fix

HOSTING.md

@@ -62,7 +62,8 @@ Relevant variables:
 HOST=127.0.0.1              # bind loopback only; the proxy talks to it
 PORT=3000
 STORAGE_DIR=/opt/filehost/storage
-MAX_FILE_SIZE=5GB           # must be <= proxy upload limit
+MAX_FILE_SIZE=10GB          # must be <= proxy upload limit
+FILE_TTL_MS=604800000       # expire files after 1 week
 RATE_LIMIT_ENABLED=1
 TRUST_PROXY=1               # proxy sets X-Forwarded-For
 ```
@@ -116,7 +117,7 @@ server {
     }
 
     location / {
-        client_max_body_size 6g;          # >= MAX_FILE_SIZE
+        client_max_body_size 11g;          # >= MAX_FILE_SIZE
         proxy_request_buffering off;      # stream uploads (critical for large files)
         proxy_http_version 1.1;
 
@@ -170,7 +171,8 @@ If you proxy through Cloudflare:
 - Set the DNS record to **Proxied**.
 - Uploads/downloads are subject to Cloudflare's size caps (free plan ~100MB).
   For larger files, add a **Cache rule** or **Origin rule** that bypasses
-  Cloudflare for `/api/upload` and `/d/*` so traffic hits your origin directly.
+  Cloudflare for `/api/upload` and `/*` (or at least the share links) so traffic
+  hits your origin directly.
 - Enable `TRUST_PROXY=1`; the app reads `CF-Connecting-IP` as the client IP.
 
 ## 9. Verification
@@ -245,5 +247,6 @@ Files in `storage/` are untouched by updates and keep working.
   short-lived HMAC-signed cookie (server secret in `storage/.secret`).
 - Rate limiting protects the keyed endpoints; `TRUST_PROXY=1` must only be set
   when a proxy really sets `X-Forwarded-For`/`CF-Connecting-IP`.
-- Files never expire. Deletion requires possession of the key
+- Files auto-expire after one week (configurable via `FILE_TTL_MS`) and are
+  swept hourly. Deletion also requires possession of the key
   (`DELETE /api/files/:id` with `X-Delete-Key`).