menzeljandClaude Opus 4.8
e3313fb4ac
Add a full host filesystem browser reachable from the sidebar (/files):
breadcrumb navigation, browse-root chips, show-hidden toggle, and a table
with size/permissions/mtime. Text files open in a Monaco editor (language by
extension); binary/oversized files fall back to download. Admins can create
folders/files, rename, delete (recursive for dirs), upload, and save edits;
download is available to all users. Every mutation is audit-logged.
Backend: new services/file_service.py reuses device_service's sandbox helpers
(confined to ALLOWED_BROWSE_ROOTS, mapped via HOST_ROOT_PREFIX) and rejects
path traversal and deleting a browse root. routers/files.py exposes
/api/files/{list,read,download,write,mkdir,touch,rename,upload,DELETE}
(reads: any user; mutations: admin). device_service.browse entries gained
mtime + symlink (non-breaking).
Deployment: ALLOWED_BROWSE_ROOTS + HOST_ROOT_PREFIX are now env-wired in
docker-compose.yml and .env.example, with a commented /:/host_root mount to
browse/manage the real host filesystem.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
1.3 KiB
Bash
29 lines
1.3 KiB
Bash
# Required: a long random secret for signing JWTs.
|
|
# Generate with: openssl rand -base64 48
|
|
SECRET_KEY=change-me-to-a-long-random-string
|
|
|
|
# Host directory where stack folders (compose.yaml + .env) are stored.
|
|
# This MUST be the same path on the host and is bind-mounted into the backend.
|
|
STACKS_HOST_DIR=./data/stacks
|
|
|
|
# Allowed CORS origin(s) for the API (comma separated). The bundled frontend
|
|
# proxies /api, so this only matters if you call the API from another origin.
|
|
CORS_ORIGINS=http://localhost:5009
|
|
|
|
# Optional: comma-separated generic JSON webhook URLs that receive every event.
|
|
# Richer per-destination webhooks (ntfy/Discord/Slack/Gotify, per-event) are
|
|
# managed from Settings → Notifications in the UI.
|
|
NOTIFY_WEBHOOKS=
|
|
|
|
# Throwaway image used to read/write named-volume contents during backups.
|
|
BACKUP_HELPER_IMAGE=alpine:latest
|
|
|
|
# File browser (sidebar) + volume host-path picker.
|
|
# ALLOWED_BROWSE_ROOTS: comma-separated paths the browser may reach (sandbox).
|
|
# HOST_ROOT_PREFIX: where the host filesystem is mounted inside the backend
|
|
# container. Leave empty to browse the container's own filesystem. To browse
|
|
# the real host, uncomment the "/:/host_root" volume in docker-compose.yml and
|
|
# set HOST_ROOT_PREFIX=/host_root here (mount without :ro to allow edits).
|
|
ALLOWED_BROWSE_ROOTS=/,/mnt,/media,/srv,/opt
|
|
HOST_ROOT_PREFIX=
|