docs: rename docs/ -> serverAppConfigs-docs/ per system-wide PROJECTNAME-docs convention

All in-repo path references (AGENTS.md, README, old scripts, report artifacts, test code paths) rewritten in the same commit; focused-test map extended for .gitignore, old/scripts/*, dankclaw/comfyui/*, and report/* per this repo's own convention ('add one before committing'). Obsidian wikilinks are title-based and unaffected.
2026-08-28 02:20:06 -07:00
parent 6d4a96a423
commit 5829a0bfe8
140 changed files with 1820 additions and 86 deletions
@@ -0,0 +1,106 @@
+# Copyparty
+
+Copyparty is a lightweight file server and media streamer that runs as a single Python binary. It handles large payloads, media streaming, resumable uploads, directory browsing, and WebDAV from one process.
+
+**Host:** Dankserver — **Hostname:** `files.dankserver.local` — **Docs:** https://github.com/9001/copyparty
+
+## Facts
+
+| Item | Value |
+|------|-------|
+| Latest version | v1.20.21 (2026-08) |
+| Image | `ghcr.io/9001/copyparty:latest` (official Dockerfile in repo) |
+| Port | 3923 (host) → 3923 (container) |
+| Volume | bind mount the shared root directory |
+| Auth | Per-directory `.cpy` config files, HTTP basic auth, `dirkeys`, `filekeys` |
+| Streaming | HTTP range requests, HLS, WebDAV, WOPI (Office editing) |
+| Docker editions | `dj` (document + media), `iv` (image + video), `v` (video only) |
+
+## Configuration
+
+### Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `COPAY_PASS` | Master password for the web UI |
+| `COPAY_MODE` | Set to `rw` for read-write shares |
+
+### Configuration File Options
+
+Copyparty reads its configuration from `initcfg` (or `config` in the `/data` directory). Key options:
+
+- `use-bwrap: n` — Disable bwrap sandboxing for ffmpeg (default in Docker). Set to `y` to enable.
+- `shadowing //NULL` — Full unmap of a volume from the filesystem.
+- Config env-var expansion: Use `${VAR}` syntax in `[global]` section for environment variable substitution.
+
+### Docker Editions
+
+Different editions bundle different libraries:
+
+| Edition | Bundled Libraries | Use Case |
+|---------|-------------------|----------|
+| `dj` | Document + image + video libraries | Full-featured server |
+| `iv` | Image + video libraries | Image and video focused |
+| `v` | Video only | Transcoding only, minimal footprint |
+
+The `iv` edition is no longer available for arm32/armv6. Use `dj` for maximum compatibility.
+
+## Volumes
+
+| Container path | Host path (convention) |
+|----------------|------------------------|
+| `/data` | `/opt/copyparty/data` |
+
+## Docker Compose
+
+```yaml
+services:
+  copyparty:
+    image: ghcr.io/9001/copyparty:latest
+    container_name: copyparty
+    restart: unless-stopped
+    environment:
+      COPAY_PASS: "${COPAY_PASS}"
+      COPAY_MODE: rw
+    ports:
+      - "3923:3923"
+    volumes:
+      - /opt/copyparty/data:/data
+    healthcheck:
+      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3923/')"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+```
+
+## Healthcheck
+
+A simple HTTP check on port 3923 works. The root path returns HTTP 200 with the directory listing.
+
+## WOPI Integration
+
+Copyparty v1.20.9+ supports WOPI (Web Application Open Platform Interface) for editing Office documents in the web UI via Collabora Online. Enable with the `--wopi-accs` flag to limit WOPI access to specific paths.
+
+## Security Advisories
+
+| Version | CVE | Issue |
+|---------|-----|-------|
+| v1.20.19 | GHSA-phv8-wgjp-g4p9 | FTP upload outside volume |
+| v1.20.17 | GHSA-x5pq-m9p8-f4vx | dirkey/filekey confusion |
+| v1.20.9 | CVE-2026-27948 / GHSA-62cr-6wp5-q43h | XSS via file upload |
+
+Upgrade to v1.20.19+ to cover all known CVEs. The dirkey fix (v1.20.17) matters if using both `dirkeys` and `filekeys`.
+
+## Gotchas
+
+- **Large transfers:** Disable TLS inside the app and let Caddy terminate TLS. This avoids double encryption overhead.
+- **Dedicated share directory:** Do not give Copyparty the whole disk. Mount only the intended share path.
+- **Upload tokens scoped per folder:** Prevents accidental global write access.
+- **CSP nonces (v1.20.17+):** Security hardening for JavaScript execution. May break third-party JS plugins (`--js-browser` / `--html-head`).
+- **Custom thumbnail extractors (v1.20.19+):** New `thumbex` framework. Requires configuration in `initcfg`.
+
+## See Also
+
+- [[Dankserver Stack]]
+- [[Caddy]] — TLS termination and authentication in front
+- [[ARR-Stack]] — Copyparty as a viewer alongside automated download management