--- title: File Browser Quantum description: Install File Browser Quantum, a modernized fork of File Browser, to browse and manage your server files from a fast web interface. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} [File Browser Quantum](https://github.com/gtsteffaniak/filebrowser) is a community fork of [File Browser](/recycled/deprecated/file-browser), rewritten for better performance (indexed search, lower memory use) and configured through a single `config.yaml` file instead of a database-only setup. ![file-browser-quantum](/img/serveex/filebrowser-quantum.png) ## Installation ::file-tree --- tree: /: - docker: - filebrowser-quantum: - compose.yaml - data: - config.yaml - filebrowser.sqlite --- :: ::steps{level="3"} ### Create the config file Create the data folder: ```bash [Terminal] sudo mkdir -p /docker/filebrowser-quantum/data ``` Create the `config.yaml` file: ```bash [Terminal] sudo nano /docker/filebrowser-quantum/data/config.yaml ``` Paste the following, adding one `sources` entry per folder you want to browse: ```yaml [config.yaml] server: cacheDir: /home/filebrowser/data/tmp sources: - path: /docker config: defaultEnabled: true - path: /media config: defaultEnabled: true ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Deploy the stack Open Dockge, click on `compose`, name the stack `filebrowser-quantum`, then copy and paste the following: ```yaml [compose.yaml] --- services: filebrowser-quantum: container_name: filebrowser-quantum image: gtstef/filebrowser:beta restart: unless-stopped volumes: - /docker:/docker - /media:/media - /docker/filebrowser-quantum/data:/home/filebrowser/data ports: - 8020:80 ``` ::note Mount every folder you listed under `sources` in `config.yaml` at the same path inside the container (here `/docker` and `/media`), otherwise File Browser Quantum won't find them. :: ::tip{icon=""} ✨ __Tip:__ Add the watchtower label to automate updates. ```yaml [compose.yaml] services: filebrowser-quantum: #... labels: - com.centurylinklabs.watchtower.enable=true ``` :: Deploy the container and go to `http://yourserverip:8020`. Log in with the default `admin` / `admin` credentials, then immediately change the password in your profile settings. ### Done ! :: ::caution __If it doesn't work:__ check your firewall rules. :: ## Exposing File Browser Quantum with Swag ::warning File Browser Quantum does not support multi-factor authentication. Exposing it publicly could put your systems at risk. Only do this if you're using a secure authentication solution like [TinyAuth](/serveex/security/tinyauth) or [Authentik](/serveex/advanced/authentik/). Otherwise, don't expose it with SWAG. Use a VPN like [Wireguard](/serveex/core/wireguard) instead. :: You may want to access File Browser Quantum remotely from all your devices. To do that, we'll expose it through Swag. ::note{icon=""} 📋 __Pre-requisite:__ We assume you've already created a subdomain like `fbq.yourdomain.com` in your [DNS zone](/general/networking/dns) pointing to `yourdomain.com` with a `CNAME`. Unless you're using Cloudflare Zero Trust, we also assume you've already forwarded port `443` on your router to port `443` on your server using [NAT rules](/general/networking/nat). :: ::steps{level="3"} ### Add File Browser Quantum's network to SWAG In Dockge, go to the SWAG stack and edit the compose file to add File Browser Quantum's network: ```yaml [compose.yaml] --- services: swag: container_name: # ... # ... networks: # Connects the container to the custom network # ... - filebrowser-quantum # Name of the network declared in the stack networks: # Defines the custom network # ... filebrowser-quantum: # Name of the network declared in the stack name: filebrowser-quantum_default # Actual name of the external network external: true # Specifies it's an external network ``` ::note Here, we assume the network name for File Browser Quantum is `filebrowser-quantum_default`. You can confirm the connection is working by accessing the SWAG dashboard at http://yourserverip:81. :: Restart the stack by clicking "deploy" and wait for SWAG to fully initialize. ### Create the subdomain.conf file In the Swag folders, create the file `fbq.subdomain.conf`. ```bash [Terminal] sudo nano /docker/swag/config/nginx/proxy-confs/fbq.subdomain.conf ``` And paste the following configuration: ```nginx [fbq.subdomain.conf] ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name fbq.*; include /config/nginx/ssl.conf; client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app filebrowser-quantum; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. ### Done ! :: That's it! File Browser Quantum is now exposed. ## Protecting File Browser Quantum with TinyAuth Add [TinyAuth](/serveex/security/tinyauth)'s forward-auth check directly to `fbq.subdomain.conf`, the same way as [the TinyAuth guide](/serveex/security/tinyauth#protecting-an-app-via-reverse-proxy): ```nginx [fbq.subdomain.conf]{22-34,37-38} ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name fbq.*; include /config/nginx/ssl.conf; client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location /tinyauth { internal; proxy_pass http://tinyauth:3000/api/auth/nginx; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Uri $request_uri; } location @tinyauth_login { return 302 https://tinyauth.mydomain.com/login?redirect_uri=$scheme://$http_host$request_uri; } location / { auth_request /tinyauth; error_page 401 = @tinyauth_login; # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app filebrowser-quantum; set $upstream_port 80; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` ::note{to="/serveex/security/tinyauth#exposing-tinyauth-with-swag"} The `location /tinyauth` block runs inside SWAG's own container, so SWAG needs to be on TinyAuth's Docker network to reach it by name (`tinyauth` here). This should already be set up from **exposing TinyAuth itself**. If you run into an error, double-check SWAG's compose file still has that network attached. :: ::tip{icon=""} ✨ __Tip:__ You can protect this app with [Authentik](/serveex/advanced/authentik) instead of TinyAuth by opening `fbq.subdomain.conf` and uncommenting `include /config/nginx/authentik-server.conf;`{lang=nginx} and `include /config/nginx/authentik-location.conf;`{lang=nginx}. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy). ::