From b782b4b8aa9479df1f5f05d6e7321bd1956747fb Mon Sep 17 00:00:00 2001 From: Daniel Lindenfelser Date: Tue, 21 Jul 2026 07:49:43 +0200 Subject: [PATCH] Fix filebrowser: persist database and allow port 80 bind The image switched to the FILEBROWSER_* env scheme and now runs as non-root (uid 1000), which broke two things: - It binds :80 inside the container, which a non-root user may not do ("bind: permission denied" since the Jul 19 reboot). Allow it via net.ipv4.ip_unprivileged_port_start=0 instead of running as root. - It stores DB/config under /home/filebrowser/data, not /config, so the old FB_DATABASE + /config mount were ignored and the database lived inside the container (lost on every restart). Mount the host dir there and give it to uid 1000. Co-Authored-By: Claude Opus 4.8 --- modules/fileserver.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/modules/fileserver.nix b/modules/fileserver.nix index 67c1263..46d9238 100644 --- a/modules/fileserver.nix +++ b/modules/fileserver.nix @@ -147,8 +147,9 @@ "d /data/backup 0775 root root -" "d /data/backup/timemachine 0775 danlin users -" - # FileBrowser config - "d /data/filebrowser 0755 root root -" + # FileBrowser config — muss dem Container-User (uid 1000) gehören, + # das Image läuft non-root als filebrowser:1000. + "d /data/filebrowser 0755 danlin users -" # Secrets "d /data/secrets 0700 root root -" @@ -167,13 +168,17 @@ ports = [ "8080:80" ]; volumes = [ "/data:/srv" - "/data/filebrowser:/config" + # Das Image legt DB + config.yaml unter /home/filebrowser/data ab + # (FILEBROWSER_DATABASE/-CONFIG). Ohne diesen Mount lebt die Datenbank + # nur im Container und ist nach jedem Neustart weg. + "/data/filebrowser:/home/filebrowser/data" ]; environment = { TZ = "Europe/Berlin"; - FB_DATABASE = "/config/filebrowser.db"; }; environmentFiles = [ "/data/secrets/filebrowser.env" ]; + # Läuft als non-root (uid 1000) und dürfte Port 80 sonst nicht binden. + extraOptions = [ "--sysctl" "net.ipv4.ip_unprivileged_port_start=0" ]; }; virtualisation.oci-containers.containers.gitea = {