Self-hosting large media transfers with OpenMediaVault and Cloudflare Tunnels

A recent technical guide outlines a method for sharing large media files using self-hosted infrastructure instead of commercial cloud storage. The author, working on video projects for small theatre companies, configured OpenMediaVault with FileBrowser Quantum and Cloudflare Tunnels to handle multi-terabyte datasets securely.

What happened

The project began with a practical challenge: transferring massive amounts of raw video and photo data from a local server to clients. One production involved two 3-hour shows recorded in 4K ProRes 422 HQ, totaling approximately 1.6TB, plus 600 Fuji RAW files adding another 10GB. After editing, the final deliverables shrank to about 80GB of H.265 renders and 4GB of stills, but the need to share raw footage remained. Traditional cloud services like Google Drive or Dropbox proved insufficient due to free tier limits and the high cost of expanding storage for such large volumes.

To solve this, the author utilized a Dell R730xd server running ESXi. The setup involved installing OpenMediaVault (OMV) on a virtual machine to manage a 12TB hard drive pool. The system was configured with specific shared folders for Docker applications, file shares, and media storage. Network access was enabled via SMB, allowing files to be moved from editing workstations to the server efficiently. The author emphasized separating data physically, using one drive for main storage and another for Docker configurations, though a single pool with logical separation is also viable.

The core of the solution relies on FileBrowser Quantum, a web-based file manager, exposed securely to the internet using Cloudflare Zero Trust Tunnels. This approach avoids opening ports on the local router while providing HTTPS encryption. The tunnel configuration restricts external access to only the public sharing paths, preventing unauthorized users from reaching the login page or administrative interfaces. This setup allows the generation of password-protected, time-limited links for clients to download specific files directly from the local server.

Key details

• The workflow handles initial raw data of roughly 1.6TB for video and 10GB for photos before editing reduces it to ~80GB.
• OpenMediaVault is installed on a Debian-based VM within an ESXi environment, managing storage via RAID or individual disks.
• Docker and omv-extras plugins are installed to manage containers, specifically using compose files for deployment.
• Cloudflare Tunnels provide secure external access without port forwarding, restricting public visibility to specific URL paths.
• FileBrowser Quantum runs in a container with read-only mounts for shared directories to prevent accidental deletion.
• Shared links can be configured with expiration dates and passwords, mimicking features found in paid cloud services.

Background

OpenMediaVault is a popular network attached storage (NAS) solution based on Debian Linux. It provides a web interface for managing hard drives, creating shared folders, and setting up services like SMB or NFS for file transfer. For users comfortable with Linux, it offers more control than consumer-grade NAS devices, allowing for custom hardware use and extensive plugin support.

Cloudflare Tunnels, part of the Zero Trust suite, create a secure outbound connection from a local server to Cloudflare’s edge network. This eliminates the need for static IP addresses or port forwarding on home or office routers, which are common security risks. By routing traffic through Cloudflare, the server remains hidden from direct internet scans, and all traffic is encrypted via HTTPS, even if the internal service uses plain HTTP.

Why it matters

For teams managing large media assets, relying on third-party cloud storage can become prohibitively expensive. Transferring terabytes of data often requires enterprise-level subscriptions, whereas self-hosting leverages existing hardware investments. This approach gives organizations full control over their data lifecycle, ensuring that raw footage and sensitive project files remain on-premises until explicitly shared.

Security is another critical factor. By using tunnels and restricting access to specific paths, administrators can mitigate the risk of brute-force attacks on login pages. The ability to generate ephemeral links with passwords adds a layer of security similar to enterprise content delivery networks, but without the recurring monthly fees. This model is particularly relevant for small studios or freelance teams that need professional-grade delivery mechanisms without the overhead of corporate IT contracts.

What you can do

• Evaluate your current storage costs and compare them against the one-time expense of building a local NAS with used enterprise hardware.
• Install OpenMediaVault on a spare machine or VM to test its interface and file management capabilities before migrating production data.
• Set up a Cloudflare account and configure a Zero Trust Tunnel to experiment with exposing local services securely without port forwarding.
• Use Docker Compose to deploy FileBrowser or similar lightweight file managers, ensuring you mount volumes as read-only where appropriate.
• Implement strict access controls by limiting tunnel paths to public sharing directories, keeping administrative interfaces accessible only locally.
• Test link generation with expiration and password features to ensure clients can access files easily while maintaining security standards.