Oier Bravo Urtasun
25df9f9398
One shared login (htpasswd) for all players, writable. Config is rendered from a template and mounted read-only, so git stays authoritative — the admin console loads but cannot save, by design. Filestash's OIDC/SAML middlewares are enterprise-only, so Keycloak SSO is out; FILES_AUTH keeps htpasswd/passthrough switchable for later. Auth-off (passthrough) is only valid once the host is off the public internet — render-config.sh warns loudly when rendering it. Three traps, all found by testing against the pinned image: - the `local` backend is admin-gated: without LOCAL_BACKEND_SECRET in the connection params every login fails with "backend error - Not Allowed" - the htpasswd plugin only accepts $2a$ bcrypt, so a $2y$ hash from `htpasswd -B` fails every login silently — use `openssl passwd -6`. render-config.sh rejects the wrong format rather than shipping it - APPLICATION_URL/ADMIN_PASSWORD env make filestash rewrite config.json at boot, which fails on the :ro mount — both live in the rendered config Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
11 lines
474 B
Plaintext
11 lines
474 B
Plaintext
# Files — Filestash player file share (filestash service). Shared login,
|
|
# writable. See plan/20-files.md.
|
|
#
|
|
# Filestash blocks any request whose Host header doesn't match its configured
|
|
# `general.host` (https://files.${BASE_DOMAIN}), with "only traffic from X is
|
|
# allowed". The host nginx forwards the original Host, and caddy passes it
|
|
# through untouched — do NOT rewrite it here or every request 403s.
|
|
http://files.{$BASE_DOMAIN} {
|
|
reverse_proxy filestash:8334
|
|
}
|