RookFile from Linux (CLI)

Create a one-hour room from the shell, upload logs or configs, and share the link with someone in a browser — no Dropbox required.

RookFile at rookvpn.com/file is built for quick browser handoffs. The headless CLI does the same from a Linux box: create a room, upload a file or paste shared text, print the URL and 5-digit code for a colleague to open.

When to use it

Ship a log excerpt, config snippet, or tarball from a server without opening SFTP to every recipient.
Pair with the browser room: you push from curl, they download from the session UI.
Sessions expire in about one hour — not archival storage. Recipients should save locally before the room closes.

See encrypted file sessions for how browser E2EE and session links work.

First run: legacy or end-to-end

The script rookfile-cli.sh (in the RookFile open-source tree) asks once:

Legacy — curl and bash only. The service can read file and text contents during the session (same idea as a non-E2EE browser room).
End-to-end — if Node.js 20+ is missing, the script installs it, then encrypts on your machine before upload (same AES-GCM protocol as the browser).

Your choice is saved locally so later upload and text commands do not ask again. Run rookfile-cli.sh crypto to change the preference.

Operator setup (not in the public SPA)

Headless create uses a shared secret the server operator configures as ROOKFILE_CLI_SECRET in the RookFile server environment. You export the same value on the Linux machine:

export ROOKFILE_CLI_SECRET='<from-your-operator>'
export ROOKFILE_BASE_URL='https://rookvpn.com/file'

Never put the secret on the command line (shell history and ps expose it). Use the environment or a root-only env file.

Commands

Command	Purpose
`create`	New room; prints URL, code, expiry
`upload <file>`	Upload (small or chunked above ~8 MB)
`text <message>`	Set shared text (`text -` reads stdin)
`url`	Reprint URL and code
`invite`	E2EE only: wrap session key for a browser peer already in the room
`crypto`	Re-ask legacy vs E2EE

Non-interactive / cron: set ROOKFILE_CRYPTO=legacy or e2ee. For E2EE without a TTY, set ROOKFILE_INSTALL=1 so Node may be installed automatically.

E2EE and browser peers

If you chose end-to-end, the AES session key stays on the Linux machine. When someone joins in the browser, run rookfile-cli.sh invite (or create with --wait-peer) so they receive the key through RookFile’s normal invite flow. Do not paste the raw session key next to the room URL.

RookFile encrypted sessions — session model and browser E2EE
Check public IP via curl — terminal HTTP basics on Linux
RookSecret one-time secrets — short text only, burn-after-read

Check the result

Run create, upload a harmless test file, open the printed URL in a private window, and confirm the file and text appear. Then run your real upload. If you used E2EE, confirm the browser peer can decrypt after invite.