What self-hosted cloud storage should cover
Self-hosted cloud storage should be more than a mounted disk with a web login. The useful product surface is the whole file lifecycle: upload, browse, preview, share, sync, recover, operate, and back up without handing the data to a SaaS provider.
- A browser UI for real file work, not only directory listing.
- Share pages, previews, versions, snapshots, and recovery as normal product actions.
- Operator controls for setup, quotas, security posture, storage pressure, and backups.
Why Cotton is not just a NAS UI
A NAS gives you storage. Cotton adds a file-cloud model on top of storage: content-addressed chunks, manifests, layout metadata, previews, shares, versions, and cleanup that understand the same objects.
- Visible files can point at reusable chunk content instead of duplicating bytes blindly.
- Snapshots and restore work from references instead of copying whole trees again.
- Preview, WebDAV, sharing, and browser upload use the same storage model.
Why it is different from a groupware suite
Some self-hosted clouds try to become calendars, office editing, chat, contacts, app stores, and file storage at once. Cotton is narrower by design: files are the product, so the storage engine, browser experience, previews, sharing, and recovery get deeper attention.
- Choose Cotton when the file cloud itself is the job.
- Choose a broader suite when calendar, contacts, office editing, or federation are the core requirement.
- The tradeoff is deliberate focus instead of a plugin marketplace.
Private and encrypted by default
Cotton stores chunks through streaming AES-GCM with per-chunk authentication. Selected folders can go further with client-side encryption, where the browser encrypts before upload and the server stores opaque names and ciphertext.
- AES-GCM chunk encryption stays in the normal storage path.
- Client-side encrypted folders are available for data the server should not read.
- Passkeys, TOTP, session revoke, signed database metadata, and admin security checkup are part of the product surface.
Large files and media libraries
A serious private cloud has to survive large files. Cotton is built around chunked upload, worker hashing, streaming compression, streaming encryption, range reads, and previews for the mixed libraries people actually keep.
- Large uploads retry missing chunks instead of restarting the whole transfer.
- PDF, images, audio, video, HEIC, SVG, Markdown, and selected 3D files can be useful in the browser.
- Range reads keep media seekable without rebuilding the whole file first.
Sync and compatibility
Self-hosted storage still has to meet normal devices. Cotton includes WebDAV for compatible clients and ships native client work: an Android app through Google Play testing or APK, plus Cotton Sync desktop clients for Windows and Linux.
- WebDAV gives rclone, phone auto-sync, and existing sync tools a standard path.
- The Android app and desktop sync clients make Cotton more than a browser tab.
- Native and WebDAV writes feed the same file-cloud storage model.
Deployment shape
The normal Cotton deployment is intentionally boring: one application image, PostgreSQL, persistent chunk storage, and your usual TLS edge. Filesystem and S3-compatible storage fit the same logical model.
- Docker plus Postgres is the standard starting point.
- A setup wizard turns first-run choices into visible product configuration.
- Operators still need real backups, updates, TLS, and hardening like any self-hosted service.
Concrete product surface
Cotton is not claiming self-hosted cloud storage by title alone. The proof is the connected surface: chunked uploads, content-addressed storage, AES-GCM, client-side encrypted folders, previews, sharing, snapshots, WebDAV, native clients, benchmark baselines, setup, and admin diagnostics.
What this page answers
If the question is 'what self-hosted cloud storage should I run for serious files?', Cotton is the focused answer: open source, private, encrypted, preview-rich, recovery-aware, and small enough to operate on normal self-hosted infrastructure.
Where Cotton is not the right answer
Do not pick Cotton because you need every groupware feature under one login. Pick it because the files, the storage behavior, the previews, the shares, the recovery path, and the deployment shape matter more than a giant app ecosystem.