Filebrowser — files.grifmail.cloud

Web UI for browsing/uploading files. Lives at /home/drew/docker/filebrowser/. Bound to loopback only (127.0.0.1:8083) — public access is exclusively via Cloudflare Tunnel, not LAN.

/home/drew/docker/filebrowser/docker-compose.yml

services:
  filebrowser:
    image: filebrowser/filebrowser:latest
    container_name: filebrowser
    restart: unless-stopped
    user: "1000:1000"
    ports:
      - "127.0.0.1:8083:80"
    volumes:
      - ./srv:/srv
      - ./database:/database
      - ./config:/config

config/settings.json

{
  "port": 80,
  "baseURL": "",
  "address": "",
  "log": "stdout",
  "database": "/database/filebrowser.db",
  "root": "/srv"
}

The settings file is intentionally minimal — most state lives in the sqlite database (database/filebrowser.db), which holds users, permissions, and per-user share rules. Editing the JSON only changes infrastructure-level knobs (port, log destination, file root); user management happens via the web UI or the in-container filebrowser users command.

Layout

Host path	In-container	Purpose
./srv	/srv	Files exposed to the UI (the configured root)
./database	/database	sqlite db with users, permissions, shares (filebrowser.db)
./config	/config	settings.json shown above

Running as 1000:1000 (host drew) means files created via the web UI are owned by drew on disk — no root or no-uid surprises.

Why loopback-only

Filebrowser has its own auth, but pinning the host port to 127.0.0.1 removes it from the LAN attack surface entirely. The only inbound path is Cloudflare Tunnel, which:

• adds TLS to a non-TLS origin
• gives a stable HTTPS URL
• can layer Cloudflare Access in front for an extra auth gate (not currently configured)

If LAN access is ever needed, change the port binding to 0.0.0.0:8083:80 and docker compose up -d — no other change required.

Public ingress

/etc/cloudflared/config.yml:

- hostname: files.grifmail.cloud
  service: http://localhost:8083

See Cloudflare Tunnel for tunnel/DNS setup.

Operating

cd /home/drew/docker/filebrowser
docker compose up -d
docker compose logs -f
docker compose pull && docker compose up -d   # upgrade (image is :latest)

# User management
docker exec filebrowser /filebrowser users ls
docker exec filebrowser /filebrowser users update admin --password <new>
docker exec filebrowser /filebrowser users add <name> <password> --perm.admin=false
docker exec filebrowser /filebrowser users rm <name>

Reset admin password

docker exec filebrowser /filebrowser users update admin --password <new>
docker compose restart filebrowser

Inspect the user db directly

sqlite3 /home/drew/docker/filebrowser/database/filebrowser.db '.tables'
sqlite3 /home/drew/docker/filebrowser/database/filebrowser.db 'select id, username, scope, locale, viewMode from users;'

Reading is safe while the container is running. Don't write to the db live — stop the container first.

Backup

See Backups. Short version:

cd /home/drew/docker/filebrowser
docker compose stop filebrowser
tar czf /backups/filebrowser-$(date +%F).tar.gz srv/ database/ config/
docker compose start filebrowser

srv/ is the content (potentially large), database/ is the user state (small, critical), config/ is settings.json (tiny).