System Design

BaySpace is a self-hosted, anonymous file transfer service. A visitor uploads a file, receives a short share link, and the file is automatically purged after a fixed retention window. There are no user accounts on the public side — access to any file is governed entirely by possession of its link.

• A file is submitted via POST /upload, validated for presence and a maximum size.
• The original filename is preserved as metadata only; the file on disk is renamed to a 40-character random token.
• A record is created with an 8-character, lowercase, collision-checked identifier — this is the public UUID used in share links, unrelated to the internal database id.
• Uploaded bytes are written outside the public web root, so no file is ever reachable by guessing or listing a directory.

Every record is stamped with an expiry of 24 hours from upload. Requests for an expired link receive an HTTP 410 response rather than a stale download. Separately, a scheduled command (files:clean) runs on an hourly cadence, physically deleting expired files from disk and their corresponding database rows — so expiry is enforced both at request time and at rest.

There is no listing endpoint, index, or search. A file's only address is its share link (/file/{uuid}) or direct download link (/download/{uuid}). The identifier space is large enough, and unrelated enough to upload order, that links cannot be feasibly enumerated. An internal admin panel — gated behind a separate authenticated guard — allows an operator to search records and remove a file ahead of its natural expiry, for abuse or takedown handling.

• Files are not end-to-end encrypted; confidentiality in transit depends on TLS being terminated correctly by the host server.
• Storage is a single local filesystem, not a distributed or redundant backend — durability is intentionally traded for simplicity.
• There is no automated malware scanning of uploaded content.
• This is a small, self-hosted tool, not a compliance-audited storage platform — treat it accordingly.

Laravel (PHP) on the backend, a relational store for file metadata, the local filesystem for binary storage, and a dependency-free vanilla JavaScript frontend — no build step required to run it.