Skip to main content

02-filebrowser.md

kstack: book: Centerpoint Home Lab chapter: Utilities page: FileBrowser tags: [filebrowser, files, storage, authentik]

Overview

emptyFileBrowser is a web-based file manager that provides browsing, uploading, downloading, and editing of files across multiple mounted host paths. The external route is protected by Authentik ForwardAuth. The internal route requires no additional middleware. Several significant host directories are exposed.

Access

Type URL Auth External https://files.jeeves5454.ddns.net Authentik ForwardAuth + GeoBlock + CrowdSec Internal https://files.home.local FileBrowser own auth (Step-CA TLS)

Configuration

Image: filebrowser/filebrowser:latest

Traefik Labels

traefik.http.routers.filebrowser-external.rule: Host(`files.jeeves5454.ddns.net`)
traefik.http.routers.filebrowser-external.entrypoints: websecure
traefik.http.routers.filebrowser-external.tls.certresolver: letsencrypt
traefik.http.routers.filebrowser-external.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.filebrowser-external.service: filebrowser-svc

traefik.http.routers.filebrowser-internal.rule: Host(`files.home.local`)
traefik.http.routers.filebrowser-internal.entrypoints: websecure
traefik.http.routers.filebrowser-internal.tls.certresolver: step-ca
traefik.http.routers.filebrowser-internal.service: filebrowser-svc

traefik.http.services.filebrowser-svc.loadbalancer.server.port: 80

Volumes / Bind Mounts

Host Path Container Path Purpose /home/jeeves/docker/filebrowser/config /config FileBrowser config file /home/jeeves/docker/filebrowser/database /database FileBrowser database (SQLite) /home/jeeves /srv/home Jeeves home directory /media/jeeves/1TB_Vol2/downloads /srv/downloads Download staging area (Ceph OSD) /mnt /srv/mnt NFS mounts (Multimedia, Photos, data)

FileBrowser provides access to the full home directory, download staging area, and all NFS mounts. Treat external access with appropriate caution.

Notes / Gotchas

    Authentik ForwardAuth is applied on the external route — external access requires a valid Authentik session before FileBrowser's own login is shown. FileBrowser still maintains its own user database internally. /mnt is exposed as /srv/mnt — this includes all NFS shares from UnRAID (/mnt/Multimedia, /mnt/Photos, /mnt/data). Changes made via FileBrowser are live on the NFS shares. The SQLite database in /database stores FileBrowser users, permissions, and settings. Back it up alongside /config. PUID=1000 / GID=1000 — FileBrowser runs as the jeeves user, so file operations respect the same ownership as files on disk.

    Last Updated: 2026-06-17

    Back to top