# filex documentation Self-hosted file manager - a Go backend with a Vue 3 / React / Web Component frontend, and pluggable **storage**, **auth**, **DB** and **queue** drivers. New here? Start with [Installation](INSTALLATION.md), then add a storage ([Storage](STORAGE.md)) and, if you want, sign-in via [SSO](SSO.md). ## Getting started - [Installation](INSTALLATION.md) - minimal → full Compose → Helm → binary, and [nightly builds](INSTALLATION.md#nightly-builds) (the image and the desktop app of every night that passed its tests, on filex.sh/nightly and the Snap Store's `edge`; not supported) - [Configuration](CONFIGURATION.md) - every `FILEX_*` variable + `config.yaml`, and [which variables only seed a setting](CONFIGURATION.md#variables-that-seed-a-stored-setting) that then lives on the admin panel (0.57: the server defaults, `FILEX_TRUSTED_PROXIES`, the external services; `filex settings reseed`) - [Features](FEATURES.md) - every feature as its own entry: how it behaves, its limits and the guide that documents it - [Admin panel](ADMIN-PANEL.md) - the administrator's menu: where every page lives (Files & storage, People, Settings, Maintenance & records), who is offered which page, the keyboard, screen readers and the phone's drawer; and the panel's [search](ADMIN-PANEL.md#search) (pages, settings, people, API keys, apps, storages, shares, files, the `file:` / `user:` … prefixes, recent searches), and the warning under [every setting that turns a protection off](ADMIN-PANEL.md#settings-that-turn-a-protection-off) (0.59) - [Databases](DATABASES.md) - SQLite, PostgreSQL, MySQL/MariaDB: which to pick, what each needs, and what "supported" is checked to mean - [Releases](RELEASES.md) - every release with a plain-English summary (generated from the GitHub releases when a release is cut, by `npm run releases`) - [Updates](UPDATES.md) - how filex checks for, and installs, a new release - [Demo mode](DEMO.md) - running filex as a public playground: the published account (counted per address, never locked for everybody), the read-only guard over the whole admin surface - the MCP admin tools included - and what a demo does *not* publish (the visitors' and the operator's addresses) ## Storage - [Storage](STORAGE.md) - how mounts work, adding one, and the adapters: local · S3 / S3-compatible · SFTP · WebDAV · FTP · SMB/CIFS - including [symlinks inside a local storage](STORAGE.md#symlinks) and the *Follow symlinks that leave this folder* option - [Private and self-signed certificates](STORAGE.md#private-and-self-signed-certificates) - trust the CA and keep the check on, or turn it off for one storage or replication target (0.59); turning it on for a saved connection needs the password typed again - [Moving files between storages](STORAGE.md#moving-files-between-storages) - what copy, cut and drag mean when the two ends are different storages - [Ordering storages](STORAGE.md#ordering-storages) - the order the navigation panel lists the drives in: each person's own (drag, or the row menu), else the one the administrator set on the Storages page, else creation order - [NAS over NFS / SMB](STORAGE.md#nas-nfs-smb-and-friends) - mount it with the OS, serve it with `local`, and the three traps that come with it - [Slow storage](STORAGE.md#slow-storage) - what is already cached, and what is actually worth tuning - [Lazy catalogue](LAZY-CATALOGUE.md) - `sync_mode: lazy`, **Live watching**, the default for a new local storage: list the opened folder from disk at once, catalogue it first, fill in the rest in the background or only on open; the deletion-safety invariant, the watch budget, network filesystems (no watch, every open from disk) and what search, sizes and usage say meanwhile - [Usage & cost](USAGE.md) - reading the provider's own daily report, pricing it with a table you can edit, and the two rows that must never be added together - [filex-watch](FILEX-WATCH.md) - when a storage's disk is on another machine (a NAS share, an SFTP server): the small agent that runs there and reports the folders that change, its key, install on Linux, Docker, Windows and macOS, settings, the protocol and troubleshooting - [Storage plugins](PLUGINS.md) - teaching filex a backend it does not ship: installing one, upgrading it in place, and writing one (the protocol, the Go SDK, presigned URLs and multipart) - plus **conformance**, the probes that refuse a plugin which cannot do what it claims, and [updates from a source](PLUGINS.md#updates-from-a-source) that wait for your review, [installing one from an app store](PLUGINS.md#installing-from-a-store) (0.55: pinned, signed and checked by the store's [plugin validator](PLUGINS.md#the-stores-plugin-validator), a paid one's license), [what a signature covers](PLUGINS.md#what-is-signed) (0.55: the plugin, its version, its platform and its SHA-256; the old SHA-256-only form taken with a warning during its [compatibility window](PLUGINS.md#compatibility-window)), each plugin's [log](PLUGINS.md#plugin-log), and [an entry the storage could not answer for](PLUGINS.md#an-entry-your-stat-cannot-answer-for) (kept, marked, and left alone until the storage answers) - [Apps (app plugins)](APP-PLUGINS.md) - sandboxed WebAssembly apps that add actions to the file menu, screens filex draws for them, and public links for outside participants: the five that ship (**e-Signature**, `BRF-Tech/filex-sign`, **Convert**, `BRF-Tech/filex-convert`, the **Office editor**, `BRF-Tech/filex-office-editor`, **filextext**, `BRF-Tech/filextext-app`, and **draw.io**, `BRF-Tech/filex-drawio`), installing one from GitHub through the permission review, or [from a store](APP-PLUGINS.md#installing-from-a-store) - its [paid apps](APP-PLUGINS.md#paid-apps), and [the store screen](APP-PLUGINS.md#the-store-screen) where the people of this filex browse a store's catalog and ask for an app (0.53) - [install requests](APP-PLUGINS.md#install-requests) (an API key asks, an administrator decides), what the administrator controls, [app permissions](APP-PLUGINS.md#app-permissions) handed out per role and per person, [updates](APP-PLUGINS.md#updates) that each wait for an administrator and [going back](APP-PLUGINS.md#going-back) to the previous version, [an app's own interface](APP-PLUGINS.md#an-apps-own-interface) (a viewer for a file type, in a sandboxed frame; 0.55: frames of its own package, `blob:` reads and printing through filex, each asked for and shown in the review; 0.56: an app that asks for encrypted folders edits a file of an unlocked folder or an open vault, which the browser decrypts for it and encrypts again, and one that asks for editing together runs its session through filex's relay - the server decrypts nothing for an app), apps that wake up on their own, [signing documents end to end](APP-PLUGINS.md#signing-documents-end-to-end) (inside and outside signers, PINs, deadlines, the audit trail, verifying, your own certificate authority), [converting files](APP-PLUGINS.md#converting-files), [default apps](APP-PLUGINS.md#default-apps-which-app-opens-a-file-and-which-draws-its-thumbnail) (which app opens a kind of file and which draws its thumbnail, Open with and "Always use this app"), [setting an app up](APP-PLUGINS.md#setting-an-app-up) (0.60: its wizard, the addresses it answers on, Reconfigure, [an app's own data](APP-PLUGINS.md#an-apps-own-data)), [short links](APP-PLUGINS.md#short-links) through an app holding the link-shortener role, what guards an app's public links, limits, troubleshooting - [Writing an app plugin](PLUGIN-KIT.md) - the manifest (and the [user permissions](PLUGIN-KIT.md#user-permissions-what-an-administrator-hands-out) an app declares for the administrator to hand out), the [compatibility window](PLUGIN-KIT.md#compatibility-window) filex keeps for an app built for an earlier release, the exports, every host function and its permission, the screen catalogue, **an app's own interface** (HTML/JS in a sandboxed frame, the `@brftech/filex-app-ui` SDK, with or without a module), the **hourly wake-up** that lets an app schedule its own work to the minute, the test kit that runs before the wasm build, and a signing walk-through with stock Go - [App plugin wire contract](APP-PLUGINS-API.md) - the exact routes, JSON shapes and frontend conventions the explorer, admin panel and public shell are built against; [printing a PDF](APP-PLUGINS-API.md#printing-a-pdf-uiprint-055) (`ui.print`: filex's print page, asked every time, printed on the person's *Allow*), [which rows say `encrypted`](APP-PLUGINS-API.md#which-rows-say-encrypted) [a file of an encrypted folder, in the clear](APP-PLUGINS-API.md#a-file-of-an-encrypted-folder-in-the-clear-encrypted_folders-056) (`encrypted_folders`, `files:e2e-plaintext`, 0.56) and [editing together](APP-PLUGINS-API.md#editing-together-coedit-056) (`coedit.*` through filex's relay, `files:co-edit`, 0.56; defined in 0.55) ## Language & direction - [Writing a language pack](PLUGIN-KIT.md#writing-a-language-pack) - adding a language to filex without waiting for a release: what makes a manifest a language pack, the exported catalogue and the per-key context that comes with it, the byte limits, CLDR plural categories (`_few` …), the `server.*` table that carries the text the server writes - mail, notifications, the pages behind a link - and the validator that refuses a pack this version would not accept. Spanish, German and French ship as examples, and `BRF-Tech/filex-lang-template` is the template to start from - [Right-to-left languages](RTL.md) - how filex turns for Arabic, Hebrew, Persian, Urdu: the one list that decides, the `dir` rule for pages and embeds, what never mirrors (document space, machine text), mixed-direction text, and the logical-properties rule the RTL guard test enforces ## Reaching filex without a browser - [Protocols](PROTOCOLS.md) - the map: which protocols filex connects *to*, which it can be *reached as*, and the credential each one takes; FTPS refuses [plain FTP](PROTOCOLS.md#plain-ftp) until an administrator allows it (0.59) - [WebDAV](WEBDAV.md) - mapping a drive from Windows / macOS / Linux - [`filex mount`](PROTOCOLS.md#filex-mount) - a remote server over ordinary HTTPS: a folder on Linux, a drive letter on Windows; ⚠ not a sync, and not available on macOS - [CLI client](CLI.md) - `filex client` and `filex sync` against a remote server: [copy and move](CLI.md#mkdir--rm--mv--cp) across storages, [the trash and versions](CLI.md#trash--versions), [tags](CLI.md#tag), [app actions](CLI.md#actions--run), [archives](CLI.md#archive), [plugin install requests](CLI.md#plugin-requests), [signing in to a tenant by its realm](CLI.md#multi-tenant-servers-the-realm) and [`filex encrypt`](CLI.md#filex-encrypt---make-a-folder-an-encrypted-folder) and [`filex vault`](CLI.md#filex-vault---a-vault-on-a-server) from the command line, a refusal printed as the server's own sentence; a saved session goes only to the address it was saved with ([connecting](CLI.md#connecting)), and so does [the switch for a self-signed certificate](CLI.md#a-server-with-a-self-signed-certificate) (0.59); and [`filex plugin-validator`](CLI.md#filex-plugin-validator---an-app-stores-conformance-runner), the conformance runner an app store runs storage plugin builds through (0.55) ## Authentication & access - [SSO (OIDC)](SSO.md) - sign in with Keycloak / Auth0 / Authentik / Okta / … - [LDAP & reverse-proxy auth](LDAP.md) - Active Directory / LDAP, groups and [directory sync](LDAP.md#directory-sync), several directories, header auth - [Sign in with an operating-system account](OS-LOGIN.md) - Windows (local or domain) and Linux PAM, the first-sign-in rule, the e-mail token, and how the provider is tested - [Bot protection (CAPTCHA)](BOT-PROTECTION.md) - Cloudflare Turnstile or Google reCAPTCHA on the sign-in, a link's PIN and a file request's upload, with a local proof of work when the provider cannot be reached (0.58) - [Sign-in attempt limits](CONFIGURATION.md#sign-in-attempt-limits) - wrong passwords counted per account and per address on the web form, WebDAV, FTPS and SFTP, the lock that doubles up to 15 minutes, the IP allow-list, the **Sign-in security** page and its API, and [`FILEX_TRUSTED_PROXIES`](CONFIGURATION.md#server--networking): the proxies whose `X-Forwarded-For` filex believes - by default [`auto`](CONFIGURATION.md#trusted-proxies), worked out from where filex runs (a proxy on the host in front of the container, on another machine, or a public hop such as a CDN's edge has to be listed; the page names one that is not) - [Requests from other origins](CONFIGURATION.md#requests-from-other-origins) - why a change sent from another site with a visitor's session is refused (`403 cross_origin_refused`), what passes with no setting, and `FILEX_CORS_ALLOWED_ORIGINS` for a page of yours that needs it - [Security headers and framing](CONFIGURATION.md#security-headers-and-framing) - who may show filex's pages in a frame (`FILEX_FRAME_ANCESTORS`: a home dashboard, and since 0.55 the sites the web component runs on when its apps print, since filex's print page is framed there) - [RBAC, folder access & API tokens](RBAC.md) - account roles, per-storage RBAC, per-item grants (**Admin → Folder access**), what an API token's verbs allow on every surface, [comments, a permission with a level](RBAC.md#permissions-with-a-level-comments) (`comments:rw` to add and delete one, since 0.53), and the acts that need an administrator signed in - [Roles & per-user permissions](PERMISSIONS.md) - what an account may do: 30 permissions, built-in and custom roles, per-person exceptions, delegated admins, the permissions installed apps declare, public links that follow their creator's right to share, per-protocol enforcement - [Groups](GROUPS.md) - named sets of people: folder access and a role for everyone in them, members by hand or through the groups a sign-in carries (OIDC, LDAP, operating system, header proxy), per tenant ## Integrations - [AI assistant](AI-ASSISTANT.md) - the assistant in the explorer (0.57): Anthropic, OpenAI or an OpenAI-compatible server, or a fully local Ollama; it works through the MCP tools as the person who asks, a change that can be undone carries Undo and one that cannot waits on an approval card, encrypted folders and the vault never reach a model, every file content sent is audited, the `ai.assistant` permission, conversations kept per person on the server - [Office editing](ONLYOFFICE.md) - in-browser editing of Office documents: [the Office editor app](ONLYOFFICE.md#the-office-editor-app) (no Document Server, alone or together; from its 0.4.0 its [office engine](ONLYOFFICE.md#the-office-engine-without-a-document-server) also draws office thumbnails and runs the apps' office conversions on the server), and [an ONLYOFFICE Document Server](ONLYOFFICE.md#the-onlyoffice-document-server-optional), supported and optional; New document, and [drafts](ONLYOFFICE.md#drafts-nothing-is-in-the-folder-until-you-save): nothing is in the folder until you save; the three addresses that must work, the **Test** that fetches through a document's own door and warns when JWT is off, and [what "Download failed" was](ONLYOFFICE.md#failure-editor-shows-download-failed) (the editor says which of its two failures it was), and [CSV files](ONLYOFFICE.md#csv-files): a `.csv` opens in ONLYOFFICE's spreadsheet and is saved back as the same kind of CSV - its delimiter, line ends and encoding (0.51); [when the document changes while it is open](ONLYOFFICE.md#when-the-document-changes-while-it-is-open) (never saved over: reloaded, or a question) and [the editor in a frame of its own](ONLYOFFICE.md#the-editor-in-a-frame-of-its-own) (`FILEX_ONLYOFFICE_FRAME_ORIGIN`: the editor's script on the Document Server's origin, not in filex's pages) (0.53); [the editor's language](ONLYOFFICE.md#the-editors-language): each person's own filex language, or one for everybody (`FILEX_ONLYOFFICE_LANG`) (0.54) - [The Office editor app](OFFICE-EDITOR.md) - what the app does from its 0.4.0 (filex 0.57): 45 kinds in the browser (`.doc`, `.xls`, `.ppt`, `.rtf`, `.csv` and the templates included), saves beside the file and conflict copies, password-protected documents, dictionaries, macros, editing together and encrypted folders; on the server the office engine (`engine.zip`, x2t and the editor's layout in WebAssembly) that draws office thumbnails and runs the apps' office conversions; installing and updating it, which release for which filex, running without a Document Server, moving from one (the External services row the environment leaves behind), known limits ## Features - [Desktop app](DESKTOP.md) - Windows/Linux/macOS app: multiple accounts, background sync, [dragging files out onto the desktop](DESKTOP.md#dragging-files-out), [opening Office documents off your own disk](DESKTOP.md#opening-documents-from-your-computer) ([a save in another format](DESKTOP.md#a-save-in-another-format), [when the file changes while it is open](DESKTOP.md#when-the-file-changes-while-it-is-open)), [the App store in a window](DESKTOP.md#the-app-store), [a portable Windows copy that installs nothing](DESKTOP.md#portable-windows), [the notification bell and your account menu in the window](DESKTOP.md#notifications-and-your-account), [the account's language, which is the app's](DESKTOP.md#language) (0.54), [the sync engine's own sentences under each folder](DESKTOP.md#the-engines-event-stream) (0.54), [the web app installed on a phone or a tablet](DESKTOP.md#on-a-phone-or-a-tablet-the-web-app), and on Linux [Chromium's sandbox](DESKTOP.md#appimage-on-recent-ubuntu) (the one-time AppArmor profile an AppImage needs on recent Ubuntu; the snap relies on [its strict confinement instead](DESKTOP.md#the-snap-and-the-sandbox), and is built on `core24` since 0.55); [updates](DESKTOP.md#updates), each release first installed over the previous one on Windows and Ubuntu, x64 and arm64 (0.55) - [Folder sync](SYNC.md) - how a folder on your PC is kept in step with the server; [the engine's event stream](SYNC.md#the-event-stream---json) a program (the desktop app) reads instead of its lines, and [`filex sync window`](SYNC.md#filex-sync-window) - [Uploaders](UPLOADERS.md) - a key for one program - ShareX (a one-file `.sxcu` made for you, or a template for any filex server), curl, a phone shortcut, a script - that puts files into one folder and answers each with a public or private link and a deletion link whose opening never deletes; the key opens nothing else (0.60) - [Mail and page templates](TEMPLATES.md) - every mail and every page a link opens as a Liquid template the administrator (or a tenant's administrator) rewrites, with a live preview and a test mail; the public link page's frame, its text slots and the class names its CSS can rely on; the pages of an app's public address (0.60.1); the sandbox, the sanitizer and the Content-Security-Policy behind them (0.60) - [Uploads](UPLOADS.md) - the staged, resumable upload path: chunked, works on every driver, survives a dropped connection - [File names](FILE-NAMES.md) - the names filex refuses (and the one rule every door asks), a name too long for its storage, invisible and right-to-left override characters, spaces at the ends, composed and decomposed spellings, what each surface does with a name it cannot carry, and the one list of hostile names every surface is tested with - [Sharing & file requests](SHARING.md) - public download links + upload/file-drop; **My shares** and reading a link's PIN back, the one branded public screen and its PIN lock-out, the maximum link life, how the folder-ZIP cache is bounded, and [a link that follows its creator](SHARING.md#a-link-follows-its-creator); a link's state (active, expired, used up, revoked) and the download command the server writes for it, and [emailing a link](SHARING.md#emailing-a-link): the mail written by the server from the link, never with its PIN (0.54) - [Thumbnails](thumbnails.md) - image, SVG (a built-in engine, on every install), HEIC/AVIF, video, PDF, Office, text and archive previews; [folder previews](thumbnails.md#folder-previews); thumbnails that follow their file; [thumbnails drawn by apps](thumbnails.md#thumbnails-drawn-by-apps-one-chain-per-kind); and [Admin → Tools → Thumbnail repair](thumbnails.md#repair-catching-up-existing-files) - [Search](SEARCH.md) - embedded full-text index: forgiving filename matching (separators, several words in any order, folders, typos), VS Code-style subsequence scoring, ranked results, `tag:` filters, an index that rebuilds itself after an upgrade without going dark, and [narrowing a search on the server](SEARCH.md#narrowing-a-search) by type, date, size, folder and owner (0.54) - [Realtime updates & presence](REALTIME.md) - the WebSocket an open explorer runs on: the ticket, the change and presence frames, how a burst is coalesced (and why a plain trailing debounce starves), the 12 s polling fallback, and [`access.changed`](REALTIME.md#when-access-changes), sent when a grant, a role or an encryption policy changes (0.54), and [editing together's socket](REALTIME.md#editing-togethers-socket) (0.56) - [Notifications](NOTIFICATIONS.md) - webhook + in-app bell: the unread badge, the full list inside the explorer for everybody, where a click goes, and the optional [digest](NOTIFICATIONS.md#the-digest) (kinds turned off are told once per window, folder by folder; out of the box everything is told at once); [what a notification says](NOTIFICATIONS.md#what-a-notification-says) - the server's sentence on every channel, in [each receiver's language](NOTIFICATIONS.md#which-language), a webhook's own among them - and [Web Push](NOTIFICATIONS.md#web-push) to a phone or a browser with filex closed (0.54) - [Trash & versioning](TRASH-VERSIONING.md) - soft-delete/restore + file history; [the trash endpoints](TRASH-VERSIONING.md#trash-endpoints): a paged trash, and the server's own count of what *Empty trash* deletes (0.54) - [Replication](REPLICATION.md) - primary→replica mirroring, the initial copy of a linked storage & reconcile - [Quotas](QUOTAS.md) - per-user ceilings: what counts, when it is released, and how a public drop link is billed - [Protection & antivirus](PROTECTION.md) - ClamAV scanning, through a local binary or a clamd daemon over TCP or a unix socket, plus the trash and version retention windows, the share-link life ceiling and how many drafts a person may keep, behind one admin screen - [Archives](ARCHIVES.md) - ZIP/7z/TAR creation, multi-format extraction and encryption providers - [End-to-end encryption](E2E-ENCRYPTION.md) - client-side WebCrypto folders at a level of the owner's choosing: contents only (the default), or contents and names; the server stores ciphertext and never receives a key. Encrypting a folder you already have, a single file (`.fxe`), files of any size (the streamed format), downloading a decrypted copy, recovery keys, optional operator key escrow, `filex decrypt` for taking a folder or a file out, `filex encrypt` for making one on the command line, exactly what each one can and cannot open, and [who may encrypt](E2E-ENCRYPTION.md#who-may-encrypt): a tenant's policy, the files.encrypt permission and an administrator's approval, asked for with a reason (0.51); and [editing in an app](E2E-ENCRYPTION.md#editing-in-an-app): an app you allow edits a file of an unlocked folder or an open vault, your browser decrypting it for the app and encrypting the save (0.56) - [End-to-end encryption roadmap](E2E-ROADMAP.md) - what is built (`filex encrypt` and large files in an in-place conversion since 0.50, the vault level in 0.54, editing in an app in 0.56) and the decisions behind the vault level - [Vault format](E2E-VAULT-FORMAT.md) - level 3, built and off by default (`FILEX_E2E_VAULT`): the normative format (packs, the encrypted index, keys and the nonce rule), the server's single-writer lock and API, garbage collection, and the test vectors - a repack among them - the browser, the server and the command line are held to - [Editing encrypted office documents](E2E-OFFICE.md) - the design of editing a document in an encrypted folder with ONLYOFFICE in the browser, alone or with others, without a server reading it (the editor's Document Server answered in the browser, a relay that orders sealed entries), and what of it exists: filex 0.56 carries filex's half (the relay, and the document handed over and taken back by the browser); the editor's side is an AGPL app of its own (`filex-office-editor`: 0.2.0 and 0.3.0/0.3.1 for filex 0.56, 0.4.0 for filex 0.57 - [OFFICE-EDITOR.md](OFFICE-EDITOR.md)), and filex provides the platform it runs on; how the app prints (filex's `ui.print`) and [what it does on a phone](E2E-OFFICE.md#on-a-phone) (it reads, **Edit** opens the folded desktop editor) - [Multi-tenancy](MULTI-TENANCY.md) - provider/tenant mode and its switch on Admin → Multi-tenant mode, per-tenant isolation on one instance, and [realms](MULTI-TENANCY.md#realms-which-tenant-a-sign-in-is-for): the tenant's sign-in name - the Realm field, `realm/name` over SFTP, the tenant's own address on WebDAV and FTPS, and the handoff to a tenant's address - [Tenant self-service](TENANT-ADMIN.md) - the Tenants screen, sign-in providers bound to tenants, a tenant's own OIDC and LDAP, platform subdomains, own domains proven by a CNAME and their certificates ## Deployment - [Deployment](DEPLOYMENT.md) - reverse proxy, HTTPS, serving under a sub-path (`/filex/`), scaling, backup - [Docker](DOCKER.md) - images, compose details, and which user the container runs as - [Metrics](METRICS.md) - the Prometheus surface, how to scrape it, and the handful of alerts worth having; [the row gate's](METRICS.md#the-row-gate) changes, fences and deferred scan judgements (0.55) - Packaging in the repo: [`deploy/compose/`](../deploy/compose/) (minimal + full) and [`deploy/helm/filex/`](../deploy/helm/filex/) (Kubernetes; published as `brf-tech/filex` at `https://helm.brf.sh` - [INSTALLATION.md → Kubernetes (Helm)](INSTALLATION.md#kubernetes-helm)) ## Develop & integrate - [Architecture](ARCHITECTURE.md) - how the pieces fit, and [the row gate](ARCHITECTURE.md#the-row-gate): why a rename, move or delete on any surface and the storage scan never cross, and how a long one fences only its own paths (0.55: every surface) - [Backend](BACKEND.md) - internals; the routes under `/api/files` and `/api/ai` are also an [OpenAPI 3.1 description](../backend/internal/api/openapi.json), held to the router by a test - [HTTP / component API](API.md) - [API errors](API-ERRORS.md) - the one shape of a refusal (`error` code, `message` written by the server in the reader's language), the codes, a failed queue operation's `error_text`, app locks and sign-in refusals; [app store](API-ERRORS.md#app-store-refusals), [plugin request](API-ERRORS.md#plugin-request-refusals) and [app install](API-ERRORS.md#app-install-refusals) refusals (0.55) - [Themes & appearance](INTEGRATION.md#themes) - the shipped palettes, an operator's own themes and instance default (Admin → **Appearance**), and the custom stylesheet that is off until you switch it on; and [branding](CONFIGURATION.md#branding-white-label): the instance's name, logo and accent, which [the installed app](CONFIGURATION.md#the-installed-app-pwa) wears too (0.56) - [Embedding the explorer](INTEGRATION.md) - Vue / React / Web Component, and the two options every wrapper shares: the **navigation panel** (`sideNav`) and how much of the explorer to show (`uiProfile`: `standard` · `simple` - two values, and the third one, `drive`, was **removed** after v0.40.0; pass `simple`); an app that prints from an embed on another site needs that site in `FILEX_FRAME_ANCESTORS` (0.55) - [AI & MCP](MCP.md) - API tokens (including the `user` / `app` token kinds), the permissions a token names - at least one, and never a blank list meaning all of them, and holding on every surface the token reaches - the ceiling that stops a narrow token issuing a wider credential (`403 token_ceiling`), the MCP endpoint for agents, the [plugin tools](MCP.md#plugin-tools) that read plugins and leave install requests, and credential-free upload tickets for large local files ## Repo only - not published to docs.filex.sh These live in the repo and are deliberately kept off the published site (`srcExclude` in `docs-site/.vitepress/config.mts`) - ⚠ a page VitePress builds is reachable by URL and indexable whether or not anything links to it, so "leave it out of the sidebar" is not the same as "do not publish it". ⚠ Linked by full URL rather than relatively: a relative link to a page the site does not build is a **dead link that fails the docs build**, which is how this list was written the first time. - [Cloud preparation](https://github.com/BRF-Tech/filex/blob/main/docs/CLOUD.md) - scaffolding for a hosted offering that has **not** launched; publishing it would announce a service that does not exist - **This page.** `docs/README.md` is the index GitHub renders when you open `docs/`, and it stays in the repository - but the site already has a home page and a sidebar, so publishing it put a second, competing table of contents at `/README`, one whose last section explains which pages are kept off the site. That is a note for contributors, not for readers ⚠ Three more are excluded from the site **and** from this repository, so they are deliberately listed without links - a deployment runbook carrying one installation's real host names and paths, and two migration guides written for downstream applications that were never public (`MIGRATION.md`, off the in-tree `@brftech/file-explorer`, and `MIGRATION_FISHAPP.md`). They would be dead links here, which is exactly the failure the note above describes. > `MIGRATION.md` was the third case and did not look like one: it was stripped > from the public repository like the other two, but nothing removed the links > to it, and it was not in `srcExclude` - so the published site carried it > while the published README pointed at a file that is not there. Handover notes under `docs/handovers/` are excluded by glob for the same reason: they are working notes between maintainers, and the next one must be excluded by default rather than by somebody remembering to add it. --- Found something wrong or missing? Please open an issue - see [CONTRIBUTING.md](CONTRIBUTING.md).