From 9db6e72cccdea8fe2a7de99b7a8b172e6418ba47 Mon Sep 17 00:00:00 2001
From: HAL 8 ops <ops@odyssey-works.io>
Date: Mon, 24 Aug 2026 23:40:35 +0000
Subject: [PATCH] Filebrowser setup script (files.odyssey-works.io)

---
 files-setup.sh | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 files-setup.sh

diff --git a/files-setup.sh b/files-setup.sh
new file mode 100644
index 0000000..09a3f1b
--- /dev/null
+++ b/files-setup.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# HAL 8 file browser: Filebrowser behind the existing Caddy on this box.
+# Browse root is /srv/files (a shared folder) - deliberately NOT the whole
+# disk, so server secrets (tank key, supplier keys, git tokens) are never
+# one misclick from a browser tab.
+set -e
+
+sudo mkdir -p /srv/files
+sudo rm -rf /opt/filebrowser && sudo mkdir -p /opt/filebrowser
+NET=$(sudo docker network ls --format '{{.Name}}' | grep -m1 hal8)
+echo "using docker network: $NET"
+
+PW=$(openssl rand -base64 12)
+HASH=$(sudo docker run --rm filebrowser/filebrowser hash "$PW")
+
+sudo docker rm -f filebrowser >/dev/null 2>&1 || true
+sudo docker run -d --restart unless-stopped --name filebrowser --network "$NET" \
+  -v /srv/files:/srv \
+  -v /opt/filebrowser:/database \
+  -e FB_DATABASE=/database/filebrowser.db \
+  -e FB_USERNAME=jerry \
+  -e FB_PASSWORD="$HASH" \
+  filebrowser/filebrowser
+
+printf 'files.odyssey-works.io {\n\treverse_proxy filebrowser:80\n}\n' \
+  | sudo tee /opt/marketplace/caddy/files.caddy >/dev/null
+CADDY_CONFIG_SHA=$(sudo sh -c "cat /opt/hal8/deploy/Caddyfile /opt/marketplace/caddy/*.caddy | sha256sum | cut -d' ' -f1")
+cd /opt/hal8
+sudo CADDY_CONFIG_SHA="$CADDY_CONFIG_SHA" docker compose -f docker-compose.prod.yaml up -d --no-build --force-recreate caddy
+
+echo "===================================================="
+echo "LOGIN:    https://files.odyssey-works.io  user: jerry"
+echo "PASSWORD: $PW"
+echo "===================================================="