OpenList is a feature-rich directory listing tool that supports mounting dozens of cloud drives with file preview, download, sharing and more

This repository is the official TypeScript + Serverless port of OpenListTeam/OpenList

Runs on Cloudflare Workers / EdgeOne Cloud Function / Alibaba Cloud ESA

📘 Docs · 🌏 Docs (China mainland) · ⚖️ Terms of use · 🔒 Privacy policy

Upstream project · Contributing · Code of conduct · License

🌎 Global Demo 　|　 🇨🇳 China Demo

---

One-click Deploy

Click the button below to deploy this project to the corresponding platform with one click:

EdgeOne Makers · International	EdgeOne Makers · China	Cloudflare Workers · Global	Alibaba Cloud ESA · China

Important

• If Cloudflare prompts cannot fetch repository content, Fork this project first, then deploy by connecting to the GitHub repository
• For Alibaba Cloud ESA, import this repository from Edge Computing and AI → Functions and Pages in the console
• Set JWT_SECRET during deployment (≥16 random chars) for JWT signing and encryption
• Storage automatically uses the platform's built-in persistent backend (DB_DRIVER=auto) — no configuration needed; for other variables see Environment Variables
• After deployment, the first visit opens the install wizard: set the admin account and password in the browser to finish initialization; set ADMIN_PASS to skip the wizard

Features

OpenList is a multi-storage aggregation file listing and management system running on edge computing platforms. It unifies files scattered across different cloud drives, object storage and protocol services into a single interface for browsing, previewing, downloading and managing.

OpenList-Worker is the official TypeScript + Serverless port of OpenListTeam/OpenList. The backend has been rewritten from Go to a TypeScript service running on Workers, while the frontend keeps a consistent interface and interaction experience.

Storage Aggregation

Built-in 78 storage drivers, ready to mount various storage backends out of the box:

• Domestic cloud drives: Aliyundrive (Open/Share), Quark (Open/UC TV), Baidu Netdisk (Album), 115 (Open/Share), 123 Pan (Open/Share), Tianyi Cloud (189/PC/TV), China Mobile Cloud (139/Hecaiyun), Wopan, Thunder, Tencent Weiyun, Lanzou, PikPak (Share), Doubao, Guangyapan, Chaoxing Group, Lenovo NAS Share, Teambition, WPS Cloud, Alibaba Docs, HalalCloud, MediaTrack, etc.
• International cloud drives: Google Drive (Album), OneDrive (App/ShareLink), Dropbox, MEGA, MediaFire, Proton Drive, Yandex Disk, Degoo, Bunny Storage, TeraBox, etc.
• Object storage: S3-compatible (AWS/OSS/COS/MinIO, etc.), Cloudflare R2 (Workers binding or S3 API), UpYun USS, Azure Blob, WebDAV, FTP, SFTP, SMB, IPFS, etc.
• Code hosting: GitHub, GitHub Releases, CNB Releases
• Cloud drive programs: OpenList (Share), AList V3, Cloudreve V3/V4, Kodbox, Seafile, Teldrive, Febbox, etc.
• Other drivers: Netease Music, Misskey, Emby, Cloudflare Image Hosting, etc.

In addition to the real storages above, virtual/functional drivers such as Local, Alias, UrlTree, AutoIndex, Strm, Crypt, Virtual and Chunk are also provided for local mounts, address aliases, URL lists, encrypted storage and chunking scenarios.

Core Capabilities

• File management: unified directory tree browsing with online preview for images, videos, audio, documents, code and archives; cross-storage upload, batch download, streaming and direct-link redirect; share links with expiry, password and permission control.
• Search & tasks: full-text search across indexed storages; background task queue for batch and async processing.
• External interfaces: WebDAV, S3-compatible protocol, and an MCP endpoint for AI assistants.
• Guest access: fresh installs require sign-in by default (the guest account is disabled). To allow anonymous read-only browsing, enable the guest user; existing deployments keep their current behavior. Anonymous access is controlled solely by the guest account state (same as the Go backend) — there is no extra site setting, and it is not a Cloudflare environment variable.
• Access & auth: RBAC (user groups, directory-level read/write permissions, quotas), account passwords plus TOTP / WebAuthn / SSO / LDAP.
• Security & ops: JWT sessions, CSRF, clickjacking (X-Frame-Options) and CSP protection, /health and /healthz probes.
• Concurrency deduplication: identical directory listing / metadata requests hit the upstream drive only once; the rest reuse the result, reducing rate limits and CPU usage.
• Runtime platforms: Cloudflare Workers, Tencent Cloud EdgeOne Makers, Alibaba Cloud ESA, Vercel / AWS Lambda and Node.js containers.
• Data storage: Cloudflare D1 (SQLite) as primary, plus KV / Blob / Durable Objects and external MySQL / MariaDB.
• One-click deploy: EdgeOne, Cloudflare Workers and Alibaba Cloud ESA deploy buttons + install wizard.

---

Manual Deployment

Expand prerequisites, local development and production deployment

Prerequisites

• Node.js 18+ (pnpm recommended)
• A Cloudflare account (for deploying to Workers)

Local Development

# 1. Install dependencies
pnpm install

# 2. Configure bindings and variables in wrangler.jsonc as needed (see .dev.vars.example for JWT_SECRET)

# 3. Start the dev server (auto-fetches the official frontend and runs the Worker)
pnpm run dev:unified

# Or run the Worker only (without fetching the frontend)
pnpm run dev:worker

Production Deployment

# One-click deploy: build the frontend → deploy to Cloudflare Workers (KV bindings are provisioned automatically by wrangler)
pnpm run deploy

# Or deploy the Worker directly (skip the frontend build)
pnpm run deploy:worker

---

Tech Stack

Backend

• Runtime: Cloudflare Workers / EdgeOne Functions / Alibaba Cloud ESA (Edge Computing)
• Web framework: Hono.js
• Database: Cloudflare D1 (SQLite) / KV / Blob / Durable Objects, or external MySQL / MariaDB
• Language: TypeScript
• Build tools: Wrangler, esbuild

Frontend

• Framework: SolidJS + TypeScript (official OpenList-Frontend)
• UI library: Hope UI
• Build tool: Vite

---

Deployment Configuration

After deployment, set the following variables:

Variable	Default	Description
JWT_SECRET	(none)	JWT signing key (≥16 chars)
DB_FORMAT	map	map (JSON) / key (per key) / sql (relational)
DB_DRIVER	auto	auto / blob / cfkv / kv / d1 / do / mysql
DB_CIPHER	none	At-rest cipher for sensitive fields, e.g. aes-256-gcm

For the full variable list, see Configuration variables.

Support

If you run into any issues, help is available through the following channels:

• 🐛 Bug reports or feature requests: please visit Issues
• 💬 General questions and discussion: please visit the Discussions forum

License

OpenList is open-source software licensed under AGPL-3.0.

Contact

🌐 @GitHub · ✈️ Telegram group · ✈️ Telegram channel

Contributors

Thanks to the following projects and their contributors:

• The author and all contributors of Alist
• The author and all contributors of OpenList (Go version)
• All contributors of this project: