DropStation

A modern iPhone client for Synology Download Station — the replacement for the discontinued DS get app.

Current version: 0.5.3 — see CHANGELOG.md for what's shipping and ROADMAP.md for what's planned. Picking up the repo as a contributor (or AI assistant)? Start with AGENTS.md.

What it does

DropStation connects to your Synology NAS and lets you manage Download Station from your iPhone. Sign in with your DSM username + password — when DSM challenges for a second factor, enter the 6-digit verification code from a TOTP app (sign-in methods below) — then:

• Dashboard tab as the post-login landing — large rounded monospaced transfer speed, NAS hostname + Online indicator, recent activity feed, quick actions. Glance-and-go control center rather than a stats wall.
• Downloads tab — every active and recent task in one list, status dot + title + monospaced ↓ speed · ETA · size metadata, thin status-tinted progress sliver that hides on completion. Swipe to pause / resume / stop / delete.
• Tap a task to drill into peers / seeders / leechers, file list, tracker URLs, ratio, and ETA.
• Add a new download by pasting a magnet/URL or picking a .torrent from the Files app. The destination folder is a tap away — browse your NAS shared folders directly.
• Filter the list by Downloading / Seeding / Paused / Finished / Error. Sort by name / size / date added / date completed.
• Open magnet links from Safari straight into the app.

The 0.5 visual language is a single design system across every screen — one primary Liquid Glass surface per screen (the dashboard hero, the Settings account card, the login card), material-and-hairline secondary cards everywhere else, status conveyed by small filled dots rather than tinted backgrounds. Premium native utility feel; no decorative chrome.

The app stays signed in across launches — the Download Station SID and Secure SignIn cookies live in the iOS Keychain so a cold start goes straight to the task list, with no OTP prompt until DSM actually expires the session. Passwords are not persisted. You can opt out of session persistence in Settings → Privacy via the Remember session toggle (defaults on; flipping it off clears the saved SID, cookies, and session metadata and forces a fresh sign-in on every cold start). The app recovers silently from Wi-Fi ↔ cellular switches and runs on iOS 26 or newer.

Sign-in methods

DropStation supports one user-facing sign-in flow today:

• Verification code (TOTP) — Type your username and password into the app; when DSM challenges for a second factor, enter the 6-digit code from a TOTP app (Synology Secure SignIn Codes tab, Google Authenticator, 1Password, …). Uses SYNO.API.Auth over auth.cgi. This is the only path the app exposes by default and the only one that reliably gets a Download Station-scoped session.

Experimental / hidden: DropStation also contains a WKWebView Secure SignIn flow (the DSM web login with "Approve sign-in" push notification). It's gated behind the auth.method.experimental UserDefaults flag because DSM's web session frequently fails to extend auth to the Download Station API (Synology error 105), which leaves the user staring at a recovery card. The code stays in the binary for development — defaults write com.wenzlik.DropStation auth.method.experimental -bool YES to bring the picker back. Don't expose this to end users until the session handoff is solved.

After the first successful sign-in, the session is restored automatically on every relaunch — the SID is kept in the iOS Keychain. The saved SID survives Wi-Fi ↔ cellular switches, offline windows, and other transport-layer hiccups; it is only discarded when DSM explicitly tells us the session has expired (Synology error codes 105/106/107/119). When the NAS is unreachable, the app shows a "Connection lost / session is saved" card and auto-reconnects via NWPathMonitor the moment the network comes back. "Sign out" clears the SID, cookies, session metadata, any legacy password an older build may have left behind, and the WKWebsiteDataStore.

Installing

DropStation is currently distributed as source — there is no public TestFlight or App Store listing yet. To run it on your own device:

git clone https://github.com/Wenzlik/DropStation.git
cd DropStation
brew install xcodegen
xcodegen generate
open DropStation.xcodeproj

Then build & run on an iPhone simulator or a physical device from Xcode. On the first launch the app asks for the NAS scheme / host / port and credentials.

GitHub Releases

Tagging vX.Y.Z produces a GitHub Release via CI with a zipped .app attached. That zip is a simulator smoke-test artefact, not an installable iPhone build: it is unsigned, has no provisioning profile, and cannot be sideloaded onto a physical device or imported into TestFlight. Use it to verify the tagged commit compiles or to drop into the iOS Simulator. Proper distribution lands in a later release once a TestFlight pipeline is set up (tracked in ROADMAP.md).

Known limitations

• No installable iOS build. As above — TestFlight / App Store distribution is on the roadmap, not in 0.5.
• No background refresh / completion notifications yet. Refresh ticks only while the app is in the foreground.
• Single NAS only. Multi-server switching is on the 0.5 roadmap.
• iOS 26 required. The app leans heavily on iOS 26 Liquid Glass.
• Secure SignIn web flow is hidden. The WKWebView Secure SignIn path is disabled in the default build (see Sign-in methods above) because DSM frequently refuses to extend the web session to the Download Station API. Verification code is the only user-facing flow until we have a more robust session handoff.

Stack

• SwiftUI, iOS 26+ (Liquid Glass design language)
• Swift 5.9, async/await, Codable
• No third-party dependencies
• actor-based API client
• XcodeGen for project generation

Repository layout

DropStation/                The SwiftUI app
├── Models/                 Codable types
├── Networking/             SynologyAPIClient (async/await actor)
├── Storage/                Keychain + UserDefaults persistence
├── ViewModels/             SessionStore + per-screen view models
├── Views/                  SwiftUI screens
└── Resources/              Info.plist + Assets.xcassets (AppIcon)
DropStationTests/           Unit tests
project.yml                 XcodeGen project specification
icon.svg                    Source for the app icon
icon-tinted.svg             Tinted-mode variant (iOS 18+ Home Screen)

Synology API

See the official Download Station Web API guide and DSM Login Web API guide for the wire format. Endpoints used:

• SYNO.API.Auth — sign-in / sign-out (auth.cgi)
• SYNO.DownloadStation.Task — list, getinfo, delete, pause, resume, and the URI-mode create (task.cgi)
• SYNO.DownloadStation2.Task — file-upload create at entry.cgi (DSM 7's newer endpoint; the legacy one silently rejects .torrent multipart uploads)
• SYNO.FileStation.List — list_share / list for the destination picker

Form-urlencoded POST bodies are strictly encoded per RFC 3986 so that magnet URIs with &-separated trackers survive the trip. File uploads use multipart with the binary as the final part, per Synology's spec.

License

MIT — see LICENSE.