Everlock One server for your digital life

Documentation

Last updated: 2026-08-26

Getting started: Files backend

This guide runs Everlock as a network drive and mounts it from your desktop:

  • start Everlock with one file share on localhost
  • create a user and grant it access
  • mount the share in Finder, Windows Explorer, or a Linux file manager
  • drop a file in and see it in the store's history

The share speaks WebDAV, so the file manager you already have is the client — no app to install.

1. Start Everlock with the files backend enabled

The two parts that trip people up:

  • --backend-files-http enables the backend. On its own, --backend-files-http-vhost only names the share — without the enable flag the backend never starts and you only get the admin SSH surface.
  • All runtime flags go after the serve subcommand. A bare everlock --backend-files-http-... fails with unexpected argument.

Grab the binary for your platform from the download page, then start Everlock with one share on localhost:

./everlock serve \
  --backend-files-http \
  --backend-files-http-vhost localhost \
  --backend-files-http-store everlock-files-local \
  --admin-user admin \
  --admin-password change-me

What this does:

  • starts Everlock with the HTTP frontend on its default 0.0.0.0:8080 (auto-enabled because an HTTP backend is on)
  • serves one share named default at http://localhost:8080/dav/
  • keeps its files in the everlock-files-local Everlock store
  • bootstraps an admin user for the SSH admin console

2. Open the admin console

Connect over SSH:

ssh -p 2222 admin@localhost

Enter the bootstrap password (change-me) and you land in the admin REPL:

Everlock Admin
>

3. Create a user and grant it the share

/users create alice change-me
/users grant alice http/files/default writer

What the roles mean on a share:

  • reader — browse and download (PROPFIND, GET, HEAD)
  • writer — everything a file manager does: upload, rename, delete, lock
  • owner — the same as writer here, plus ownership of the access path

The share created by --backend-files-http-vhost is named default, so its access path is http/files/default. A share is private until somebody is granted on it — creating one opens nothing.

You can manage shares from the console too:

/files list                                       list shares and their URLs
/files create team store=team-files vhost=files.example.com
/files set team mount=/share                      serve it under /share
/files unset team vhost=old.example.com           stop serving a vhost
/files delete team                                stop serving (store kept)

4. Mount the share

The address is the vhost, the mount path, and a trailing slash: http://localhost:8080/dav/.

macOS Finder

Go → Connect to Server (⌘K), then:

http://localhost:8080/dav/

Sign in as alice with change-me. The share appears in the sidebar and behaves like any other volume.

Linux (GNOME Files, Dolphin)

Other Locations → Connect to Server, or from a terminal:

gio mount dav://localhost:8080/dav/

Dolphin uses the same address with webdav://.

Windows Explorer

Windows' built-in client sends Basic credentials over HTTPS only, so map the share from an HTTPS address — This PC → Map network drive, then:

https://files.example.com/dav/

Step 6 below puts the share on such an address. For the plain-HTTP localhost one used here, a third-party client mounts it as it stands: Cyberduck, WinSCP, and RaiDrive all do.

From the command line

curl -u alice:change-me -T notes.txt http://localhost:8080/dav/notes.txt
curl -u alice:change-me http://localhost:8080/dav/notes.txt

5. See what the share kept

Drop a file into the mounted drive. A share is a versioned store, and a store is a Git repository — so the history is there to clone:

/users grant alice ssh/git/everlock-files-local reader

git clone ssh://alice@localhost:2222/everlock-files-local.git files-history
cd files-history
git log --oneline

a1b2c3d write notes.txt
9f8e7dc reports is no longer empty
4d5c6ba create collection reports

Every request that changed something is one commit. Editing the file from the file manager and saving again adds another, with the previous version still readable at the earlier commit:

git show 9f8e7dc:notes.txt

6. Going further

Serve it on a real name. Point a domain at the host, open ports 80 and 443, and Everlock requests a certificate over ACME:

./everlock serve \
  --frontend-http-listen-http 0.0.0.0:80 \
  --frontend-http-listen-https 0.0.0.0:443 \
  --backend-files-http \
  --backend-files-http-vhost files.example.com \
  --backend-files-http-store team-files \
  --admin-user admin \
  --admin-password change-me

Every client above — Windows Explorer included — mounts an HTTPS share.

Serve it on the LAN. A .local vhost is announced over mDNS as _webdav._tcp — the service type file managers browse for when they list network shares — so the share can be reached without anyone typing a URL.

Share it with a team. Grant a group instead of a person:

/groups create staff
/groups assign staff alice
/groups grant staff http/files/team writer
files webdav dav getting-started