iLovePDF

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the PDF toolbox I actually need instead of iLovePDF: merge, split, compress, convert, rotate and sign, on my own machine, without documents leaving it.

STACK
- Node 20+ with Fastify, server-rendered HTML
- SQLite through better-sqlite3 for jobs and history
- The real work done by existing tools, each in its own container: qpdf, Ghostscript, LibreOffice, ImageMagick, tesseract for OCR
- Caddy in front

WHY THIS IS WORTH BUILDING
- Documents sent to a public converter are documents on somebody else's server. Contracts, payslips, identity documents and medical letters go through these sites every day
- Running it yourself means the file never leaves the building. That is the whole reason, and it should be written at the top of the README

THE DATA MODEL
- jobs: id, token, tool, status, options_json, created_at, finished_at, error, expires_at
- files: id, job_id, kind, original_name, stored_path, sha256, mime_detected, bytes, pages, deleted_at
- tool_runs: id, job_id, engine, argv_json, exit_code, ms, log_excerpt
- Files expire, by default within the hour, and the sweeper deletes them from disk as well as from the table. Deletion is real and the row records that it happened

THE TOOLS
- Merge, with a page ordering interface and the ability to drop pages
- Split by page range, by every N pages, by bookmark, or by a detected blank separator page
- Rotate, reorder, delete and extract pages
- Compress with a choice between a smaller file and a readable one, and a preview of both the size and a sample page. Compression on a badly made PDF is where these tools differ most — try downsampling images and re-encoding, and if the result is larger than the original, keep the original and say so
- Convert to and from office formats through LibreOffice, and to and from images
- OCR with tesseract, adding a text layer without altering the visible page, with the language chosen
- Unlock a password-protected PDF where the password is known, and add a password with permissions
- Sign: place an image or a drawn signature, flatten it, and optionally apply a document-level digital signature so later changes are detectable
- Repair a damaged file with qpdf, which fixes a surprising proportion of them
- Extract text, extract images, and fill a form

SANDBOXING, WHICH IS NOT OPTIONAL
- Every engine runs in a container with no network, a read-only root filesystem, a tmpfs for work, a memory cap, a CPU quota, a wall-clock timeout and dropped capabilities
- Non-root inside, with the input mounted read-only and only the output directory writable
- Ghostscript, ImageMagick and LibreOffice have each been remote code execution within recent memory. A PDF is a program, and you are running strangers' programs. The isolation is the requirement, not a precaution
- The type comes from the file's own content, never the extension
- Page count, file size and expansion checked before work starts, so a crafted file cannot exhaust the machine

THE INTERFACE
- One page per tool, each doing one thing, with a drop area and a download
- Progress for the slow ones, and an honest absence of progress where the engine gives none
- A page preview rendered server-side so the ordering interfaces show the actual pages
- Everything works from a phone, because half of these jobs start with a photograph of a document
- Dark and light

THE API
- The same tools over HTTP with a token, for scripting
- Upload, run, download, with the job's expiry stated in the response
- Idempotency keys so a retry does not run the job twice

BATCH
- Several files through the same tool in one job, with a zip of the results
- A queue with a concurrency cap, because this work is CPU-bound and unbounded parallelism takes the box down

PRIVACY
- A stated retention, enforced, with the countdown visible on the download page
- No document content in any log
- If it is exposed beyond your own machine, put it behind authentication — a public PDF tool on your server is a public PDF tool for everybody who finds it
- No third-party request of any kind, which is the difference from the service being replaced

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, MAX_UPLOAD_BYTES, RETENTION_MINUTES, CONTAINER_RUNTIME
- Migrations on boot, each once
- Disk watchdog that refuses new jobs rather than filling the volume
- Health endpoint that runs one tool on a one-page document
- The database is worth backing up; the files are not, because they expire by design

WHAT MATTERS MOST
The sandbox and real deletion. Build the container runner with its limits before a single tool works, and confirm a file is gone from disk when its job expires. The reason to build this instead of using the free site is that documents stay yours — and that promise is only as good as the sweeper.

Give me the repository, the container definitions, migrations, .env.example, and a README with deploy steps behind Caddy and the security assumptions stated in full.