Make sure /ro and other resources are protected (#248)

* Enable caddy file server by default

* Update readme

APP_VERSION

@@ -1 +1 @@
-6.1.1
+6.2.1

Caddyfile

@@ -9,6 +9,7 @@ redir /ui / 301
 redir /ui/ / 301
 redir /rclone /rclone/ 301
 redir /files /files/ 301
+redir /ro /ro/ 301
 
 reverse_proxy /rpc 127.0.0.1:6800
 reverse_proxy /jsonrpc 127.0.0.1:6800
@@ -23,6 +24,14 @@ route /files/* {
 	reverse_proxy 127.0.0.1:8080
 }
 
+route /ro/* {
+	uri strip_prefix /ro
+	root * /data
+	file_server {
+		browse "{$CADDY_FILE_SERVER_BROWSE_HTML}"
+	}
+}
+
 route /ping {
 	respond "app version: {env.APP_VERSION}"
 }

Dockerfile

@@ -41,6 +41,7 @@ ENV RCLONE_AUTO_UPLOAD_REMOTE_PATH=/downloads
 ENV RCLONE_AUTO_UPLOAD_FILE_MIN_SIZE=1K
 ENV RCLONE_AUTO_UPLOAD_FILE_MAX_SIZE=100G
 ENV FIX_DATA_VOLUME_PERMISSIONS=false
+ENV CADDY_FILE_SERVER_BROWSE_HTML=/app/browse.html
 
 ADD install.sh aria2c.sh caddy.sh filebrowser.sh Procfile init.sh start.sh rclone.sh new-version-checker.sh APP_VERSION /app/
 ADD conf /app/conf

HerokuCaddyfile

@@ -5,7 +5,9 @@
 
 :PORT
 
-basicauth / {
+@protected path / /index.html /css/* /js/* /ro /ro/* /jsonrpc
+
+basicauth @protected {
 	ARIA2_USER ARIA2_PWD_ENCRYPT
 }
 
@@ -13,6 +15,7 @@ redir /ui / 301
 redir /ui/ / 301
 redir /rclone /rclone/ 301
 redir /files /files/ 301
+redir /ro /ro/ 301
 
 reverse_proxy /jsonrpc 127.0.0.1:6800
 
@@ -26,6 +29,14 @@ route /files/* {
 	reverse_proxy 127.0.0.1:8080
 }
 
+route /ro/* {
+	uri strip_prefix /ro
+	root * /data
+	file_server {
+		browse "{$CADDY_FILE_SERVER_BROWSE_HTML}"
+	}
+}
+
 route /ping {
 	respond "app version: {env.APP_VERSION}"
 }

README.md

@@ -72,6 +72,7 @@ File Browser
 ```
 
 * Aria2: <http://yourip:8000>
+* Caddy File Server(Read Only) <http://yourip:8000/ro>
 * FileManger: <http://yourip:8000/files>
 * Rclone: <http://yourip:8000/rclone>
 * Please use `admin`/`admin` as username and password to login `Filebrowser` for the first time. And use `user`/`password` to login `Rclone` if you don't update `ARIA2_USER` and `ARIA2_PWD`
@@ -124,7 +125,8 @@ Then simply run `docker-compose up -d`, that's it!
 | ENV | Description|
 |:---|:---|
 | `ENABLE_AUTH` | Whether to enable Basic auth |
-| `ENABLE_RCLONE` | Whether to disable Rclone, if you running this container offline or do not have stable connection to Github, please set to `false`
+| `ENABLE_RCLONE` | Whether to disable Rclone, if you running this container offline or do not have stable connection to Github, please set to `false` |
+| `ENABLE_FILEBROWSER` | Whether to disable Filebrowser, set it to `false` to disable it, by default it's enabled |
 | `ARIA2_USER` | Basic Auth username, Rclone GUI uses it as well. |
 | `ARIA2_PWD` | Basic Auth password, Rclone GUI uses it as well. |
 | `ARIA2_EXTERNAL_PORT` | The Aria2 port which exposed to public to access to |

SecureCaddyfile

@@ -5,7 +5,9 @@ log {
 	output stderr
 }
 
-basicauth / {
+@protected path / /index.html /css/* /js/* /ro /ro/* /jsonrpc
+
+basicauth @protected {
 	ARIA2_USER ARIA2_PWD_ENCRYPT
 }
 
@@ -13,6 +15,7 @@ redir /ui / 301
 redir /ui/ / 301
 redir /rclone /rclone/ 301
 redir /files /files/ 301
+redir /ro /ro/ 301
 
 reverse_proxy /rpc 127.0.0.1:6800
 reverse_proxy /jsonrpc 127.0.0.1:6800
@@ -27,6 +30,14 @@ route /files/* {
 	reverse_proxy 127.0.0.1:8080
 }
 
+route /ro/* {
+	uri strip_prefix /ro
+	root * /data
+	file_server {
+		browse "{$CADDY_FILE_SERVER_BROWSE_HTML}"
+	}
+}
+
 route /ping {
 	respond "app version: {env.APP_VERSION}"
 }

filebrowser.sh

@@ -7,4 +7,5 @@ if [ "$ENABLE_FILEBROWSER" = "true" ]; then
     /app/filebrowser -p 8080 -d /app/filebrowser.db -r /data -b /files
 else
     echo "FileBrowser is disabled. Set ENABLE_FILEBROWSER=true to enable it."
+    sleep 3650d
 fi

install.sh

@@ -42,6 +42,7 @@ groupadd junv \
   && tar -zxf ${caddy_file} \
   && mv caddy /usr/local/bin/ \
   && rm -rf ${caddy_file} \
+  && wget -P /app -N https://raw.githubusercontent.com/glowinthedark/caddy-file-server-browse-extension/39e997c91539d0f04fcce53a3cb6605b2ae9e50c/browse.html \
   && platform=linux-amd64 \
   && wget -N https://github.com/filebrowser/filebrowser/releases/download/${filebrowser_version}/${filebrowser_file} \
   && tar -zxf ${filebrowser_file} \