Frank
e8fd009419
Fact-check results: - RomM 5.2.0: MariaDB+Redis now required (was SQLite), auth var renamed, 11 metadata providers - Copyparty v1.20.19: 3 CVEs fixed, WOPI integration, docker editions documented - Calibre-Web 0.6.27-ls397: version pinning, kepubify auto-config, CVE fixes - Calibre 9.9.0: content server security fix noted New documentation: - docs/Dankserver/Jellyfin.md — full media server guide (compose, Caddy, GPU, metadata, clients) - docs/Dankserver/ARR-Stack.md — automated download stack overview - docs/Dankserver/RomM-Scraping.md — metadata providers, naming, cover art, emulator integration - docs/Dankserver/sonarr.md, radarr.md, lidarr.md, readarr.md, prowlarr.md, qbittorrent.md - docs/Dankserver/mariadb.md, redis.md — supporting services for RomM Infrastructure updates: - dankserver/compose.yaml: added mariadb, redis, jellyfin, *arr services - dankserver/Caddyfile: added hostnames for all new services - dankserver/.env.example: added all new environment variables - docs/index.md: linked all new documentation pages Tested: 52/52 tests pass.
107 lines
3.9 KiB
Markdown
107 lines
3.9 KiB
Markdown
# Copyparty
|
|
|
|
Copyparty is a lightweight file server and media streamer that runs as a single Python binary. It handles large payloads, media streaming, resumable uploads, directory browsing, and WebDAV from one process.
|
|
|
|
**Host:** Dankserver — **Hostname:** `files.dankserver.local` — **Docs:** https://github.com/9001/copyparty
|
|
|
|
## Facts
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Latest version | v1.20.19 (released 2026-07-27) |
|
|
| Image | `ghcr.io/9001/copyparty:latest` (official Dockerfile in repo) |
|
|
| Port | 3923 (host) → 3923 (container) |
|
|
| Volume | bind mount the shared root directory |
|
|
| Auth | Per-directory `.cpy` config files, HTTP basic auth, `dirkeys`, `filekeys` |
|
|
| Streaming | HTTP range requests, HLS, WebDAV, WOPI (Office editing) |
|
|
| Docker editions | `dj` (document + media), `iv` (image + video), `v` (video only) |
|
|
|
|
## Configuration
|
|
|
|
### Environment Variables
|
|
|
|
| Variable | Description |
|
|
|----------|-------------|
|
|
| `COPAY_PASS` | Master password for the web UI |
|
|
| `COPAY_MODE` | Set to `rw` for read-write shares |
|
|
|
|
### Configuration File Options
|
|
|
|
Copyparty reads its configuration from `initcfg` (or `config` in the `/data` directory). Key options:
|
|
|
|
- `use-bwrap: n` — Disable bwrap sandboxing for ffmpeg (default in Docker). Set to `y` to enable.
|
|
- `shadowing //NULL` — Full unmap of a volume from the filesystem.
|
|
- Config env-var expansion: Use `${VAR}` syntax in `[global]` section for environment variable substitution.
|
|
|
|
### Docker Editions
|
|
|
|
Different editions bundle different libraries:
|
|
|
|
| Edition | Bundled Libraries | Use Case |
|
|
|---------|-------------------|----------|
|
|
| `dj` | Document + image + video libraries | Full-featured server |
|
|
| `iv` | Image + video libraries | Image and video focused |
|
|
| `v` | Video only | Transcoding only, minimal footprint |
|
|
|
|
The `iv` edition is no longer available for arm32/armv6. Use `dj` for maximum compatibility.
|
|
|
|
## Volumes
|
|
|
|
| Container path | Host path (convention) |
|
|
|----------------|------------------------|
|
|
| `/data` | `/opt/copyparty/data` |
|
|
|
|
## Docker Compose
|
|
|
|
```yaml
|
|
services:
|
|
copyparty:
|
|
image: ghcr.io/9001/copyparty:latest
|
|
container_name: copyparty
|
|
restart: unless-stopped
|
|
environment:
|
|
COPAY_PASS: "${COPAY_PASS}"
|
|
COPAY_MODE: rw
|
|
ports:
|
|
- "3923:3923"
|
|
volumes:
|
|
- /opt/copyparty/data:/data
|
|
healthcheck:
|
|
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3923/')"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
```
|
|
|
|
## Healthcheck
|
|
|
|
A simple HTTP check on port 3923 works. The root path returns HTTP 200 with the directory listing.
|
|
|
|
## WOPI Integration
|
|
|
|
Copyparty v1.20.9+ supports WOPI (Web Application Open Platform Interface) for editing Office documents in the web UI via Collabora Online. Enable with the `--wopi-accs` flag to limit WOPI access to specific paths.
|
|
|
|
## Security Advisories
|
|
|
|
| Version | CVE | Issue |
|
|
|---------|-----|-------|
|
|
| v1.20.19 | GHSA-phv8-wgjp-g4p9 | FTP upload outside volume |
|
|
| v1.20.17 | GHSA-x5pq-m9p8-f4vx | dirkey/filekey confusion |
|
|
| v1.20.9 | CVE-2026-27948 / GHSA-62cr-6wp5-q43h | XSS via file upload |
|
|
|
|
Upgrade to v1.20.19+ to cover all known CVEs. The dirkey fix (v1.20.17) matters if using both `dirkeys` and `filekeys`.
|
|
|
|
## Gotchas
|
|
|
|
- **Large transfers:** Disable TLS inside the app and let Caddy terminate TLS. This avoids double encryption overhead.
|
|
- **Dedicated share directory:** Do not give Copyparty the whole disk. Mount only the intended share path.
|
|
- **Upload tokens scoped per folder:** Prevents accidental global write access.
|
|
- **CSP nonces (v1.20.17+):** Security hardening for JavaScript execution. May break third-party JS plugins (`--js-browser` / `--html-head`).
|
|
- **Custom thumbnail extractors (v1.20.19+):** New `thumbex` framework. Requires configuration in `initcfg`.
|
|
|
|
## See Also
|
|
|
|
- [[Dankserver Stack]]
|
|
- [[Caddy]] — TLS termination and authentication in front
|
|
- [[ARR-Stack]] — Copyparty as a viewer alongside automated download management
|