0-RTT/telegraph: A Cloudflare Worker image, video and file host backed by Telegram

What problem 0-RTT/telegraph solves

0-RTT/telegraph is a serverless image, video and file host based on Cloudflare Workers and Pages plus the Telegram Bot API. It stores media through Telegram and keeps a mapping between URLs and Telegram fileIds in a Cloudflare D1 database. The README describes it as easy to deploy without servers. Core features include optional Basic Auth visitor verification, optional image compression that is on by default and toggleable in the frontend, an optional file size limit defaulting to 20MB and configurable through an environment variable, support for common image and video formats with a whitelist to prevent stored XSS, multi file upload, drag and drop, paste upload with Ctrl+V, hash based deduplication, and concurrent upload with 4 lanes by default. The project is written in JavaScript, licensed under MIT, and its last push was on 2026-09-12. It is not archived.

How storage and caching work

Files are uploaded to Telegram through a bot, and the service stores the mapping between the public URL and the Telegram fileId in a D1 table named media with columns url and fileId. Access goes through the fileId. The README lists performance features: Cloudflare Cache API caching, lazy loading and skeleton screens, a Bing daily wallpaper background, automatic retry for fetching file paths up to 3 times with backoff, and zero external dependencies on both the homepage and admin page. The admin side supports a gallery view with batch operations, batch deletion that removes both the database record and the CDN cache, upload timestamps, and copying links in URL, BBCode and Markdown formats. Local history is also supported.

Deploying it on Cloudflare

Configuration is done through environment variables in Cloudflare Workers. Required variables are DOMAIN, DATABASE, TG_BOT_TOKEN, TG_CHAT_ID, USERNAME, PASSWORD and ADMIN_PATH. Optional variables are ENABLE_AUTH and MAX_SIZE_MB, which defaults to 20. The D1 database binding name must match the DATABASE variable. The media table must be created with this SQL:

CREATE TABLE media (
    url TEXT PRIMARY KEY,
    fileId TEXT NOT NULL
);

The README warns that although the project uses the Worker Cache API, you should configure edge TTL and enable visitor authentication to avoid abuse and billing. The admin path is set by ADMIN_PATH, so the management interface URL is not fixed.

Security and recent hardening

The changelog shows substantial hardening in the 2026-09-12 update. Upload keys gained a random suffix to fix concurrent uploads overwriting each other. An extension whitelist blocks .html and .js uploads. Authentication moved before upload so unauthorized requests do not consume Telegram API quota. The delete endpoint now validates URL ownership and only allows deleting files under the site domain. Image responses gained X-Content-Type-Options nosniff, SVG is forced to download as an attachment with a strict CSP to prevent stored XSS, and Telegram getFile failures retry with backoff of 200ms and 400ms. JSON responses use no-store. The UI was rebuilt in an Apple Liquid Glass style with backdrop filter glass, mouse tracking highlights, glass toast notifications and a glass confirm dialog replacing native confirm and alert.

Limitations and where it is the wrong tool

The project depends entirely on Telegram for storage, so Telegram's own file size and retention limits apply and are not documented in the README. It requires Cloudflare Workers, D1 and the Cache API, which means a specific hosting platform and its pricing model. The README does not document backup or migration procedures for the D1 data. There is no mention of rate limiting or abuse protection beyond visitor authentication. Users who need storage independent of a messaging platform, or who need documented SLAs, should look elsewhere.

Alternatives and how they differ

The README notes that the Telegraph interface moved to a telegraph branch, while the main branch uses the TG_BOT interface and can be deployed to Pages by forking. That gives two deployment shapes: the Telegram bot backed main branch and the older Telegraph interface branch. The README also warns that files uploaded through the Telegraph interface have an expiry, and recommends TG_BOT upload. Compared with self hosted object storage, this project trades control for zero server management, but it ties your data to Telegram and Cloudflare.

Maintenance and licence

Recent releases include v2.8 on 2026-01-19, v2.7 on 2025-08-24 and v2.6 on 2025-08-07. The changelog shows active feature and security work through 2026-09-13.

Editorial conclusion

Adopt this project if you want a self hosted media host on Cloudflare Workers with Telegram backed storage and a polished UI. Do not adopt it if you cannot configure D1, environment variables and a Telegram bot, or if you need guaranteed long term file retention beyond Telegram's own limits. Verify first that your Cloudflare plan supports Workers, D1 and the Cache API, and that your Telegram channel accepts the file sizes you plan to store.

Frequently asked questions

Official sources

1. 0-RTT/telegraph on GitHub
2. Issues
3. License: MIT
4. README
5. Releases