0e4ff2ebe482:/app# cat /etc/nginx/partials/security.conf
# security headers
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
# add_header X-Frame-Options           "DENY" always;
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
# add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
# add_header Permissions-Policy        "interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location /error/ {
  internal;
  alias /etc/nginx/error_pages/;
  default_type text/html;
  try_files $uri /error/50x.html;
}

# . files
location ~ /\.(?!well-known) {
  deny all;
}

networks:
  wiredoor:
    driver: bridge
    ipam:
      config:
        - subnet: 172.18.100.0/24

services:
  filebrowser:
    environment:
      FILEBROWSER_CONFIG: "/home/yeop/docker/filebrowser/data/config.yaml"
      #FILEBROWSER_ADMIN_PASSWORD: admin
      TZ: "Asia/Kuala_Lumpur" # optionally set your local timezone https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
    volumes:
      - '/home/yeop/fbdata:/srv' # Never mount root "/" directory to docker, always choose a sub-folder with your data.
      - './data:/home/yeop/docker/filebrowser/data' # mount the data folder you created with the config file.
  #   - '/srv:/home/yeop/docker/filebrowser/data'
  # (and if unraid) If you plan to run with a different user besides root or filebrowser, you will need to mount a tmp directory.
      #- './tmp/:/home/filebrowser/tmp/'
    ports:
      - '80:80' # the left 80 is the port **you will use** to access. The right 80 is the container port that **must match the config.yaml**
    image: gtstef/filebrowser
    container_name: filebrowser
    #hostname: filebrowser
    # Optionally run as non-root filebrowser user
    #user: filebrowser
    restart: unless-stopped
    networks:
      - wiredoor

  onlyoffice:
    image: onlyoffice/documentserver
    container_name: onlyoffice
    environment:
      JWT_SECRET: ${ONLYOFFICE_SECRET:?ONLYOFFICE environment variable is required in your .env file}
    ports:
      - '8080:80' # note this is HTTP, insecure, do not expose to internet
    networks:
      - wiredoor

  wiredoor-gw:
    image: wiredoor/wiredoor-cli:latest
    cap_add:
      - NET_ADMIN
   # sysctls:
   #   - net.ipv4.ip_forward=1
    environment:
      WIREDOOR_URL: ${WIREDOOR_URL:?WIREDOOR_URL environment variable is required in your .env file}
      TOKEN: ${WIREDOOR_TOKEN:?WIREDOOR_TOKEN environment variable is required in your .env file}
    networks:
      - wiredoor

server:
  port: 80
  baseURL:  "/"
  logging:
    - levels: "info|warning|error"
  sources:
    - path: "/home/yeop/docker/filebrowser/data/files"
      name: "mydata"
      config:
        defaultEnabled: true # this gives the source to all users by default.
  #externalUrl: "http://fb.domain.ovh" 
  internalUrl: "http://filebrowser" 
  database: "/home/yeop/docker/filebrowser/data/database.db"
integrations:
  office:
    url: "https://onlyoffice.domain.ovh"  
   # internalUrl: "http://fb.domain.ovh"  
    secret: IN2222222222222222222222222222Lb
auth:
  adminUsername: "admin"
  adminPassword: "sdd@#!der32423423"
userDefaults:
  preview:
    image: true
    popup: true
    video: false
    office: false
    highQuality: false
  darkMode: true
  disableSettings: false
  singleClick: true
  permissions:
    admin: false
    modify: false
    share: false
    api: false