canvas-drop

Deploy and share the small web tools your org builds, behind your sign-in.

This page is for anyone deciding whether to run canvas-drop, or wondering what it does today. By the end you know what a canvas is, what ships, what is still open, and which page to read next for your job.

canvas-drop is an open-source (MIT), self-hostable platform where signed-in members of an organization publish and share small web artifacts called canvases. A canvas is static files (HTML, CSS, JS, images). Drop them in and they are live at a URL your colleagues can open once they sign in. It is inspired by Shopify's Quick; canvas-drop is the open way to run the idea on your own infrastructure.

The constraint is the product: a small, fixed set of primitives done well, not a general-purpose hosting platform. There is no server-side build step and no secret in the page. A canvas gains backend capability only through six fixed primitives (KV, files, AI, identity, realtime, and admin-granted Connections) served by a zero-config browser SDK, and that backend stays off until the owner or an editor turns it on.

Try it

A signed-in local instance with no external services (path URLs, SQLite, local disk, dev auth). You need Node 24 or newer and pnpm:

git clone https://github.com/markpasternak/canvas-drop.git
cd canvas-drop
pnpm install
cp .env.example .env
pnpm dev
# dashboard http://localhost:5173 · server http://localhost:3000

Open http://localhost:5173, click Create canvas, choose Paste HTML, and paste an index.html. It is created and published in one step and live at http://localhost:3000/c/{slug}/. To give it a backend, switch on Enable backend in the canvas's Backend tab and add one tag to the page:

<script src="/sdk/v1.js"></script>
<script type="module">
  const me = await canvasdrop.me();
  const views = await canvasdrop.kv.increment("views");
</script>

The Quickstart walks the rest of the loop: deploy, edit, share, roll back.

For the production shape instead, docker compose up --build boots Caddy, an identity-aware proxy (oauth2-proxy) signing in against a bundled demo identity provider (Dex), Postgres, and the app in real proxy auth mode at http://localhost:8080 (sign in as demo@example.com / canvasdrop). See Self-hosting → Install.

What ships today

The administration guide covers composed sharing filters, access explanations, activity, offboarding, selected bulk actions, permanent file/data purge, and observed Connections health.

Trust posture

• Identity comes from the server-side auth context, never from the client. In proxy mode only the trusted proxy may assert it.
• Secrets stay server-side. AI provider keys, deploy keys, and Connection protected headers never reach the browser.
• The backend is off by default; each primitive is a per-canvas opt-in.
• Every canvas starts Restricted. Only its owner or an editor widens access, and Public link is gated by an instance switch plus a per-account grant on the owner.
• Your infrastructure, your data. No telemetry, no phone-home.

The security model states the threat model (a trusted org, not the hostile internet) and the tradeoffs, including path versus subdomain isolation.

Status

v1 is feature-complete. Milestones M1 through M9 (foundation, hosting and deploy, the dashboard, canvas management, the editor and version model, the five primitives and SDK, admin and hardening, the gallery, AI and realtime) are shipped, along with the post-v1 work in the table above: the access ladder, editor roles and ownership transfer, teams and auth-delegated invites, Shared discovery, the MCP server, staged uploads, custom slugs, clone-as-template, usage stats, optional screenshots and preview covers, design skins, the authoring capability, and admin-granted outbound Connections.

Ops and packaging (M10) is the only open milestone. The Docker image and compose stack, vendor-neutral deploy docs, backup/restore tooling (with an automated round-trip test on both dialects), the security review, a secret scan in CI, and the starter examples have shipped. Still deferred: a single-VPS load test and a colleague pilot behind an identity-aware proxy. canvas-drop has not yet run under a real org's load; treat it as ready to self-host and evaluate, not as battle-tested.

Not in v1: a CLI (the Deploy API, MCP server, and agent skill cover programmatic deploys), custom domains, multi-org tenancy, an audit-log viewer in the admin panel, KV change subscriptions, and realtime message history.

Where to go next

• New here? Start with the Quickstart.
• Building a canvas with a backend? Read the SDK overview.
• Sharing with colleagues or adding editors? See Sharing & access.
• Running your own instance? See Self-hosting → Install, then Configuration.
• An AI agent? Read /llms.txt, then connect over the MCP server.

Examples and URLs in these docs use {base} (your instance's base URL) and localhost placeholders. Substitute your own instance's address.