services: replace FileBrowser with FileBrowser Quantum

- Swaps image from filebrowser/filebrowser to gtstef/filebrowser:stable
- Uses ./data:/home/filebrowser/data volume layout (Quantum convention)
- Generates data/config.yaml instead of settings.json + database.db
- Mounts primary path as /files with defaultEnabled: true
- Deploys fbq-add-source.sh for adding extra directories post-install
- Updates README with Quantum-specific instructions

docs: save standalone bootstrap as docs/standalone-template.sh

Preserves the full standalone pattern from filebrowser.sh as the
reference template for adding standalone support to other services.

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

docs/standalone-template.sh

@@ -0,0 +1,234 @@
+#!/bin/bash
+# services/my-service.sh — One-line description.
+# Part of the modular post-install system (sourced by setup.sh).
+#
+# Can also be run standalone on any machine:
+#   sudo bash my-service.sh
+# (Docker must already be installed when run standalone)
+
+# ── Standalone bootstrap ──────────────────────────────────────────────────────
+# Detected when the script is executed directly rather than sourced by setup.sh.
+# Sets up helpers and globals, then defers execution until after the function
+# definition at the bottom of this file.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    [[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
+
+    _SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    _COMMON="$_SELF_DIR/../lib/common.sh"
+
+    if [[ -f "$_COMMON" ]]; then
+        # Full repo present — use the real helpers (picks up ~/docker/.config too)
+        # shellcheck source=../lib/common.sh
+        source "$_COMMON"
+    else
+        # One-off copy — inline minimal stubs so the script works without the repo
+        log_info()    { echo -e "\033[0;34m[INFO]\033[0m $*"; }
+        log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
+        log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
+        log_error()   { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
+
+        require_docker() {
+            command -v docker &>/dev/null || {
+                log_error "Docker not found. Install it first:"
+                log_error "  curl -fsSL https://get.docker.com | sudo sh"
+                return 1
+            }
+            docker compose version &>/dev/null || {
+                log_error "Docker Compose plugin missing:"
+                log_error "  sudo apt-get install -y docker-compose-plugin"
+                return 1
+            }
+        }
+
+        ensure_docker_dir_ownership() {
+            chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
+        }
+
+        # Match common.sh's eval-based pattern so local vars in install_* are set correctly
+        prompt_text() {
+            local _q="$1" _def="$2" _var="$3" _r
+            [[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
+            read -r -p "  $_q " _r
+            eval "$_var='${_r:-$_def}'"
+        }
+
+        prompt_yn() {
+            local _q="$1" _def="$2" _var="$3" _r
+            [[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
+            read -r -p "  $_q " _r
+            eval "$_var='${_r:-$_def}'"
+        }
+
+        configure_caddy_for_service() {
+            local _name="$1" _upstream="$2" _subdomain="$3" _extra="${4:-}"
+            local _caddy_dir="$DOCKER_DIR/caddy"
+            local _caddyfile="$_caddy_dir/Caddyfile"
+
+            if [[ ! -d "$_caddy_dir" ]]; then
+                log_info "Access $_name directly on port ${_upstream##*:}."
+                return 0
+            fi
+
+            echo ""
+            local _do_caddy=""
+            read -r -p "  Configure Caddy reverse proxy for $_name? [y/N]: " _do_caddy
+            [[ "${_do_caddy,,}" == "y" ]] || {
+                log_info "Skipping — access at: http://localhost:${_upstream##*:}"
+                return 0
+            }
+
+            local _domain=""
+            read -r -p "  Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
+            [[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
+
+            # Back up before touching
+            if [[ -f "$_caddyfile" ]]; then
+                local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
+                cp "$_caddyfile" "$_bk"
+                log_info "Backed up Caddyfile to $(basename "$_bk")"
+            else
+                touch "$_caddyfile"
+            fi
+
+            # Remove existing block for this domain if present
+            if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
+                log_warning "$_domain already in Caddyfile"
+                local _ow=""
+                read -r -p "  Overwrite? [y/N]: " _ow
+                [[ "${_ow,,}" == "y" ]] || { log_info "Keeping existing entry."; return 0; }
+                sed -i "/^${_domain}/,/^}/d" "$_caddyfile"
+            fi
+
+            cat >> "$_caddyfile" << CBLOCK
+
+# $_name
+$_domain {
+    reverse_proxy $_upstream
+
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+    }
+
+    log {
+        output file /var/log/caddy/${_domain}.log
+        format json
+    }
+${_extra}
+}
+CBLOCK
+
+            log_success "Added $_domain to Caddyfile"
+            docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+            if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
+                log_success "$_name accessible at: https://$_domain"
+            else
+                log_warning "Reload failed — check: docker logs caddy"
+                log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+            fi
+        }
+
+        write_readme() {
+            local _dir="$1"; shift
+            mkdir -p "$_dir"
+            cat > "$_dir/README.md"
+        }
+    fi
+
+    # Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
+    # ($HOME under sudo is /root, not the real user's home)
+    ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
+    ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
+    DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
+    DRY_RUN="${DRY_RUN:-false}"
+    UNATTENDED="${UNATTENDED:-false}"
+    SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
+    SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
+    SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
+
+    register_service() { :; }   # no-op — no wizard to register into
+    _RUN_STANDALONE=1
+fi
+# ─────────────────────────────────────────────────────────────────────────────
+
+register_service my-service utilities "What it does (My Service)" 8080
+
+install_my_service() {
+    require_docker || return 1
+    log_info "Installing My Service..."
+
+    local DIR="$DOCKER_DIR/my-service"
+
+    if [ "$DRY_RUN" = true ]; then
+        echo "[DRY-RUN] Would create $DIR with docker-compose.yml"
+        return 0
+    fi
+
+    mkdir -p "$DIR"
+    ensure_docker_dir_ownership "$DIR"
+    cd "$DIR" || return 1
+
+    cat > docker-compose.yml << 'EOF'
+name: my-service
+
+services:
+  my-service:
+    image: vendor/my-service:latest
+    container_name: my-service
+    hostname: my-service
+    restart: unless-stopped
+    environment:
+      - TZ=${SITE_TZ:-UTC}
+    ports:
+      - "8080:8080"
+    volumes:
+      - ./data:/data
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
+EOF
+
+    cat > .env << ENV
+CADDY_NET=$SITE_CADDY_NET
+ENV
+
+    configure_caddy_for_service "My Service" "my-service:8080" "my-service"
+
+    write_readme "$DIR" << MD
+# My Service
+
+Brief description.
+
+## Access
+- URL: http://localhost:8080
+
+## Manage
+\`\`\`
+cd $DIR
+docker compose up -d      # start
+docker compose down       # stop
+docker compose logs -f    # logs
+docker compose pull && docker compose up -d  # update
+\`\`\`
+MD
+
+    local START=""
+    prompt_yn "Start My Service now? (y/n):" "y" START
+    if [ "$START" = "y" ] || [ "$START" = "Y" ]; then
+        docker compose up -d \
+            && log_success "My Service started" \
+            || log_warning "Start failed — check: docker compose logs"
+    fi
+
+    echo "  Access at: http://localhost:8080"
+    echo ""
+}
+
+# Run immediately when executed directly (deferred until after function definition)
+[[ "${_RUN_STANDALONE:-0}" == 1 ]] && install_my_service

services/filebrowser.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# services/filebrowser.sh — FileBrowser web-based file manager.
+# services/filebrowser.sh — FileBrowser Quantum web-based file manager.
 # Part of the modular post-install system (sourced by setup.sh).
 #
 # Can also be run standalone on any machine:
@@ -7,9 +7,6 @@
 # (Docker must already be installed when run standalone)
 
 # ── Standalone bootstrap ──────────────────────────────────────────────────────
-# Detected when the script is executed directly rather than sourced by setup.sh.
-# Sets up helpers and globals, then defers execution until after the function
-# definition at the bottom of this file.
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     [[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
 
@@ -17,11 +14,8 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     _COMMON="$_SELF_DIR/../lib/common.sh"
 
     if [[ -f "$_COMMON" ]]; then
-        # Full repo present — use the real helpers (picks up ~/docker/.config too)
-        # shellcheck source=../lib/common.sh
         source "$_COMMON"
     else
-        # One-off copy — inline minimal stubs
         log_info()    { echo -e "\033[0;34m[INFO]\033[0m $*"; }
         log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
         log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -44,7 +38,6 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
             chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
         }
 
-        # Match common.sh's eval-based pattern so local vars in install_* are set correctly
         prompt_text() {
             local _q="$1" _def="$2" _var="$3" _r
             [[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
@@ -81,7 +74,6 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
             read -r -p "  Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
             [[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
 
-            # Back up before touching
             if [[ -f "$_caddyfile" ]]; then
                 local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
                 cp "$_caddyfile" "$_bk"
@@ -90,7 +82,6 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
                 touch "$_caddyfile"
             fi
 
-            # Remove existing block for this domain if present
             if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
                 log_warning "$_domain already in Caddyfile"
                 local _ow=""
@@ -137,8 +128,6 @@ CBLOCK
         }
     fi
 
-    # Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
-    # ($HOME under sudo is /root, not the real user's home)
     ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
     ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
     DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
@@ -148,54 +137,51 @@ CBLOCK
     SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
     SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
 
-    register_service() { :; }   # no-op — no wizard to register into
+    register_service() { :; }
     _RUN_STANDALONE=1
 fi
 # ─────────────────────────────────────────────────────────────────────────────
 
-register_service filebrowser utilities "Web file manager (FileBrowser)" 8085
+register_service filebrowser utilities "Web file manager (FileBrowser Quantum)" 8085
 
 install_filebrowser() {
     require_docker || return 1
-    log_info "Installing Filebrowser..."
+    log_info "Installing FileBrowser Quantum..."
+
     local FB_DIR="$DOCKER_DIR/filebrowser"
 
     if [ "$DRY_RUN" = true ]; then
         echo "[DRY-RUN] Would create $FB_DIR"
+        echo "[DRY-RUN] Would write docker-compose.yml and data/config.yaml"
         return 0
     fi
 
-    mkdir -p "$FB_DIR"
+    mkdir -p "$FB_DIR/data"
     ensure_docker_dir_ownership "$FB_DIR"
     cd "$FB_DIR" || return 1
 
     local FB_PATH=""
-    prompt_text "Path to browse [default: $ACTUAL_HOME]:" "$ACTUAL_HOME" FB_PATH
+    prompt_text "Primary files directory to browse [default: $ACTUAL_HOME]:" "$ACTUAL_HOME" FB_PATH
 
     cat > docker-compose.yml << FB_COMPOSE
 name: filebrowser
 
 services:
   filebrowser:
-    image: filebrowser/filebrowser:latest
+    image: gtstef/filebrowser:stable
     container_name: filebrowser
     hostname: filebrowser
     restart: unless-stopped
     environment:
-      - TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
+      - TZ=${SITE_TZ:-UTC}
     volumes:
-      - fb_users:/srv
+      - ./data:/home/filebrowser/data
-      - ${FB_PATH}:/srv/data
+      - ${FB_PATH}:/files
-      - ./database/filebrowser.db:/database/filebrowser.db
-      - ./config/settings.json:/config/settings.json
     ports:
       - "8085:80"
     networks:
       - caddy_net
 
-volumes:
-  fb_users:
-
 networks:
   caddy_net:
     external: true
@@ -203,63 +189,72 @@ networks:
 FB_COMPOSE
 
     cat > .env << FB_ENV
-FB_PATH=$FB_PATH
 CADDY_NET=$SITE_CADDY_NET
 FB_ENV
 
-    mkdir -p database config
+    # Generate config.yaml — Quantum reads this from /home/filebrowser/data/
-    touch database/filebrowser.db
+    cat > data/config.yaml << FB_CONFIG
-    cat > config/settings.json << 'FB_SETTINGS'
+server:
-{
+  sources:
-  "port": 80,
+    - path: "/files"
-  "baseURL": "",
+      name: "files"
-  "address": "",
+      config:
-  "log": "stdout",
+        defaultEnabled: true
-  "database": "/database/filebrowser.db",
+
-  "root": "/srv"
+auth:
-}
+  adminUsername: admin
-FB_SETTINGS
+  adminPassword: admin
+
+userDefaults:
+  account:
+    permissions:
+      admin: false
+      modify: false
+      share: true
+      download: true
+      create: false
+      delete: false
+FB_CONFIG
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$FB_DIR"
 
-    # Deploy extra-directory helper script
+    # Deploy fbq-add-source.sh helper
     local _TOOLS_DIR
     _TOOLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../tools" 2>/dev/null && pwd)" || true
-    if [ -f "$_TOOLS_DIR/additional_directories.sh" ]; then
+    if [ -f "$_TOOLS_DIR/fbq-add-source.sh" ]; then
-        cp "$_TOOLS_DIR/additional_directories.sh" "$FB_DIR/additional_directories.sh"
+        cp "$_TOOLS_DIR/fbq-add-source.sh" "$FB_DIR/fbq-add-source.sh"
-        chmod 750 "$FB_DIR/additional_directories.sh"
+        chmod 750 "$FB_DIR/fbq-add-source.sh"
-        chown "$ACTUAL_USER:$ACTUAL_USER" "$FB_DIR/additional_directories.sh"
+        chown "$ACTUAL_USER:$ACTUAL_USER" "$FB_DIR/fbq-add-source.sh"
-        log_success "additional_directories.sh installed at $FB_DIR/additional_directories.sh"
+        log_success "fbq-add-source.sh installed at $FB_DIR/fbq-add-source.sh"
     fi
 
     echo ""
-    log_success "Filebrowser configured at $FB_DIR"
+    log_success "FileBrowser Quantum configured at $FB_DIR"
 
     configure_caddy_for_service "FileBrowser" "filebrowser:80" "files"
 
     write_readme "$FB_DIR" << MD
-# FileBrowser
+# FileBrowser Quantum
 
-Web-based file manager. Browse, upload, and download files through a browser.
+Web-based file manager with multi-source support, office preview, and
+per-user access control.
 
 ## Access
 - URL: http://localhost:8085
 - Default login: admin / admin (change immediately!)
 
-## Data
+## Adding sources (extra directories)
-- Browsed path: $FB_PATH (mounted to /srv/data inside container)
+Run the included helper to add directories and wire them into both
-- User home dirs: Docker named volume fb_users (no host clutter)
+docker-compose.yml and config.yaml:
-- Admin full-access scope: /data
+\`\`\`
-- Per-user scope example: /alice
+sudo bash $FB_DIR/fbq-add-source.sh
-- Database: ./database/filebrowser.db
+\`\`\`
-- Settings: ./config/settings.json
+Then assign the new source to users: Settings → Users → edit user → Add source.
 
-## Users
+## Data
-Create and manage users in the FileBrowser web UI.
+- Primary path: $FB_PATH (mounted to /files inside container)
-To give a user access to extra folders beyond their root directory:
+- Config + database: ./data/
-\`\`\`
+- Add more mounts via fbq-add-source.sh — no manual YAML editing needed
-$FB_DIR/additional_directories.sh
-\`\`\`
 
 ## Manage
 \`\`\`
@@ -267,13 +262,16 @@ cd $FB_DIR
 docker compose up -d      # start
 docker compose down       # stop
 docker compose logs -f    # logs
+docker compose pull && docker compose down && docker compose up -d  # update
 \`\`\`
 MD
 
     local START_FB=""
-    prompt_yn "Start Filebrowser now? (y/n):" "y" START_FB
+    prompt_yn "Start FileBrowser Quantum now? (y/n):" "y" START_FB
     if [ "$START_FB" = "y" ] || [ "$START_FB" = "Y" ]; then
-        docker compose up -d 2>/dev/null && log_success "Filebrowser started" || log_warning "Failed to start"
+        docker compose up -d 2>/dev/null \
+            && log_success "FileBrowser Quantum started" \
+            || log_warning "Failed to start — check: docker compose logs"
     fi
 
     echo "  Access at:  http://localhost:8085"