How do I make one source readonly and other sources not?

[gordon-matt]

Can someone please tell me how to have one source editable and another reasonly for a user? What I want is this:

• per user folder: read/write
• shared folder: readonly.. except admin user can write.

Here's my stack:

version: "3.9"
services:
  filebrowser:
    image: ghcr.io/gtsteffaniak/filebrowser:latest
    container_name: FileBrowser-Quantum
    restart: unless-stopped
    user: "1026:100"
    ports:
      - "7006:8080"
    volumes:
      - /volume1/docker/filebrowser-quantum/files/shared:/shared:rw
      - /volume1/docker/filebrowser-quantum/files/users:/users:rw
      - /volume1/docker/filebrowser-quantum/data:/home/filebrowser/data:rw

And here's my config.yaml:

server:
  port: 8080
  cacheDir: /home/filebrowser/data/tmp
  sources:
    - path: /users
      name: "My Files"
      config:
        defaultEnabled: true
        createUserDir: true
        
    - path: /shared
      name: "Shared Files"
      config:
        defaultEnabled: true
        private: true
        denyByDefault: false

I created a user in User Management, but it seems that allowing them create/delete permission is a global config and cannot be done per source. Is there some way to do what I want?

[cookesan]

private: true is not the read-only switch. In the generated config it only means the source cannot be shared.

For this layout, make the writable personal source and the shared source separate concerns. Keep normal create/modify/delete permissions for users who should write in their own source. For the shared source, use source access rules: either denyByDefault: true with explicit allow rules for the users/groups that may read it, or deny rules for write-capable groups on the shared path. The config surface has separate user permissions for modify, create, delete, and download, and the source config has denyByDefault, private, and rules.

The Docker mount still needs to be readable by the container, and can stay :rw if admins need to write through FileBrowser. The bind-mount mode is the outer filesystem permission; FileBrowser's user permissions and source rules are what make normal users read-only in the app.

[gtsteffaniak]

the above suggestion is for docker deployments. You can set your volume bind mounts to read only, which would effectively do this.

You are asking for a readonly option per source -- definitely possible. I'll convert this to a feature request.

[gtsteffaniak]

as a workaround for now your config could be readonly like this:

version: "3.9"
services:
  filebrowser:
    image: ghcr.io/gtsteffaniak/filebrowser:latest
    container_name: FileBrowser-Quantum
    restart: unless-stopped
    user: "1026:100"
    ports:
      - "7006:8080"
    volumes:
      - /volume1/docker/filebrowser-quantum/files/shared:/shared:ro
      - /volume1/docker/filebrowser-quantum/files/users:/users:ro
      - /volume1/docker/filebrowser-quantum/data:/home/filebrowser/data:rw

[gordon-matt]

@gtsteffaniak Thanks for the response. I haven't tried it yet, but looking at that config, it would still be an issue, because "ro" means it would always be readonly, no matter what. I want my shared folder writable by me, but readonly by other family members.

Ideally I want:

1. A separate folder for each user to both read and write
2. A shared folder for ONLY me to write, but everyone else can ONLY read.

So permissions per user, per source are necessary.

[gtsteffaniak]

ok I have added a global readonly flag in v1.4.2 beta.

What you are asking above is not currently possible, it will be possible in the future when access permissions and access controls are made more granular in the future.

[gordon-matt]

ok I have added a global readonly flag in v1.4.2 beta.

What you are asking above is not currently possible, it will be possible in the future when access permissions and access controls are made more granular in the future.

Sounds good. Any estimate on when that will be available?