shortr

What it does

Install

docker run -d --name shortr \
  -p 8080:8080 \
  dawidzbinski/shortr:latest

docker run -d --name shortr \
  -p 8080:8080 \
  -v shortr-data:/data \
  -e URL_PERSISTER=file \
  dawidzbinski/shortr:latest

services:
    shortr:
        image: dawidzbinski/shortr:latest
        restart: unless-stopped
        ports:
            - '8080:8080'
        environment:
            BASE_URL: https://s.example.com
            URL_PERSISTER: redis
            REDIS_HOST: redis
            REDIS_PORT: '6379'
            REDIS_USER: default
            REDIS_PASSWORD: change-me
        depends_on:
            redis:
                condition: service_healthy

    redis:
        image: redis:8-alpine
        restart: unless-stopped
        command: ['redis-server', '--requirepass', 'change-me', '--appendonly', 'yes']
        volumes:
            - redis-data:/data
        healthcheck:
            test: ['CMD', 'redis-cli', '-a', 'change-me', 'ping']
            interval: 5s
            timeout: 3s
            retries: 20

volumes:
    redis-data:

Self-hosting

Pin 1 to take fixes and features but approve majors yourself.

Configuration

Every setting is an environment variable read at startup. An invalid value aborts the start with an error naming the variable; an empty one falls back to the default.

API

curl -X POST http://localhost:8080/api/shorten \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com/a-rather-long-link"}'

{
  "code": "aB3xY7kQ1mZp",
  "shortUrl": "http://localhost:8080/aB3xY7kQ1mZp",
  "expiresAt": "2026-10-05T12:00:00Z"
}

Client

One page, two modes — Shorten URL and QR code. No external requests at runtime.

• Mode is a tablist stored in localStorage under shortr.mode. Roving tabindex: Left and Right move, Home and End jump to the ends.
• Result is copied the moment it appears — the short URL as text, the QR as a PNG through ClipboardItem. Clicking it copies again.
• Expiry sits under the link, built from expiresAt: Expires in 30 days · 4 Oct 2026.
• Errors render in a role="alert" element, status code first; a 429 shows the seconds to wait.
• Fonts are self-hosted woff2 under /assets/, so nothing is fetched from a CDN.

Security

• Codes are 12 characters of [0-9A-Za-z] from crypto/rand without modulo bias — around 71 bits, so links cannot be enumerated.
• Everything expires after URL_TTL. Redis expires its own keys; the memory and file adapters check expiry on every read and sweep the expired ones in the background.
• Not indexable — X-Robots-Tag: noindex, nofollow, noarchive on every response, a robots.txt that disallows everything, and 403 for known crawler user agents. Redirects and /healthz stay open.
• Headers — strict CSP (default-src 'self', no inline scripts or styles, frame-ancestors 'none'), nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer.
• Input limits — URLs capped at URL_MAX_LENGTH, bodies at that plus 1024 bytes. URLs with whitespace, control characters or embedded credentials are rejected.
• Rate limiting is a fixed window per client IP on /api only; redirects are never limited.

Technical

A Go 1.27 API on Fiber v3 serves the JSON endpoints, the redirects and a plain TypeScript client bundled by esbuild — one binary, one image.

• Image — gcr.io/distroless/static-debian12:nonroot: no shell, no package manager, no toolchain. Just the static binary and the client in /srv/client.
• Storage sits behind one interface — SaveURL, FindURL, Ping, Close. A new backend touches adapters/<name>.go, its test and one case in adapters.New, and reads its own environment variables.
• Development runs entirely in Docker: task project:start brings up the API with hot reload, the client watcher and Redis. task project:test, task project:lint and task project:e2e do the rest.
• Releases are automatic — every commit on main that passes CI is tagged and pushed to Docker Hub, with the version taken from the commit subjects.

Full details in the README.