Set up a makerspace 3D printing library with PrintStash

A makerspace library should let members find approved files without giving every account permission to reorganize or delete them. Start with individual accounts, then grant access at the collection level.

Use accounts, not a shared password

The first account is the superuser. Create a separate account for each person who needs the library. This gives API keys, uploads, and audit events an owner and lets you remove one member without changing a password for everyone.

Collection permissions have three levels:

• View for browsing and downloading.
• Edit for adding files and changing model information.
• Admin for managing the collection and its permissions.

Superusers retain system-wide administration, including the full audit log. A collection admin is not the same as a system superuser.

A useful starting layout is:

• Approved library: view for normal members, edit for print staff.
• Member uploads: edit access for the people contributing files.
• Staff testing: edit access for operators validating new slices.
• Machine files: restricted configuration, calibration, and maintenance material.

Share without accounts

An expiring share link is better than creating an account for a class visitor or external collaborator. The link opens one model in a read-only page. Downloads are optional, and the recipient cannot browse the rest of the library.

Set a useful expiry and revoke the link when the handoff ends. The token is stored as a hash, but anyone holding the URL can use it until it expires or is revoked, so treat it as a temporary credential.

Automate slicer uploads per user

Give each slicer user a named API key from their own account. The OrcaSlicer hook exchanges that key for a normal access token and can upload only where that account has edit access.

Do not put one superuser key on every workstation. Separate keys are easier to revoke and leave a useful audit trail. Name them after the machine, such as lab-pc-orca, rather than after a vague purpose.

Know who changed what

The audit log records important administrative and content changes. Use it to answer who changed a collection, uploaded a file, or deleted a model instead of trying to reconstruct the event from chat messages.

Deletion is soft first. Keep a trash retention window long enough to survive holidays and class cycles. Thirty days is a reasonable start, but it is not a backup. A superuser can still make a permanent mistake, and a failed disk ignores application permissions.

Connect printers without exposing them

The PrintStash server needs network access to each configured printer. Member browsers only need access to PrintStash, so the printer interfaces do not have to be exposed to the whole member network.

Sending a library file requires edit access to its collection. That prevents view-only members from starting jobs. Network segmentation still needs normal firewall rules: allow the PrintStash host to reach the printer VLAN, and do not assume the application replaces that boundary.

Practical setup for a typical makerspace

1. Create accounts and the initial collection tree.
2. Grant view access broadly and edit access narrowly.
3. Add one shared slicing workstation with its own API key.
4. Index the existing NAS folder in place if it must remain the source of truth.
5. Connect one printer and test with a small file before adding the rest.
6. Set trash retention and create a full backup.
7. Test restoring that backup outside the production instance.

This setup keeps approved files easy to find, makes risky actions attributable, and gives members routine access without handing everyone the keys to the server. Staff still decide what belongs in the approved library.

Use the expiring share-link guide for visitors, the API automation guide for slicer workstations, and the backup guide before moving the full makerspace archive. If your space already runs an identity provider, putting the library behind SSO covers what OpenID Connect does and does not replace here. For the full access-control picture, including per-printer permissions and what the audit log records, see how makerspaces manage shared access.