To go full aws on this:

- lambda vending s3 pre signed urls with put only permissions

- a static page with 20 lines of js that requests one of those urls and does the put

I’m not aware of any existing solutions, but your problem seems simple enough that you could roll a solution yourself

This is exactly what I use Firefox Send for in my org. It's not strictly "admin can download" but anyone with the password/link can download. The effect is the same.

I run https://www.wormhol.org

Ping me if you want your own instance.

It uploads to S3. I could make it such that only you/admin can download. Right now everyone with the link can.

Supports up to 5GB (S3's limit without doing multipart uploads).