menzeljandClaude Opus 4.8
e3313fb4ac
Add a full host filesystem browser reachable from the sidebar (/files):
breadcrumb navigation, browse-root chips, show-hidden toggle, and a table
with size/permissions/mtime. Text files open in a Monaco editor (language by
extension); binary/oversized files fall back to download. Admins can create
folders/files, rename, delete (recursive for dirs), upload, and save edits;
download is available to all users. Every mutation is audit-logged.
Backend: new services/file_service.py reuses device_service's sandbox helpers
(confined to ALLOWED_BROWSE_ROOTS, mapped via HOST_ROOT_PREFIX) and rejects
path traversal and deleting a browse root. routers/files.py exposes
/api/files/{list,read,download,write,mkdir,touch,rename,upload,DELETE}
(reads: any user; mutations: admin). device_service.browse entries gained
mtime + symlink (non-breaking).
Deployment: ALLOWED_BROWSE_ROOTS + HOST_ROOT_PREFIX are now env-wired in
docker-compose.yml and .env.example, with a commented /:/host_root mount to
browse/manage the real host filesystem.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
services:
|
|
backend:
|
|
image: 10.10.5.10:3020/menzelj/stackpilot-backend:latest
|
|
build: ./backend
|
|
restart: unless-stopped
|
|
environment:
|
|
- SECRET_KEY=${SECRET_KEY}
|
|
- STACKS_DIR=/opt/stacks
|
|
- DATA_DIR=/data
|
|
- HOST_PROC_PATH=/host_proc
|
|
- CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5009}
|
|
# Optional: comma-separated generic JSON webhook URLs (every event).
|
|
# Per-destination webhooks (ntfy/Discord/Slack/Gotify) are managed in the UI.
|
|
- NOTIFY_WEBHOOKS=${NOTIFY_WEBHOOKS:-}
|
|
# Throwaway image used to snapshot named-volume contents during backups.
|
|
- BACKUP_HELPER_IMAGE=${BACKUP_HELPER_IMAGE:-alpine:latest}
|
|
# File browser (sidebar) + volume host-path picker. ALLOWED_BROWSE_ROOTS
|
|
# limits which paths are reachable; HOST_ROOT_PREFIX is where the host
|
|
# filesystem is mounted inside this container (see the volume below).
|
|
- ALLOWED_BROWSE_ROOTS=${ALLOWED_BROWSE_ROOTS:-/,/mnt,/media,/srv,/opt}
|
|
- HOST_ROOT_PREFIX=${HOST_ROOT_PREFIX:-}
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ./data:/data
|
|
- ${STACKS_HOST_DIR:-./data/stacks}:/opt/stacks
|
|
- /proc:/host_proc:ro
|
|
# Host devices for GPU/device detection + passthrough (USB/TTY/DRI).
|
|
# Read-only; remove if you don't need GPU/device features.
|
|
- /dev:/dev:ro
|
|
# File browser: to browse/manage the real host filesystem, mount it here
|
|
# and set HOST_ROOT_PREFIX=/host_root in .env. Use :ro for read-only
|
|
# browsing, or drop :ro to allow edits/uploads/deletes from the UI.
|
|
# - /:/host_root
|
|
expose:
|
|
- "5008"
|
|
# Uncomment to expose the API directly (normally proxied by the frontend):
|
|
# ports:
|
|
# - "5008:5008"
|
|
|
|
frontend:
|
|
image: 10.10.5.10:3020/menzelj/stackpilot-frontend:latest
|
|
build: ./frontend
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- backend
|
|
ports:
|
|
- "5009:80"
|