--- title: File Browser description: Install File Browser to browse and manage your server files from a web interface, exposed securely with SWAG. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} # File Browser ::note 🎯 __Objectives:__ - Install File Browser - Expose File Browser using Swag :: [File Browser](https://github.com/filebrowser/filebrowser) is a web-based interface that lets you access and edit the files on your server. ![File Browser](/img/serveex/filebrowser.png) ## Installation Open Dockge, click on `compose`, name the stack `filebrowser`, then copy and paste the following: ```yaml [compose.yaml] --- services: filebrowser: container_name: filebrowser volumes: - /docker/filebrowser/config:/config/ - /path/to/your/folders:/yourfolders #add your folders to browse as /docker:/docker for exemple ports: - 8010:80 image: filebrowser/filebrowser:s6 ``` ::tip{icon=""} ✨ __Tip:__ Add the watchtower label to each container to automate updates. ```yaml [compose.yaml] services: filebrowser: #... labels: - com.centurylinklabs.watchtower.enable=true ``` :: Deploy the container and go to `http://yourserverip:8010`. That’s it! Your File Browser web UI is up and running! ::caution __If it doesn’t work:__ check your firewall rules. :: ## Exposing File Browser with Swag ::warning File Browser does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you’re using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, do not expose it with SWAG. Use a VPN like [Wireguard](/serveex/security/wireguard) instead. :: You may want to access File Browser remotely from all your devices. To do that, we’ll expose it through Swag. ::note __Pre-requisite:__ We assume you've already created a subdomain like `files.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat). :: In Dockge, go to the SWAG stack and edit the compose file to add File Browser’s network: ```yaml [compose.yaml] --- services: swag: container_name: # ... # ... networks: # Connects the container to the custom network # ... - filebrowser # Name of the network declared in the stack networks: # Defines the custom network # ... filebrowser: # Name of the network declared in the stack name: filebrowser_default # Actual name of the external network external: true # Specifies it's an external network ``` ::note Here, we assume the network name for File Browser is `filebrowser_default`. You can confirm the connection is working by accessing the SWAG dashboard at http://yourserverip:81. :: Restart the stack by clicking "deploy" and wait for SWAG to fully initialize. In the Swag folders, create the file `files.subdomain.conf`. ```bash [Terminal] sudo nano /docker/swag/config/nginx/proxy-confs/files.subdomain.conf ``` And paste the following configuration: ```nginx [files.subdomain.conf] ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name files.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app filebrowser; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. That’s it! File Browser is now exposed! ## Protecting File Browser with TinyAuth Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `files.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy): ```nginx [files.subdomain.conf]{26-38,41-42} ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name files.*; include /config/nginx/ssl.conf; client_max_body_size 0; #if ($lan-ip = yes) { set $geo-whitelist yes; } #if ($geo-whitelist = no) { return 404; } if ($geo-blacklist = no) { return 404; } # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location /tinyauth { internal; proxy_pass http://tinyauth:3000/api/auth/nginx; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; } location @tinyauth_login { return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri; } location / { auth_request /tinyauth; error_page 401 = @tinyauth_login; # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app filebrowser; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` ::note The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from [exposing TinyAuth itself](/serveex/security/tinyauth#exposing-tinyauth-with-swag). If you run into an error, double-check SWAG's compose file still has that network attached. :: ::tip{icon=""} ✨ __Tip:__ You can protect this app with Authentik instead of TinyAuth by opening `files.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don’t forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). ::