---
title: File Browser Quantum
description: Install File Browser Quantum, a modernized fork of File Browser, to browse and manage your server files from a fast web interface.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

[File Browser Quantum](https://github.com/gtsteffaniak/filebrowser) is a community fork of [File Browser](/recycled/deprecated/file-browser), rewritten for better performance (indexed search, lower memory use) and configured through a single `config.yaml` file instead of a database-only setup.

![file-browser-quantum](/img/serveex/filebrowser-quantum.png)

## Installation

::file-tree
---
tree:
  /:
    - srv:
      - docker:
        - filebrowser-quantum:
          - compose.yaml
          - data:
            - config.yaml
            - filebrowser.sqlite
---
::

::steps{level="3"}
### Create the config file

Create the data folder:

```bash [Terminal]
sudo mkdir -p /srv/docker/filebrowser-quantum/data
```

Create the `config.yaml` file:

```bash [Terminal]
sudo nano /srv/docker/filebrowser-quantum/data/config.yaml
```

Paste the following, adding one `sources` entry per folder you want to browse:

```yaml [config.yaml]
server:
  cacheDir: /home/filebrowser/data/tmp
  sources:
    - path: /srv/docker
      config:
        defaultEnabled: true
    - path: /media
      config:
        defaultEnabled: true
```

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

### Deploy the stack

Open Dockge, click on `compose`, name the stack `filebrowser-quantum`, then copy and paste the following:

```yaml [compose.yaml]
---
services:
  filebrowser-quantum:
    container_name: filebrowser-quantum
    image: gtstef/filebrowser:beta
    restart: unless-stopped
    volumes:
      - /srv/docker:/srv/docker
      - /media:/media
      - /srv/docker/filebrowser-quantum/data:/home/filebrowser/data
    ports:
      - 8020:80
```

::note

Mount every folder you listed under `sources` in `config.yaml` at the same path inside the container (here `/srv/docker` and `/media`), otherwise File Browser Quantum won't find them.
::

::tip{icon=""}
✨ __Tip:__ Add the watchtower label to automate updates.

    ```yaml [compose.yaml]
    services:
      filebrowser-quantum:
        #...
        labels:

          - com.centurylinklabs.watchtower.enable=true
    ```
::

Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings.

### Done !
::

::caution

__If it doesn't work:__ check your firewall rules.
::

## Exposing File Browser Quantum with Swag

::warning

File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead.
::

You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag.

::note{icon=""}

📋 __Pre-requisite:__ We assume you've already created a subdomain like `fbq.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat).
::

::steps{level="3"}
### Add File Browser Quantum's network to SWAG

In Dockge, go to the SWAG stack and edit the compose file to add File Browser Quantum's network:

```yaml [compose.yaml]
---
services:
  swag:
     container_name: # ...
      # ... 
     networks:                          # Connects the container to the custom network 
      # ...           
      - filebrowser-quantum             # Name of the network declared in the stack
    
networks:                               # Defines the custom network
  # ...
  filebrowser-quantum:                  # Name of the network declared in the stack
    name: filebrowser-quantum_default   # Actual name of the external network
    external: true                      # Specifies it's an external network
```

::note

Here, we assume the network name for File Browser Quantum is `filebrowser-quantum_default`. You can confirm the connection is working by accessing the SWAG dashboard at http://yourserverip:81.
::

Restart the stack by clicking "deploy" and wait for SWAG to fully initialize.

### Create the subdomain.conf file

In the Swag folders, create the file `fbq.subdomain.conf`.

```bash [Terminal]
sudo nano /srv/docker/swag/config/nginx/proxy-confs/fbq.subdomain.conf
```

And paste the following configuration:

```nginx [fbq.subdomain.conf]
## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name fbq.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app filebrowser-quantum;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}
```

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

### Done !
::

That's it! File Browser Quantum is now exposed.

## Protecting File Browser Quantum with TinyAuth
Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `fbq.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy):

```nginx [fbq.subdomain.conf]{22-34,37-38}
## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name fbq.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location /tinyauth {
        internal;
        proxy_pass http://tinyauth:3000/api/auth/nginx;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

    location @tinyauth_login {
        return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri;
    }

    location / {
        auth_request /tinyauth;
        error_page 401 = @tinyauth_login;

        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app filebrowser-quantum;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}
```

::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"}

The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached.
::

::tip{icon=""}
✨ __Tip:__ You can protect this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `fbq.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
::
