patches on sxsw ai working api key working container hardened plus many more

2026-03-12 22:19:04 +00:00
parent 73e0a1b74d
commit 5e6aaa74aa
14 changed files with 625 additions and 46 deletions
--- a/scripts/deploy-to-target.sh
+++ b/scripts/deploy-to-target.sh
@@ -64,6 +64,20 @@ if ! ssh $SSH_OPTS -o ConnectTimeout=5 "$TARGET_HOST" "echo ok" >/dev/null 2>&1;
 fi
 echo "   Connected."

+# Install prerequisites if missing (rsync for code sync, python3 for Claude API proxy)
+echo "$(timestamp) Checking prerequisites..."
+ssh $SSH_OPTS "$TARGET_HOST" '
+  NEED_INSTALL=""
+  command -v rsync >/dev/null 2>&1 || NEED_INSTALL="$NEED_INSTALL rsync"
+  command -v python3 >/dev/null 2>&1 || NEED_INSTALL="$NEED_INSTALL python3"
+  if [ -n "$NEED_INSTALL" ]; then
+    echo "   Installing:$NEED_INSTALL"
+    sudo apt-get update -qq && sudo apt-get install -y -qq $NEED_INSTALL 2>&1 | tail -3
+  else
+    echo "   All prerequisites present"
+  fi
+' 2>&1
+
 # Pre-deploy health check (informational — warns but does not block)
 TARGET_IP_ONLY="$(echo "$TARGET_HOST" | cut -d@ -f2)"
 PRE_HEALTH=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 "http://$TARGET_IP_ONLY/health" 2>/dev/null || echo "000")
@@ -80,10 +94,11 @@ if [ "$BOTH" = true ]; then
    "$0" --live
    echo ""
    echo "📤 Copying to 192.168.1.198 (no rsync/cargo on that node)..."
+    TARGET_198="archipelago@192.168.1.198"
    scp $SSH_OPTS archipelago@192.168.1.228:$TARGET_DIR/core/target/release/archipelago /tmp/archipelago-both 2>/dev/null || true
-    scp $SSH_OPTS /tmp/archipelago-both archipelago@192.168.1.198:/tmp/archipelago-new
-    ssh $SSH_OPTS archipelago@192.168.1.228 "cd $TARGET_DIR && tar cf - web/dist/neode-ui 2>/dev/null" | ssh $SSH_OPTS archipelago@192.168.1.198 "mkdir -p /tmp/web-deploy && cd /tmp/web-deploy && tar xf -"
-    ssh $SSH_OPTS archipelago@192.168.1.198 '
+    scp $SSH_OPTS /tmp/archipelago-both "$TARGET_198:/tmp/archipelago-new"
+    ssh $SSH_OPTS archipelago@192.168.1.228 "cd $TARGET_DIR && tar cf - web/dist/neode-ui 2>/dev/null" | ssh $SSH_OPTS "$TARGET_198" "mkdir -p /tmp/web-deploy && cd /tmp/web-deploy && tar xf -"
+    ssh $SSH_OPTS "$TARGET_198" '
        sudo systemctl stop archipelago
        sudo cp /tmp/archipelago-new /usr/local/bin/archipelago
        sudo chmod +x /usr/local/bin/archipelago
@@ -91,10 +106,55 @@ if [ "$BOTH" = true ]; then
        sudo find /opt/archipelago/web-ui -mindepth 1 -maxdepth 1 ! -name "aiui" ! -name "claude-login.html" -exec rm -rf {} +
        sudo cp -r /tmp/web-deploy/web/dist/neode-ui/* /opt/archipelago/web-ui/ 2>/dev/null || true
        sudo chown -R 1000:1000 /opt/archipelago/web-ui
-        sudo systemctl start archipelago
-        sudo systemctl restart nginx
-        echo "   ✅ 192.168.1.198 deployed"
    '
+
+    # Deploy AIUI to 198 if available
+    AIUI_DIST="$PROJECT_DIR/../AIUI/packages/app/dist"
+    if [ -d "$AIUI_DIST" ] && [ -f "$AIUI_DIST/index.html" ]; then
+        echo "   Deploying AIUI to 198..."
+        ssh $SSH_OPTS "$TARGET_198" "sudo mkdir -p /opt/archipelago/web-ui/aiui && sudo rm -rf /opt/archipelago/web-ui/aiui/*"
+        cd "$AIUI_DIST" && tar cf - . | ssh $SSH_OPTS "$TARGET_198" "sudo tar xf - -C /opt/archipelago/web-ui/aiui/"
+        cd "$PROJECT_DIR"
+        ssh $SSH_OPTS "$TARGET_198" "sudo chown -R 1000:1000 /opt/archipelago/web-ui/aiui"
+    fi
+
+    # Sync nginx config + fixes to 198
+    NGINX_CFG="$PROJECT_DIR/image-recipe/configs/nginx-archipelago.conf"
+    if [ -f "$NGINX_CFG" ]; then
+        echo "   Syncing nginx config to 198..."
+        scp $SSH_OPTS "$NGINX_CFG" "$TARGET_198:/tmp/nginx-archipelago.conf" 2>/dev/null || true
+        ssh $SSH_OPTS "$TARGET_198" '
+            sudo cp /tmp/nginx-archipelago.conf /etc/nginx/sites-available/archipelago
+            sudo rm -f /etc/nginx/conf.d/external-app-proxies.conf
+            sudo sed -i "s|proxy_pass http://127.0.0.1:3141/;|proxy_pass http://127.0.0.1:3142/;|g" /etc/nginx/sites-available/archipelago
+            sudo nginx -t 2>&1 && echo "   nginx config OK" || echo "   nginx config test failed"
+            rm -f /tmp/nginx-archipelago.conf
+        ' 2>/dev/null || true
+    fi
+
+    # Dev mode + FileBrowser on 198
+    ssh $SSH_OPTS "$TARGET_198" '
+        # Dev mode
+        if ! grep -q "ARCHIPELAGO_DEV_MODE=true" /etc/systemd/system/archipelago.service.d/override.conf 2>/dev/null; then
+            sudo mkdir -p /etc/systemd/system/archipelago.service.d
+            printf "[Service]\nEnvironment=ARCHIPELAGO_DEV_MODE=true\n" | sudo tee /etc/systemd/system/archipelago.service.d/override.conf > /dev/null
+            sudo systemctl daemon-reload
+        fi
+        # FileBrowser fix
+        DOCKER=podman; command -v podman >/dev/null 2>&1 || DOCKER=docker
+        FB=$(sudo $DOCKER ps -a --format "{{.Names}}" 2>/dev/null | grep -x filebrowser || true)
+        if [ -n "$FB" ]; then
+            RO=$(sudo $DOCKER inspect filebrowser 2>/dev/null | grep -oP "\"ReadonlyRootfs\":\s*\K\w+" || echo "false")
+            if [ "$RO" = "true" ]; then
+                sudo $DOCKER stop filebrowser 2>/dev/null; sudo $DOCKER rm filebrowser 2>/dev/null
+                sudo mkdir -p /var/lib/archipelago/filebrowser
+                sudo $DOCKER run -d --name filebrowser --restart=always -p 8083:80 -v /var/lib/archipelago/filebrowser:/srv docker.io/filebrowser/filebrowser:v2.27.0 2>/dev/null
+            fi
+        fi
+    ' 2>/dev/null || true
+
+    ssh $SSH_OPTS "$TARGET_198" "sudo systemctl start archipelago && sudo systemctl restart nginx"
+    echo "   ✅ 192.168.1.198 deployed"
    rm -f /tmp/archipelago-both
    exit 0
 fi
@@ -192,6 +252,125 @@ if [ "$LIVE" = true ]; then
      ' 2>/dev/null || true
    fi

+    # Remove old port-based external app proxies (now handled via /ext/ paths in main nginx config)
+    ssh $SSH_OPTS "$TARGET_HOST" 'sudo rm -f /etc/nginx/conf.d/external-app-proxies.conf' 2>/dev/null || true
+
+    # Fix nginx Claude API proxy port (template uses 3141, proxy runs on 3142)
+    ssh $SSH_OPTS "$TARGET_HOST" 'sudo sed -i "s|proxy_pass http://127.0.0.1:3141/;|proxy_pass http://127.0.0.1:3142/;|g" /etc/nginx/sites-available/archipelago' 2>/dev/null || true
+
+    # Deploy Claude API proxy (auto-install if missing)
+    echo "$(timestamp)    Setting up Claude API proxy..."
+    ssh $SSH_OPTS "$TARGET_HOST" '
+      if systemctl is-active claude-api-proxy >/dev/null 2>&1; then
+        echo "   Claude API proxy already running"
+      else
+        echo "   Installing Claude API proxy on port 3142..."
+        # Check for API key in existing service or setup-aiui-server.sh
+        EXISTING_KEY=$(grep -oP "ANTHROPIC_API_KEY=\K.*" /etc/systemd/system/claude-api-proxy.service 2>/dev/null || true)
+        if [ -z "$EXISTING_KEY" ]; then
+          echo "   ⚠️  No ANTHROPIC_API_KEY found — run setup-aiui-server.sh first to configure"
+        else
+          # Proxy script
+          sudo tee /opt/archipelago/claude-api-proxy.py > /dev/null << '\''PYEOF'\''
+#!/usr/bin/env python3
+import http.server, json, ssl, sys, os, urllib.request, urllib.error
+API_KEY = os.environ.get("ANTHROPIC_API_KEY", "")
+PORT = 3142
+class Handler(http.server.BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path == "/health":
+            self.send_response(200); self.send_header("Content-Type","application/json"); self.end_headers()
+            self.wfile.write(b"{\"status\":\"ok\"}"); return
+        cl = int(self.headers.get("Content-Length", 0))
+        body = self.rfile.read(cl)
+        try: data = json.loads(body)
+        except: data = {}
+        if "max_tokens" not in data: data["max_tokens"] = 8096
+        for f in ["webSearch","web_search"]: data.pop(f, None)
+        body = json.dumps(data).encode()
+        headers = {"Content-Type":"application/json","x-api-key":API_KEY,"anthropic-version":"2023-06-01","anthropic-dangerous-direct-browser-access":"true"}
+        for h in ["anthropic-version","anthropic-beta"]:
+            if self.headers.get(h): headers[h] = self.headers[h]
+        req = urllib.request.Request("https://api.anthropic.com"+self.path, data=body, headers=headers, method="POST")
+        try:
+            ctx = ssl.create_default_context()
+            resp = urllib.request.urlopen(req, context=ctx, timeout=300)
+            self.send_response(resp.status)
+            is_stream = "text/event-stream" in (resp.headers.get("Content-Type","") or "")
+            for k,v in resp.headers.items():
+                if k.lower() not in ("transfer-encoding","connection"): self.send_header(k,v)
+            if is_stream: self.send_header("Transfer-Encoding","chunked")
+            self.end_headers()
+            if is_stream:
+                while True:
+                    chunk = resp.read(4096)
+                    if not chunk: break
+                    self.wfile.write(b"%x\r\n" % len(chunk)); self.wfile.write(chunk); self.wfile.write(b"\r\n"); self.wfile.flush()
+                self.wfile.write(b"0\r\n\r\n"); self.wfile.flush()
+            else: self.wfile.write(resp.read())
+        except urllib.error.HTTPError as e:
+            self.send_response(e.code); self.send_header("Content-Type","application/json"); self.end_headers(); self.wfile.write(e.read())
+        except Exception as e:
+            self.send_response(502); self.send_header("Content-Type","application/json"); self.end_headers(); self.wfile.write(json.dumps({"error":str(e)}).encode())
+    def do_GET(self):
+        if self.path == "/health":
+            self.send_response(200); self.send_header("Content-Type","application/json"); self.end_headers(); self.wfile.write(b"{\"status\":\"ok\"}")
+        else: self.send_response(404); self.end_headers()
+    def log_message(self, fmt, *args): pass
+if not API_KEY: print("ERROR: ANTHROPIC_API_KEY not set"); sys.exit(1)
+server = http.server.HTTPServer(("127.0.0.1", PORT), Handler)
+print(f"Claude API proxy on port {PORT}")
+server.serve_forever()
+PYEOF
+          sudo systemctl daemon-reload
+          sudo systemctl enable claude-api-proxy
+          sudo systemctl restart claude-api-proxy
+          sleep 1
+          echo "   Claude API proxy: $(systemctl is-active claude-api-proxy)"
+        fi
+      fi
+    ' 2>/dev/null || true
+
+    # Dev mode for Tailscale HTTP access (cookies need Secure flag disabled over plain HTTP)
+    echo "$(timestamp)    Checking dev mode..."
+    ssh $SSH_OPTS "$TARGET_HOST" '
+      if [ -f /etc/systemd/system/archipelago.service.d/override.conf ] && grep -q "ARCHIPELAGO_DEV_MODE=true" /etc/systemd/system/archipelago.service.d/override.conf 2>/dev/null; then
+        echo "   Dev mode already enabled"
+      else
+        echo "   Enabling dev mode (for Tailscale HTTP cookie support)..."
+        sudo mkdir -p /etc/systemd/system/archipelago.service.d
+        printf "[Service]\nEnvironment=ARCHIPELAGO_DEV_MODE=true\n" | sudo tee /etc/systemd/system/archipelago.service.d/override.conf > /dev/null
+        sudo systemctl daemon-reload
+        echo "   Dev mode enabled"
+      fi
+    ' 2>/dev/null || true
+
+    # Fix FileBrowser — recreate if read-only root, create if missing
+    echo "$(timestamp)    Checking FileBrowser..."
+    ssh $SSH_OPTS "$TARGET_HOST" '
+      DOCKER=podman
+      command -v podman >/dev/null 2>&1 || DOCKER=docker
+      FB_EXISTS=$(sudo $DOCKER ps -a --format "{{.Names}}" 2>/dev/null | grep -x filebrowser || true)
+      if [ -n "$FB_EXISTS" ]; then
+        RO=$(sudo $DOCKER inspect filebrowser 2>/dev/null | grep -oP "\"ReadonlyRootfs\":\s*\K\w+" || echo "false")
+        if [ "$RO" = "true" ]; then
+          echo "   FileBrowser has read-only root — recreating..."
+          sudo $DOCKER stop filebrowser 2>/dev/null
+          sudo $DOCKER rm filebrowser 2>/dev/null
+          sudo mkdir -p /var/lib/archipelago/filebrowser
+          sudo $DOCKER run -d --name filebrowser --restart=always -p 8083:80 -v /var/lib/archipelago/filebrowser:/srv docker.io/filebrowser/filebrowser:v2.27.0 2>&1 | tail -1
+          echo "   FileBrowser recreated"
+        else
+          echo "   FileBrowser OK"
+        fi
+      else
+        echo "   Creating FileBrowser..."
+        sudo mkdir -p /var/lib/archipelago/filebrowser
+        sudo $DOCKER run -d --name filebrowser --restart=always -p 8083:80 -v /var/lib/archipelago/filebrowser:/srv docker.io/filebrowser/filebrowser:v2.27.0 2>&1 | tail -1
+        echo "   FileBrowser created"
+      fi
+    ' 2>/dev/null || true
+
    # Restart services
    echo "$(timestamp)    Restarting services..."
    ssh $SSH_OPTS "$TARGET_HOST" "sudo systemctl start archipelago && sudo systemctl restart nginx"
@@ -243,6 +422,8 @@ if [ "$LIVE" = true ]; then
        echo '   Creating Bitcoin Knots (mainnet, archipelago RPC)...'
        sudo mkdir -p /var/lib/archipelago/bitcoin
        sudo \$DOCKER run -d --name bitcoin-knots --restart unless-stopped \$NET_OPT \
+          --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
+          --security-opt no-new-privileges:true \
          -p 8332:8332 -p 8333:8333 \
          -v /var/lib/archipelago/bitcoin:/home/bitcoin/.bitcoin \
          docker.io/bitcoinknots/bitcoin:latest \
@@ -420,6 +601,8 @@ if [ "$LIVE" = true ]; then
        echo '   Creating btcpay-server on 23000...'
        sudo mkdir -p /var/lib/archipelago/btcpay
        sudo \$DOCKER run -d --name btcpay-server --restart unless-stopped \$NET_OPT \
+          --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
+          --security-opt no-new-privileges:true \
          -p 23000:49392 \
          -v /var/lib/archipelago/btcpay:/datadir \
          -e ASPNETCORE_URLS=http://0.0.0.0:49392 \
@@ -589,6 +772,8 @@ PYEOF
        sudo \$DOCKER stop \"\$c\" 2>/dev/null
        sudo \$DOCKER rm -f \"\$c\" 2>/dev/null
        sudo \$DOCKER run -d --name fedimint --restart unless-stopped \
+          --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
+          --security-opt no-new-privileges:true \
          -p 8173:8173 -p 8174:8174 -p 8175:8175 \
          -v /var/lib/archipelago/fedimint:/data \
          -e FM_DATA_DIR=/data \
@@ -616,6 +801,8 @@ PYEOF
      if sudo \$DOCKER ps --format '{{.Names}}' | grep -q '^lnd\$' && sudo test -f \$LND_CERT && sudo test -f \$LND_MACAROON; then
        echo '   LND detected — using lnd mode'
        sudo \$DOCKER run -d --name fedimint-gateway --restart unless-stopped \
+          --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
+          --security-opt no-new-privileges:true \
          -p 8176:8176 \
          -v /var/lib/archipelago/fedimint-gateway:/data \
          -v /var/lib/archipelago/lnd/tls.cert:/lnd/tls.cert:ro \
@@ -629,6 +816,8 @@ PYEOF
      else
        echo '   No LND found — using ldk (built-in Lightning)'
        sudo \$DOCKER run -d --name fedimint-gateway --restart unless-stopped \
+          --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
+          --security-opt no-new-privileges:true \
          -p 8176:8176 -p 9737:9737 \
          -v /var/lib/archipelago/fedimint-gateway:/data \
          docker.io/fedimint/gatewayd:v0.10.0 \
--- a/scripts/first-boot-containers.sh
+++ b/scripts/first-boot-containers.sh
@@ -45,7 +45,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
  log "Creating Bitcoin Knots..."
  mkdir -p /var/lib/archipelago/bitcoin
  if $DOCKER run -d --name bitcoin-knots --restart unless-stopped --network archy-net \
-    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
    --security-opt no-new-privileges:true \
    -p 8332:8332 -p 8333:8333 \
    -v /var/lib/archipelago/bitcoin:/home/bitcoin/.bitcoin \
@@ -212,7 +212,7 @@ LNDCONF
    log "LND config created (archy-net → bitcoin-knots:8332, rpcpolling)"
  fi
  $DOCKER run -d --name lnd --restart unless-stopped --network archy-net \
-    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
    --security-opt no-new-privileges:true \
    -p 9735:9735 -p 10009:10009 -p 8080:8080 \
    -v /var/lib/archipelago/lnd:/root/.lnd \
@@ -224,7 +224,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint; then
  log "Creating Fedimint..."
  mkdir -p /var/lib/archipelago/fedimint
  $DOCKER run -d --name fedimint --restart unless-stopped --network archy-net \
-    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
    --security-opt no-new-privileges:true \
    -p 8173:8173 -p 8174:8174 -p 8175:8175 \
    -v /var/lib/archipelago/fedimint:/data \
@@ -246,7 +246,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint-gateway; th
  if $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q '^lnd$' && [ -f "$LND_CERT" ] && [ -f "$LND_MACAROON" ]; then
    log "  LND detected — using lnd mode"
    $DOCKER run -d --name fedimint-gateway --restart unless-stopped --network archy-net \
-      --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+      --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
      --security-opt no-new-privileges:true \
      -p 8176:8176 \
      -v /var/lib/archipelago/fedimint-gateway:/data \
@@ -261,7 +261,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q fedimint-gateway; th
  else
    log "  No LND found — using ldk (built-in Lightning)"
    $DOCKER run -d --name fedimint-gateway --restart unless-stopped --network archy-net \
-      --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+      --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID --cap-add DAC_OVERRIDE \
      --security-opt no-new-privileges:true \
      -p 8176:8176 -p 9737:9737 \
      -v /var/lib/archipelago/fedimint-gateway:/data \
@@ -303,8 +303,8 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q uptime-kuma; then
  log "Creating Uptime Kuma..."
  mkdir -p /var/lib/archipelago/uptime-kuma
  $DOCKER run -d --name uptime-kuma --restart unless-stopped \
-    --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m --tmpfs /run:rw,noexec,nosuid,size=64m \
+    --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --cap-add SETUID --cap-add SETGID \
+    --security-opt no-new-privileges:true \
    -p 3001:3001 -v /var/lib/archipelago/uptime-kuma:/app/data \
    -e TZ=UTC \
    docker.io/louislam/uptime-kuma:1 2>>"$LOG" || true
@@ -323,8 +323,8 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q photoprism; then
  log "Creating PhotoPrism..."
  mkdir -p /var/lib/archipelago/photoprism
  $DOCKER run -d --name photoprism --restart unless-stopped \
-    --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m --tmpfs /run:rw,noexec,nosuid,size=64m \
+    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID \
+    --security-opt no-new-privileges:true \
    -p 2342:2342 -v /var/lib/archipelago/photoprism:/photoprism/storage \
    -e PHOTOPRISM_ADMIN_PASSWORD=archipelago -e PHOTOPRISM_DEFAULT_LOCALE=en \
    docker.io/photoprism/photoprism:latest 2>>"$LOG" || true
@@ -342,8 +342,8 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q vaultwarden; then
  log "Creating Vaultwarden..."
  mkdir -p /var/lib/archipelago/vaultwarden
  $DOCKER run -d --name vaultwarden --restart unless-stopped \
-    --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m --tmpfs /run:rw,noexec,nosuid,size=64m \
+    --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
+    --security-opt no-new-privileges:true \
    -p 8082:80 -v /var/lib/archipelago/vaultwarden:/data \
    docker.io/vaultwarden/server:1.30.0-alpine 2>>"$LOG" || true
 fi
@@ -376,10 +376,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q filebrowser; then
  log "Creating File Browser..."
  mkdir -p /var/lib/archipelago/filebrowser /var/lib/archipelago/filebrowser-db
  $DOCKER run -d --name filebrowser --restart unless-stopped \
-    --cap-drop ALL --security-opt no-new-privileges:true \
-    --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m --tmpfs /run:rw,noexec,nosuid,size=64m \
    -p 8083:80 -v /var/lib/archipelago/filebrowser:/srv \
-    -v /var/lib/archipelago/filebrowser-db:/database \
    docker.io/filebrowser/filebrowser:v2.27.0 2>>"$LOG" || true
 fi
 if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -q nginx-proxy-manager; then