Shubham Ranpise

Back

Installing FileBrowser

Install FileBrowser using Docker. Includes exFAT SSD mount, HTTPS, and restricted service user.

This document describes the steps used to deploy FileBrowser in the homelab.

Key characteristics of this setup:

  • Runs in Docker
  • Uses external exFAT SSD as storage
  • Runs as a low‑privilege service user
  • Uses self‑signed HTTPS
  • Accessible from LAN and Tailscale

Create FileBrowser system user#

Create a dedicated low‑privilege system account used by the service.

sudo useradd \
  --system \
  --uid 777 \
  --gid nogroup \
  --home /nonexistent \
  --shell /usr/sbin/nologin \
  filebrowser
bash

Verify:

id filebrowser
bash

Mount the external SSD (exFAT)#

Identify the disk UUID.

blkid
bash

Example output:

/dev/sda2: UUID="<your-ssd-uuid>" TYPE="exfat"
plaintext

Edit fstab file.

sudo nano /etc/fstab
bash

Add below line (replace <your-ssd-uuid> with your actual UUID):

UUID=<your-ssd-uuid> /mnt/ssd exfat uid=777,gid=65534,umask=0022,nofail 0 0
plaintext

Create mount directory and mount everything.

sudo mkdir -p /mnt/ssd
sudo mount -a
bash

Create the data directory used by FileBrowser.

sudo mkdir -p /mnt/ssd/data
bash

Reload systemd and verify.

sudo systemctl daemon-reload
lsblk
df -h
bash

Create Docker stack directories#

All services in this lab live under /opt/dockerstacks. Create the FileBrowser stack structure.

sudo mkdir -p /opt/dockerstacks/filebrowser
sudo mkdir -p /opt/dockerstacks/filebrowser/{database,config,certs}
bash

Create Docker Compose file#

Create FileBrowser configuration#

sudo tee /opt/dockerstacks/filebrowser/config/settings.json <<EOF
{
  "port": 443,
  "baseURL": "",
  "address": "",
  "log": "stdout",
  "database": "/database/filebrowser.db",
  "root": "/srv",
  "cert": "/certs/filebrowser.crt",
  "key": "/certs/filebrowser.key"
}
EOF
bash

Create the empty database file.

sudo touch /opt/dockerstacks/filebrowser/database/filebrowser.db
bash

Generate self‑signed TLS certificate#

Used for internal HTTPS.

sudo openssl req -x509 -nodes -days 365 \
-newkey rsa:2048 \
-keyout /opt/dockerstacks/filebrowser/certs/filebrowser.key \
-out /opt/dockerstacks/filebrowser/certs/filebrowser.crt \
-subj "/CN=pi.local"
bash

Set ownership for the service user#

# compose file owned by iamdocker account
sudo chown 999:65534 /opt/dockerstacks/filebrowser/docker-compose.yml 

# runtime directories owned by filebrowser service account
sudo chown -R 777:65534 /opt/dockerstacks/filebrowser/database
sudo chown -R 777:65534 /opt/dockerstacks/filebrowser/config
sudo chown -R 777:65534 /opt/dockerstacks/filebrowser/certs
sudo chown -R 777:65534 /mnt/ssd/data
bash

Start FileBrowser container#

sudo -u iamdocker -s
cd /opt/dockerstacks/filebrowser
docker compose pull
docker compose up -d
bash

Verify container is running.

docker ps | grep filebrowser
bash

Retrieve initial admin password#

Check the logs.

docker logs filebrowser
bash

Look for the generated admin password.

First login#

Open:

https://pi.local:12443
plaintext

Default credentials:

username: admin
password: <value from logs>
plaintext

Optional: Create additional users#

If sharing the storage with other users:

  1. Login as admin
  2. Open Users
  3. Create users with restricted access

Examples:

  • read‑only users
  • specific folder access

FileBrowser is now running in the homelab. The files stored on the SSD can be accessed securely over HTTPS from devices on the LAN or connected through Tailscale.

Contents