# 02-filebrowser.md

kstack:
  book: Centerpoint Home Lab
  chapter: Utilities
  page: FileBrowser
  tags: [filebrowser, files, storage, authentik]
---

## Overview

FileBrowser is a web-based file manager that provides browsing, uploading,
downloading, and editing of files across multiple mounted host paths. The
external route is protected by Authentik ForwardAuth. The internal route requires
no additional middleware. Several significant host directories are exposed.

## Access

| Type     | URL                                      | Auth                                     |
|----------|------------------------------------------|------------------------------------------|
| External | `https://files.jeeves5454.ddns.net`      | Authentik ForwardAuth + GeoBlock + CrowdSec |
| Internal | `https://files.home.local`               | FileBrowser own auth (Step-CA TLS)       |

## Configuration

**Image:** `filebrowser/filebrowser:latest`

### Traefik Labels

```yaml
traefik.http.routers.filebrowser-external.rule: Host(`files.jeeves5454.ddns.net`)
traefik.http.routers.filebrowser-external.entrypoints: websecure
traefik.http.routers.filebrowser-external.tls.certresolver: letsencrypt
traefik.http.routers.filebrowser-external.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.filebrowser-external.service: filebrowser-svc

traefik.http.routers.filebrowser-internal.rule: Host(`files.home.local`)
traefik.http.routers.filebrowser-internal.entrypoints: websecure
traefik.http.routers.filebrowser-internal.tls.certresolver: step-ca
traefik.http.routers.filebrowser-internal.service: filebrowser-svc

traefik.http.services.filebrowser-svc.loadbalancer.server.port: 80
```

## Volumes / Bind Mounts

| Host Path                             | Container Path     | Purpose                              |
|---------------------------------------|--------------------|--------------------------------------|
| `/home/jeeves/docker/filebrowser/config`   | `/config`     | FileBrowser config file              |
| `/home/jeeves/docker/filebrowser/database` | `/database`   | FileBrowser database (SQLite)        |
| `/home/jeeves`                        | `/srv/home`        | Jeeves home directory                |
| `/media/jeeves/1TB_Vol2/downloads`    | `/srv/downloads`   | Download staging area (Ceph OSD)     |
| `/mnt`                                | `/srv/mnt`         | NFS mounts (Multimedia, Photos, data)|

> FileBrowser provides access to the full home directory, download staging area,
> and all NFS mounts. Treat external access with appropriate caution.

## Notes / Gotchas

- Authentik ForwardAuth is applied on the external route — external access
  requires a valid Authentik session before FileBrowser's own login is shown.
  FileBrowser still maintains its own user database internally.
- `/mnt` is exposed as `/srv/mnt` — this includes all NFS shares from UnRAID
  (`/mnt/Multimedia`, `/mnt/Photos`, `/mnt/data`). Changes made via
  FileBrowser are live on the NFS shares.
- The SQLite database in `/database` stores FileBrowser users, permissions, and
  settings. Back it up alongside `/config`.
- `PUID=1000 / GID=1000` — FileBrowser runs as the `jeeves` user, so file
  operations respect the same ownership as files on disk.

---
*Last Updated: 2026-06-17*