podman config for filebrowser quantum

[LFrank2021]

Disclaimer: I am not an expert with Proxmox and podman (yet), so there might be room for improvement.

It took me a few days to get FileBrowser Quatum to work on my new Proxmox VE system.
In sharing my troubles and findings, I hope it helps others to get it up and running quicker.
I will not get into setting up Proxmox VE, just how to get a working podman LXC and how to configure it for FileBrowser quantum.

I set up the podman LXC using the according script from Proxmox Helper-Scripts
I added 3 mountpoints:
/data for the container registry
/fileshare for the files shared through FileBrowser quantum
/etc/ssl/private for SSL-Certificates

I created the following configs under /etc/containers/
containers.conf without comments mine boils down to

[engine] 
static_dir = "/data/containers/storage/libpod"
volume_path = "/data/containers/storage/volumes"

storage.conf
Min is a copy from /usr/share/containers/storage.conf and modified on line

graphroot = "/data/containers/storage"

Restarted the podman.service and podman.socket
systemctl restart podman.service podman.socket

I created a quadlet filebrowser.containerunder /etc/container/systemd/

[Unit]
Description=Podman filebrowser.service
Wants=network-online.target
After=network-online.target podman.socket
RequiresMountsFor=%t/containers

[Container]
Image=docker.io/gtstef/filebrowser:stable
ContainerName=filebrowser
PublishPort=8080:80
#PublishPort=8443:443
Volume=filebrowser_data:/home/filebrowser/data
Volume=/fileshare:/srv
Environment=FILEBROWSER_CONFIG="data/config.yaml"
Label="io.containers.autoupdate=registry"

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=multi.user.target default.target

systemctl daemon-reload

For the /home/filebrowser/data I created a volume;
podman volume create filebrowser_data >/dev/null

Starting the container with this, should avoid some issues I faced

1. always loosing the database.db, when container is restarted
2. not finding the certificates and modified config.yaml

If you want to switch to HTTPS:
change the PublishPort in the quadlet, don't forget the systemctl daemon-reload
copy your certificates into the container volume, mind are in a directory certs/
and modify the config.yaml under the container volume:

server:
  port: 443
  database: "data/database.db"
  baseURL:  "/"
  tlsKey: "data/certs/key.pem"          # path to TLS key
  tlsCert: "data/certs/cert.pem"        # path to TLS cert
  logging:
    - levels: "info|warning|error"
  sources:
    - path: "/srv"

The Label in the quadlet allows me to update the container using the following command:
podman auto-update
add --dry-run to get a preview

Combine this with a podman container prune and you immediately remove unneeded container remains.

For now, I think this is all.

Best regards
Frank

[cryinkfly]

I have also created a pod to run FileBrowser Quantum with Radicale in rootless mode using Podman with a Nginx-Proxy-Manager. The file is available here: https://github.com/cryinkfly/podman-rootless-quadlets/tree/main/quadlets/filebrowser-quantum

[LFrank2021]

It is been some time, since my initial writeup.
And with the current stable release 1.3.0, I thought this being a good time to update it a bit.

Te quadlet now reads:

[Unit]
Description=Podman filebrowser.service
Wants=network-online.target
After=network-online.target podman.socket
RequiresMountsFor=%t/containers

[Container]
Image=docker.io/gtstef/filebrowser:stable
ContainerName=filebrowser
AddCapability=NET_BIND_SERVICE
#PublishPort=8080:80
PublishPort=8443:443
Volume=filebrowser_data:/home/filebrowser/data
Volume=/fileshare:/srv
Environment=FILEBROWSER_CONFIG="data/config.yaml"
Label="io.containers.autoupdate=registry"

[Service]
# clear ghost veth-Interfaces
ExecStopPost=/usr/bin/bash -c 'for veth in $(ip -o link show | grep veth | awk -F": " "{print \$2}" | cut -d@ -f1); do ip link show "\$veth" | grep -q link-netnsid || ip link delete "\$veth" 2>/dev/null; done'
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=multi.user.target default.target

The AddCapability is needed since the now non-root user 'filebrowser' is not allowed to open ports below 1024. (see this as well)
Alternatively you should be able to change the port to something of your liking.
Though I seem to recall it only accepted 443 with TLS (might have changed!).

The config.yaml within the podman volume shows this for the server stanza:

server:
  port: 443
  database: "data/database.db"
  baseURL:  "/"
  tlsKey: "data/certs/key.pem"          # path to TLS key
  tlsCert: "data/certs/cert.pem"        # path to TLS cert
  logging:
    - levels: "warning|error"
  sources:
    - path: "/srv"