02-filebrowser.md

kstack: book: Centerpoint Home Lab chapter: Utilities page: FileBrowser tags: [filebrowser, files, storage, authentik]

Overview

FileBrowser is a web-based file manager that provides browsing, uploading, downloading, and editing of files across multiple mounted host paths. The external route is protected by Authentik ForwardAuth. The internal route requires no additional middleware. Several significant host directories are exposed.

Access

Type	URL	Auth
External	`https://files.jeeves5454.ddns.net`	Authentik ForwardAuth + GeoBlock + CrowdSec
Internal	`https://files.home.local`	FileBrowser own auth (Step-CA TLS)

Configuration

Image: filebrowser/filebrowser:latest

Traefik Labels

traefik.http.routers.filebrowser-external.rule: Host(`files.jeeves5454.ddns.net`)
traefik.http.routers.filebrowser-external.entrypoints: websecure
traefik.http.routers.filebrowser-external.tls.certresolver: letsencrypt
traefik.http.routers.filebrowser-external.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.filebrowser-external.service: filebrowser-svc

traefik.http.routers.filebrowser-internal.rule: Host(`files.home.local`)
traefik.http.routers.filebrowser-internal.entrypoints: websecure
traefik.http.routers.filebrowser-internal.tls.certresolver: step-ca
traefik.http.routers.filebrowser-internal.service: filebrowser-svc

traefik.http.services.filebrowser-svc.loadbalancer.server.port: 80

Volumes / Bind Mounts

Host Path	Container Path	Purpose
`/home/jeeves/docker/filebrowser/config`	`/config`	FileBrowser config file
`/home/jeeves/docker/filebrowser/database`	`/database`	FileBrowser database (SQLite)
`/home/jeeves`	`/srv/home`	Jeeves home directory
`/media/jeeves/1TB_Vol2/downloads`	`/srv/downloads`	Download staging area (Ceph OSD)
`/mnt`	`/srv/mnt`	NFS mounts (Multimedia, Photos, data)

FileBrowser provides access to the full home directory, download staging area, and all NFS mounts. Treat external access with appropriate caution.

Notes / Gotchas

Authentik ForwardAuth is applied on the external route — external access requires a valid Authentik session before FileBrowser's own login is shown. FileBrowser still maintains its own user database internally.
/mnt is exposed as /srv/mnt — this includes all NFS shares from UnRAID (/mnt/Multimedia, /mnt/Photos, /mnt/data). Changes made via FileBrowser are live on the NFS shares.
The SQLite database in /database stores FileBrowser users, permissions, and settings. Back it up alongside /config.
PUID=1000 / GID=1000 — FileBrowser runs as the jeeves user, so file operations respect the same ownership as files on disk.

Last Updated: 2026-06-17

Revision #2
Created 2026-06-17 04:46:01 UTC by Admin
Updated 2026-06-17 04:46:01 UTC by Admin