NAS Manager Administration

The TwilightTV NAS Manager is powered by File Browser. It provides browser-based file access for approved users, including private home folders, shared storage, uploads, downloads, and administrator-managed files.

Public URL: nas.twilighttv.myddns.me

SSH is only available to select users, due to the high security nature of the service. Right now, David (Gumby) is the only one with SSH and direct access to the machine. For now, all major issues go to him.

Warning: File Browser user scopes and filesystem permissions determine what users can access. Always verify the target username, scope, and filesystem path before saving account or permission changes.

• Open NAS Manager
• User Guide: NAS Manager
• Admin Overview
• Backup and Restore Procedures
• The Twilight Zone Discord

The File Browser storage root is:

/mnt/TwilightStorage

Each user receives a private home folder here:

/mnt/TwilightStorage/UserFiles/<username>

Recommended layout:

/mnt/TwilightStorage/
├── UserFiles/
│   ├── alice/
│   ├── bob/
│   └── <username>/
├── Shared/
│   ├── Uploads/
│   ├── Downloads/
│   └── Public/
├── Media/
│   ├── Movies/
│   ├── TV/
│   └── Music/
└── Admin/
    └── Staging/

Do not expose File Browser's database, application configuration, container mounts, backup locations, Docker socket, SSH keys, environment files, or host system directories to normal users.

This page assumes File Browser sees the host path:

/mnt/TwilightStorage

as its own root directory.

For example, if File Browser is containerized, the host path should be mounted into the container as a fixed location such as /srv:

services:
  filebrowser:
    image: filebrowser/filebrowser:latest
    container_name: <filebrowser-container-name>
    volumes:
      - /mnt/TwilightStorage:/srv
      - <config-path>/filebrowser.db:/database/filebrowser.db
      - <config-path>/settings.json:/.filebrowser.json
    ports:
      - "<internal-port>:80"
    restart: unless-stopped

With this mapping:

File Browser user scopes must use the File Browser-visible path, not the host path. For example, use /UserFiles/alice as Alice's scope—not /mnt/TwilightStorage/UserFiles/alice.

Each normal user should receive a private directory and a File Browser account scoped to that directory.

1. Choose a lowercase username without spaces. Prefer letters, numbers, hyphens, and underscores.
2. Create the user's home folder:

sudo mkdir -p /mnt/TwilightStorage/UserFiles/<username>

1. Set ownership and permissions according to the File Browser service account and your local permission model.
2. Sign in to File Browser as an administrator.
3. Go to Settings → Users.
4. Select New User.
5. Enter the username and a unique temporary password.
6. Set the user's Scope to:

/UserFiles/<username>

1. Enable only the permissions the user needs.
2. Save the account.
3. Test the new account in a private/incognito browser window.
4. Send the user the NAS Manager link and NAS Manager Help through a private message.

Recommended permissions for a normal user with a private home folder:

For users who should only download content:

1. Create the account normally.
2. Set its scope to the appropriate File Browser path, for example:

/Shared/Downloads

1. Enable browsing and downloading.
2. Disable upload/create, rename, move, copy, edit, delete, and share permissions.
3. Test the account to ensure it cannot change files.

For a user who needs access to the shared upload area:

1. Set the user's scope to:

/Shared/Uploads

1. Enable browsing, uploading, and folder creation only as needed.
2. Do not give access to /Media unless the user is a trusted media administrator.
3. Review uploads before moving them into a final media library or shared location.

1. Create a unique account for each administrator.
2. Use a strong password and do not share it.
3. Keep the number of administrators small.
4. Confirm at least two trusted admins can restore access if one account is lost.
5. Record account ownership in the change log without recording passwords.

• Never give a normal user the / scope.
• Never scope a normal user to /UserFiles if home folders are meant to remain private.
• Use /UserFiles/<username> for every personal account.
• Keep /Media unavailable to normal users by default.
• Use scoped accounts rather than one shared account.
• Test every new or modified account in an incognito/private browser window.
• File Browser permissions do not override Linux filesystem permissions.

File Browser must have host-level permission to read and write each directory it exposes. A correct File Browser scope can still fail if Linux ownership, modes, ACLs, or SELinux labels are incorrect.

Check the storage mount and user directory:

findmnt /mnt/TwilightStorage
df -h /mnt/TwilightStorage
 
ls -ld /mnt/TwilightStorage
ls -ld /mnt/TwilightStorage/UserFiles
ls -ld /mnt/TwilightStorage/UserFiles/<username>

Check ACLs, if used:

getfacl /mnt/TwilightStorage/UserFiles/<username>

Check SELinux labels, if the host uses SELinux:

ls -ldZ /mnt/TwilightStorage
ls -ldZ /mnt/TwilightStorage/UserFiles/<username>

Do not fix permission problems by making all storage world-writable or by unnecessarily running File Browser as root. Use correct ownership, groups, ACLs, container user IDs, and SELinux labels.

The File Browser CLI can manage users from the host or from inside the container. Confirm supported options on your installed version before changing production accounts.

Show help:

filebrowser --help
filebrowser users --help

List users:

filebrowser users ls --database <database-path>

Add a standard user:

filebrowser users add <username> <temporary-password> \
  --scope /UserFiles/<username> \
  --database <database-path>

Update a password:

filebrowser users update <username> \
  --password <new-password> \
  --database <database-path>

Update a user scope:

filebrowser users update <username> \
  --scope /UserFiles/<username> \
  --database <database-path>

Remove a user account:

filebrowser users rm <username> \
  --database <database-path>

Docker example:

docker exec -it <filebrowser-container-name> filebrowser users ls \
  --database /database/filebrowser.db

Podman example:

podman exec -it <filebrowser-container-name> filebrowser users ls \
  --database /database/filebrowser.db

Removing a File Browser user account does not automatically remove that person's files. Archive, transfer, or delete /mnt/TwilightStorage/UserFiles/<username> separately and only after confirming the intended retention action.

1. Verify the user’s identity through Discord or another approved method.
2. Sign in as a File Browser administrator.
3. Open Settings → Users.
4. Select the user account.
5. Set a new temporary password.
6. Save the change.
7. Send the temporary password privately.
8. Do not post passwords in Discord channels, wiki pages, tickets, or the change log.

If all File Browser administrator access is lost:

1. Back up the File Browser database first.
2. Use the File Browser CLI to reset a known admin password.
3. Restart File Browser if needed.
4. Confirm administrator login works.
5. Remove or secure any emergency account created during recovery.

Check available storage regularly:

df -h /mnt/TwilightStorage
du -sh /mnt/TwilightStorage/*
du -sh /mnt/TwilightStorage/UserFiles/*
du -sh /mnt/TwilightStorage/Shared/*
du -sh /mnt/TwilightStorage/Media/*

Find the largest files:

find /mnt/TwilightStorage -type f -printf '%s %p\n' | sort -nr | head -n 50

Confirm ownership and purpose before removing files. Do not bulk-delete files based only on size.

Normal users should request movies and shows through Seerr whenever possible.

For approved manual media uploads:

1. Upload files to /Admin/Staging or another designated staging location.
2. Confirm sufficient free space.
3. Check the file name, file type, duplicate status, and playback.
4. Move approved media into the correct final library directory under /mnt/TwilightStorage/Media.
5. Trigger or wait for the Jellyfin library scan.
6. Verify the media appears correctly in Jellyfin.
7. Notify the requester only after verification.

Do not allow normal users to write directly to final Jellyfin library folders unless you intentionally accept the risk of duplicates, unwanted metadata, broken naming, and accidental deletion.

Docker:

docker ps --filter "name=<filebrowser-container-name>"
docker logs --tail 200 <filebrowser-container-name>

Podman:

podman ps --filter "name=<filebrowser-container-name>"
podman logs --tail 200 <filebrowser-container-name>

Systemd:

systemctl status <filebrowser-service-name>
journalctl -u <filebrowser-service-name> -n 200 --no-pager

Docker:

docker restart <filebrowser-container-name>

Podman:

podman restart <filebrowser-container-name>

Systemd:

sudo systemctl restart <filebrowser-service-name>

1. Confirm File Browser is running.
2. Open nas.twilighttv.myddns.me in a private/incognito window.
3. Confirm HTTPS is valid.
4. Confirm administrator login works.
5. Confirm a normal user sees only their own /UserFiles/<username> directory.
6. Upload and delete a harmless test file in an approved test directory.
7. Confirm a normal user cannot see another user's home folder.
8. Review recent service and reverse-proxy logs.

The File Browser application should be accessible publicly through HTTPS at:

nas.twilighttv.myddns.me

Do not expose File Browser's internal application port directly to the public internet unless there is a specific, documented reason.

Nginx example:

server {
    server_name nas.twilighttv.myddns.me;
 
    client_max_body_size <expected-upload-limit>;
    proxy_connect_timeout <timeout>;
    proxy_send_timeout <timeout>;
    proxy_read_timeout <timeout>;
    send_timeout <timeout>;
 
    location / {
        proxy_pass http://<filebrowser-host>:<internal-port>;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

If uploads fail at a specific size, check client_max_body_size. If they fail after several minutes, check proxy timeouts, File Browser logs, free disk space, and connection stability.

Back up File Browser configuration, its database, and the files it exposes. The File Browser database contains user accounts, password hashes, scopes, permissions, settings, and share information.

Stop File Browser before a direct SQLite database copy when possible:

docker stop <filebrowser-container-name>
 
cp <database-path> <backup-destination>/filebrowser-$(date +%F).db
 
docker start <filebrowser-container-name>

If sqlite3 is installed, use its backup function:

sqlite3 <database-path> ".backup '<backup-destination>/filebrowser-$(date +%F).db'"

1. Stop File Browser before restoring its database or application configuration.
2. Restore the matching configuration and database together.
3. Restore filesystem ownership, permissions, ACLs, and SELinux labels as needed.
4. Confirm /mnt/TwilightStorage is properly mounted before starting File Browser.
5. Test the service locally, then test HTTPS access.
6. Test with a non-admin user before announcing recovery.

Before updating File Browser, its container image, plugins, or the host:

1. Read release notes for breaking changes.
2. Confirm backups completed successfully.
3. Record the currently running version or image.
4. Keep the previous image/version available for rollback.
5. Update and restart the service.
6. Test admin login, standard-user login, scopes, file access, uploads, downloads, and HTTPS.
7. Review logs before declaring the update complete.

Docker Compose example:

docker inspect <filebrowser-container-name> --format '{{.Config.Image}}'
 
docker compose pull
docker compose up -d
 
docker compose ps
docker compose logs --tail 200

1. Confirm File Browser is running.
2. Check File Browser logs.
3. Check reverse-proxy status and logs.
4. Confirm the proxy can reach the internal File Browser address.
5. Verify DNS, firewall rules, port forwarding, and TLS certificate status.
6. Confirm the reverse proxy is configured for nas.twilighttv.myddns.me.

1. Check the user’s File Browser scope.
2. A normal user's scope should be /UserFiles/<username>.
3. Confirm the user is not using an administrator account.
4. Confirm File Browser's root is mapped to /mnt/TwilightStorage.
5. Confirm that /mnt/TwilightStorage/UserFiles/<username> exists on the host.
6. Test the account in a private/incognito browser window.

1. Review File Browser user permissions.
2. Check host ownership and modes on the target directory.
3. Check ACLs with getfacl.
4. Check SELinux labels when applicable.
5. Confirm File Browser's container/service user has access to the mounted path.
6. Review logs for the exact failed operation.

1. Check free space with df -h /mnt/TwilightStorage.
2. Confirm the user can write to their assigned scope.
3. Check reverse-proxy upload size limits and timeouts.
4. Review File Browser logs.
5. Test a small upload and then a larger upload.
6. Confirm that the storage mount is present and writable.

1. Verify the storage device is mounted:

findmnt /mnt/TwilightStorage

1. Confirm File Browser has the expected bind mount.
2. Check whether files were moved, renamed, or deleted.
3. Check snapshots, recycle-bin behavior, and backups.
4. Do not write new files into a suspected missing mount path until the mount is verified; otherwise, new files may be written to the server's root filesystem rather than the intended storage device.

• Require unique passwords for every user.
• Do not share File Browser administrator accounts.
• Use /UserFiles/<username> scopes for personal accounts.
• Keep normal users out of /Media and /.
• Use HTTPS only.
• Do not expose the internal File Browser port directly to the internet.
• Keep File Browser, the reverse proxy, container runtime, and host OS updated.
• Disable unused accounts promptly.
• Review scopes and permissions regularly.
• Back up the File Browser database and important storage.
• Test recovery periodically.
• Keep passwords, tokens, API keys, and private configuration out of this wiki and Discord.

For service outages or possible security issues, contact the administrator team in The Twilight Zone Discord with:

• When the issue began
• Who is affected: one user, one folder, uploads, all users, or the complete service
• The exact error message and relevant recent logs
• Any recent storage, File Browser, reverse-proxy, DNS, account, or permission changes
• Actions already attempted

For normal-user instructions, see NAS Manager Help.