Zum Inhalt

Self-Hosting Cloud Storage: Seafile on Debian Linux (Content-Defined Chunking, C Core & E2EE)

Executive Summary: While Nextcloud is a comprehensive PHP groupware suite (combining files, calendars, contacts, and apps), Seafile is a purpose-built, ultra-high-performance file synchronization and virtual drive engine whose core data transfer daemon (seaf-server) is written in compiled C. By splitting files into Content-Defined Variable-Size Chunks (CDC) tracked in a Git-like Merkle commit tree (fs/ and blocks/), Seafile synchronizes 100,000 small source files or multi-gigabyte VM images 5× to 10× faster than WebDAV while supporting client-side End-to-End Encrypted (E2EE) Libraries.

  • C-Powered Chunk Deduplication

    Modify 4 KB inside a 2 GB file and Seafile transmits only the changed content-defined block over the wire (delta sync).

  • Client-Side E2EE Libraries

    Encrypt sensitive libraries with AES-256 directly on the client device so the server never sees your plaintext passphrase or filenames.

  • SeaDrive Virtual FUSE Mount

    Access a 10 TB server library seamlessly on a 256 GB laptop via SeaDrive—streaming file blocks on demand without syncing the whole disk.

  • Git-Style Snapshot Rollback

    Every library state is an immutable Merkle root commit—allowing instant 1-click library rollback after accidental deletion or ransomware.

1. How Seafile's Git-Like Block Storage Works

Unlike WebDAV servers that store files directly as flat paths on disk and issue a separate HTTP request per file, Seafile models every Library (Repo) like a Git repository optimized for binary files:

%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    FILE["📄 Large File (2 GB)<br/>Modified in 1 Place"]
    CDC["✂️ Content-Defined Slicer<br/>(Rabin Fingerprint CDC)<br/>1 MB - 8 MB Variable Blocks"]
    DEDUP["🔍 SHA-1 / SHA-256 Dedupe<br/>Only Uploads Changed<br/>Chunk #42 Over Network!"]
    STORE["🗄️ /opt/seafile-data<br/>commits/ + fs/ + blocks/<br/>(Immutable Snapshot Tree)"]

    FILE --> CDC
    CDC --> DEDUP
    DEDUP ==> STORE

2. Production Container Stack (compose.yaml with MariaDB & Memcached)

Deploy Seafile Community Edition (seafileltd/seafile-mc:11.0-latest) backed by MariaDB 11 and Memcached (for in-memory session and metadata caching):

# File: /srv/containers/seafile/compose.yaml
services:
  seafile:
    image: docker.io/seafileltd/seafile-mc:11.0-latest
    container_name: seafile
    depends_on:
      - seafile-db
      - seafile-memcached
    restart: unless-stopped
    ports:
      - "127.0.0.1:8082:80/tcp"
    environment:
      - DB_HOST=seafile-db
      - DB_ROOT_PASSWD=${SEAFILE_DB_ROOT_PASSWORD}
      - TIME_ZONE=Europe/Berlin
      - SEAFILE_ADMIN_EMAIL=nejat.hakan@googlemail.com
      - SEAFILE_ADMIN_PASSWORD=${SEAFILE_ADMIN_PASSWORD}
      - SEAFILE_SERVER_LETSENCRYPT=false
      - SEAFILE_SERVER_HOSTNAME=seafile.nejat-hakan.de
    volumes:
      - /srv/containers/seafile/data:/shared:rw

  seafile-memcached:
    image: docker.io/library/memcached:1.6-alpine
    container_name: seafile-memcached
    restart: unless-stopped
    entrypoint: memcached -m 256

  seafile-db:
    image: docker.io/library/mariadb:11
    container_name: seafile-db
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${SEAFILE_DB_ROOT_PASSWORD}
      - MYSQL_LOG_CONSOLE=true
      - MARIADB_AUTO_UPGRADE=1
    volumes:
      - /srv/containers/seafile/mysql:/var/lib/mysql:rw

Post-Start Configuration (SERVICE_URL & FILE_SERVER_ROOT)

When running behind a TLS reverse proxy (https://seafile.nejat-hakan.de), ensure /srv/containers/seafile/data/seafile/conf/seahub_settings.py contains the exact https:// URLs and trusted CSRF origin:

# File: /srv/containers/seafile/data/seafile/conf/seahub_settings.py
SERVICE_URL = "https://seafile.nejat-hakan.de"
FILE_SERVER_ROOT = "https://seafile.nejat-hakan.de/seafhttp"
CSRF_TRUSTED_ORIGINS = ["https://seafile.nejat-hakan.de"]

3. Maintenance: Running Garbage Collection (seaf-gc.sh) & Integrity Checks (seaf-fsck.sh)

Because Seafile stores historical blocks immutably for snapshot rollback, deleting a file in the UI only removes its pointer from the latest commit. To physically reclaim disk space from expired history blocks, run the Seafile Garbage Collector (seaf-gc.sh) periodically:

# File: /opt/seafile-ops/run_seafile_gc.sh
#!/usr/bin/env bash
set -euo pipefail

# 1. Verify block and commit tree integrity across all libraries (online check)
docker exec -it seafile /scripts/gc.sh --dry-run

# 2. Run actual garbage collection to purge unreferenced blocks from disk
docker exec -it seafile /scripts/gc.sh

Where to Go Next

Compare Seafile with Nextcloud groupware, Collabora/OnlyOffice integration, and off-site backups:

  • Nextcloud All-in-One Groupware

    Compare Seafile's pure C sync speed with Nextcloud's integrated Calendar (CalDAV), Contacts (CardDAV), and apps.

    Nextcloud Guide

  • OnlyOffice Docs Backend

    Connect Seafile or Nextcloud to a self-hosted OnlyOffice Docs server for real-time browser document editing.

    OnlyOffice Guide

  • Restic Encrypted Backups

    Back up /srv/containers/seafile/data and MariaDB dumps to off-site S3 or SFTP storage with Restic.

    Restic Guide