Enforce file permissions

.env.sample

@@ -3,9 +3,12 @@ COMPOSE_FILE=docker-compose.yml:dev.yml
 # For prod
 #COMPOSE_FILE=docker-compose.yml:traefik.yml
 NAME=filebrowser
+VERSION=v2
 # Hostname for prod `FQDN` ex HOSTS=`files.example.org`
 HOSTS=
 DEV_PORT=8080
 DATA_PATH=./data/files
 UID=1000
 GID=1000
+DEFAULT_PERMS_DIR=755
+DEFAULT_PERMS_FILE=644

docker-compose.yml

@@ -2,8 +2,14 @@ version: "3"
 
 services:
   filebrowser:
-    image: filebrowser/filebrowser:v2
+    build:
+      context:  docker/
+      args:
+        VERSION:
     user: "${UID}:${GID}"
     volumes:
       - ./data/database.db:/database.db
       - ${DATA_PATH}:/srv
+    environment:
+      DEFAULT_PERMS_DIR:
+      DEFAULT_PERMS_FILE:

docker/Dockerfile

+ARG VERSION=v2
+FROM filebrowser/filebrowser:${VERSION}
+COPY entrypoint.sh /
+RUN apk add inotify-tools
+ENTRYPOINT '/entrypoint.sh'
+

docker/entrypoint.sh

+#!/bin/sh
+
+set_perms() {
+    inotifywait --monitor --recursive --quiet --event create /srv --format "%w%f" | \
+        while read f;do
+            if [ -d "$f" ]; then
+                chmod -R $DEFAULT_PERMS_DIR "$f"
+            else
+                chmod $DEFAULT_PERMS_FILE "$f"
+            fi
+        done
+}
+set_perms &
+exec /filebrowser
+