VaultDrop

VaultDrop is an offline file-exchange appliance for Raspberry Pi that stores files inside VeraCrypt containers (.hc) and serves a local web interface over an isolated access point.

It is designed for environments where internet access is not required and data should remain encrypted at rest on the device.

Security Model

Data at rest

• Uploaded files are written into VeraCrypt containers created on the appliance.
• Containers use VeraCrypt defaults (AES + SHA-512).
• Container files are stored under /var/lib/vaultdrop/containers by default.
• Temporary staged plaintext files are securely deleted with BleachBit after import.
• Admin and download credentials are stored hashed (not plain text) in config.

Data in transfer

• VaultDrop currently serves UI/API over HTTP on the local appliance network.
• Upload traffic from client to appliance is not TLS-encrypted on the network link.
• Downloaded artifacts are encrypted VeraCrypt containers (.hc), so exported files remain encrypted at rest after transfer.

Recommended operational controls for secure transfer use:

• Run VaultDrop on an isolated AP/network.
• Use strong Wi-Fi passphrases and rotate them.
• Treat the local wireless segment as trusted/controlled infrastructure.
• Do not expose the appliance interface to untrusted routed networks.

Supported Hardware

VaultDrop is validated for 64-bit ARM (arm64) Raspberry Pi targets, including:

• Raspberry Pi (64-bit OS)
• Raspberry Pi Zero 2 W (64-bit OS)

Core Features

• Upload workflow and download workflow are separated.
• Upload users cannot browse existing containers.
• Download listing is protected by a download password.
• Admin console is protected by a separate admin password.
• Captive-portal style local redirection for AP clients.
• Per-file and bulk secure delete operations via BleachBit.

Default Access

• SSID: VaultDrop
• Wi-Fi password: changeme12345
• URL: http://192.168.5.1
• Download password: download
• Admin password: admin

On first admin login, update admin password, SSID, and Wi-Fi password.

Accessing The Upload Portal

To open the upload portal:

1. Connect a client device to the VaultDrop Wi-Fi SSID.
2. Open a browser and go to http://192.168.5.1.
3. Use the Upload panel on the main page.

The upload portal is the same main UI page and does not require download or admin login.

Install

Build package

cd /home/user/VaultDrop-dev
npm install
npm --prefix client install
npm run build:deb

Package output:

dist/deb/vaultdrop_1.0.0_arm64.deb

Install package

sudo apt install ./dist/deb/vaultdrop_1.0.0_arm64.deb

Runtime Services

• vaultdrop.service
• vaultdrop-ap.service
• vaultdrop-dnsmasq.service
• vaultdrop-hostapd.service
• nginx.service

Health checks:

systemctl is-active vaultdrop.service vaultdrop-ap.service vaultdrop-dnsmasq.service vaultdrop-hostapd.service nginx.service
curl -s http://127.0.0.1:8080/api/health

UI Screenshots

Home

Upload Panel

Download Panel

Admin Console

License

This project is licensed under the MIT License. See LICENSE.