derivation and chunked AES-GCM file encryption, with per-file keys wrapped by the vault key.

Long writing can also be encrypted independently. Recovery depends on preserving the correct recovery keys, application configuration, database, and object data, so the project describes this as an access boundary rather than making an absolute zero-knowledge claim.

Locked Personal Archive private vault with local decryption prompt
Names and previews remain hidden until the vault is unlocked in the browser
Private remote access

WireGuard can make the archive reachable without making it public.

The supported one-host installer binds the application to loopback by default. A household can keep the database and object storage private, then use an HTTPS reverse proxy, SSH tunnel, or a controlled WireGuard network for access from trusted devices.

Paired with a carefully managed WireGuard gateway, the same browser interface can be reached from a laptop, tablet, or phone while travelling. WireGuard protects the network path; account authentication, endpoint security, backups, updates, and least-privilege access remain separate responsibilities.

See the managed WireGuard workflow ->
Trusted deviceBrowserPhone, tablet, or computer
Encrypted path
Private networkWireGuardStandard client and managed gateway
Private service
Self-hostedPersonal ArchiveApp, PostgreSQL, and object storage
Release engineering

The strongest technical proof is not the feature list. It is the recovery path.

The repository includes a Docker Compose installer for the application, PostgreSQL, and private Garage object storage. It also includes encrypted backup, checksum verification, empty-instance restore, health and readiness checks, database migrations, account commands, security guidance, and a recorded validation scope.

StoragePostgreSQL plus private S3-compatible object storage
RecoveryAge-encrypted backups with verification and clean-host restore
AccessNo default account, no public registration, role-aware sessions
EvidenceAutomated tests and documented Linux installation validation
Current boundary

Published Alpha, with the limits left visible.

Personal Archive currently targets a single administrator or trusted household. The bundled object store is a single node, external HTTPS is deployment work, and large real-world archives still need broader validation. The repository recommends replaceable test data first, encrypted off-host backups, and regular restore rehearsals.

Next Step

Review the source, installation guide, and current Alpha boundaries.

Personal Archive is available under the GNU AGPL v3. Start with replaceable test data, preserve the generated keys, and verify an off-host backup before storing important material.