Add Seafile app with optional SeaDoc by mreid-tt · Pull Request #4993 · truenas/apps

mreid-tt · 2026-05-16T14:51:33Z

App Addition

I have opened an issue to discuss this app addition before submitting this pull request.

AI

Part or All of this PR was generated by an LLM.

Description

Adds Seafile to the community train.

Seafile is an open source cloud storage system with privacy preservation and teamwork features. This package includes:

Core Seafile server (seafileltd/seafile-mc:13.0.24) with MariaDB (mariadb:12.3.2) and Valkey (valkey/valkey:9.1.0)
Nginx reverse proxy (nginxinc/nginx-unprivileged:1.31.1) with optional TrueNAS certificate support for HTTPS
Optional SeaDoc server (seafileltd/sdoc-server:2.0.9) for collaborative document editing

App Information

Upstream: https://www.seafile.com/
Documentation: https://manual.seafile.com/
Docker Image: https://hub.docker.com/r/seafileltd/seafile-mc
App Version: 13.0.24

Testing

Tested locally with:

All tests passed successfully (render and deployment).

Icons and Screenshots

Please upload the following to the CDN:

Icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/seafile.svg

Special Notes

The seafile-mc image uses baseimage-docker's my_init as PID 1, which requires root. The container runs as root; the init system drops privileges for seafile processes internally.
Requires SETUID/SETGID capabilities. Applied via cap_add since the library defaults to cap_drop: [ALL].
SeaDoc server is conditional — when enable_seadoc is true, the sdoc-server container is deployed alongside seafile.
Nginx (nginxinc/nginx-unprivileged) serves as the reverse proxy with dynamic port mapping (ports >= 1024), eliminating the need for NET_BIND_SERVICE capability. Nginx config is injected via Docker configs.
HTTPS via TrueNAS certificate manager — selecting a certificate enables TLS on a separate HTTPS port (30441) with HTTP to HTTPS redirect on 30440.
Valkey is used as the cache server with --stop-writes-on-bgsave-error no to ensure compatibility with Seafile's redis client.
All image tags are pinned to concrete versions.
Tested on Ubuntu 22.04 VM with Docker Compose. All five test configurations deployed successfully with web UI accessible.

Checklist

App runs successfully locally
Only modified files under /ix-dev/ or /library/
README.md included
Multiple test scenarios tested (5 test files)
questions.yaml has clear descriptions and follows structure of existing apps
All automated CI checks pass

…n, fix custom-storage paths

- Rename MariaDB vars: db -> mariadb_container, db_image -> mariadb_image - Run Caddy as non-root with NET_BIND_SERVICE, enable healthcheck - Use db_user/db_name consts instead of hardcoded values - Fix redis dependency: service_started -> service_healthy - Add additional_storage question with full host_path/ix_volume/cifs/nfs support - Add Labels Configuration group and question - Add acl_entries + acl blocks to all storage questions - Add notes_body const with post-install credentials note - Remove inconsistent auto_permissions from db_data/redis_data - Fix Memory label to (in MB), trim README to 3 lines - Fix redis run_as_context description - Normalize host_ips in test values, ensure trailing newlines

- User enters bare hostname (no port), port appended automatically - Only appends :port when non-standard (not 80/443) - Also feeds into SeaDoc URL and extra_hosts - Add TCP healthcheck to seadoc container

- seadoc always runs on the same server behind Caddy - No need for user-configurable seadoc_server_url override - Match upstream behavior of always auto-constructing the URL

mreid-tt · 2026-05-18T17:46:03Z

Hey @stavros-k, hope you’re doing well. If there are any recommended changes or suggested next steps, please let me know. I’m very eager to help get this into the catalog.

stavros-k · 2026-05-19T15:38:38Z

+{% set caddy = tpl.add_container(values.consts.caddy_container_name, "caddy_image") %}
+{% do caddy.add_network(seafile_net) %}
+{% do caddy.set_user(values.run_as.user, values.run_as.group) %}
+{% do caddy.add_caps(["NET_BIND_SERVICE"]) %}


The caddy file that seafile docs suggest is just an example. Users can and probably will want to customize it by a lot.
Also if they have already a reverse proxy in their network, they probably dont want another one.

If seafile is added, it wont be with caddy.

Still this is a very quick review, I have not checked anything else, but this is a blocker.

Thanks for the quick review, appreciate you taking the time.

You raise a good point about Caddy. My understanding is that the upstream uses it for path-based routing to SeaDoc (/sdoc-server/), and without it I'm not sure how SeaDoc would be reachable within the isolated network of a TrueNAS app. But I may be missing something.

FWIW, I noticed Windmill in the community train also bundles Caddy, so there's some precedent, though I don't know if that's considered a different scenario.

If you think there's a cleaner approach that avoids bundling Caddy, I'm happy to follow your guidance. Otherwise, if Caddy is a hard no, we can drop SeaDoc from the app and keep it simpler. Let me know what you'd prefer.

@mreid-tt as I see SeaDoc does not have to be /sdoc-server/
you can configure it as SEADOC_SERVER_URL without /sdoc-server/

@mreid-tt if you want I can share my test custom app yaml for truenas with seafile without Caddy

Hey @stavros-k, just following up to see if you've had a chance to complete your review of this PR. I was also wondering if you've had an opportunity to consider my response and the question I raised. Please let me know if there's any additional information I can provide.

@mreid-tt as I see SeaDoc does not have to be /sdoc-server/ you can configure it as SEADOC_SERVER_URL without /sdoc-server/

Thanks for the suggestion @Krysztal. I explored removing the /sdoc-server/ path prefix, but decided to keep it for a few reasons:

The upstream documentation and default deployment use /sdoc-server/ as the standard path

With the nginx reverse proxy, path-based routing to the seadoc container is clean and well-tested

The nginx config follows the reference config from the upstream "Use other reverse proxy" docs, which also uses /sdoc-server/

Keeping the upstream default makes it easier for users to follow upstream troubleshooting guides

That said, I confirmed during testing that HTTP+SeaDoc works correctly — document editing and revision workflows both pass with the /sdoc-server/ path.

- Remove Caddy reverse proxy container - Add nginx (nginxinc/nginx-unprivileged:1.31.1) as replacement - Pin all image versions to concrete tags (seafile:13.0.24, sdoc-server:2.0.9, mariadb:10.11.18, redis:7.4.9-alpine) - Change default ports to 30042/30043 to avoid CI conflicts - Fix explicit ENABLE_SEADOC env var (was only set when true) - Add extra_hosts for seafile container backend resolution - Fix Host header to use $http_host (includes port) for CSRF - Add /health endpoint for reliable healthchecks - Remove nginx_data storage volume (certs via Docker configs) - Drop NET_BIND_SERVICE capability (dynamic ports >= 1024)

stavros-k · 2026-06-22T14:57:02Z

+{% set seafile_proto = "https" if values.network.certificate_id else "http" %}
+{% set seafile_port = values.network.https_port.port_number if values.network.certificate_id else values.network.web_port.port_number %}
+{% set default_port = 443 if values.network.certificate_id else 80 %}
+{% set seafile_hostname = values.seafile.server_hostname ~ (":" ~ seafile_port if seafile_port != default_port else "") %}


why not always append the :443 or :80?
We can also just strip these 2 suffixes without having to do all these checks.

Simplified to always append the port from network config. The user provides a bare hostname and the template adds the port (e.g., hostname:30440). No conditional logic.

stavros-k · 2026-06-22T14:57:27Z

+{% do seafile.environment.add_env("REDIS_HOST", values.consts.redis_container_name) %}
+{% do seafile.environment.add_env("REDIS_PORT", values.consts.redis_port) %}
+{% do seafile.environment.add_env("REDIS_PASSWORD", values.database.redis_password) %}
+{% do seafile.environment.add_env("ENABLE_GO_FILESERVER", "true") %}


bool values are also working no need to make them strings

Changed to native bools. Also made ENABLE_SEADOC explicitly set on every startup — previously it was only set when true, and the seafile-mc image defaults to enabled, which caused the UI to show SeaDoc features for users who didn't enable it.

stavros-k · 2026-06-22T14:59:01Z

+  {% do seadoc.environment.add_env("DB_PORT", values.consts.mariadb_port) %}
+  {% do seadoc.environment.add_env("DB_USER", values.consts.db_user) %}
+  {% do seadoc.environment.add_env("DB_PASSWORD", values.database.db_password) %}
+  {% do seadoc.environment.add_env("DB_NAME", "seahub_db") %}


why does this connect to a different database that the one that we create?

SeaDoc connects to seahub_db — the upstream seadoc.yml for version 13.0 uses SEAFILE_MYSQL_DB_SEAHUB_DB_NAME (defaults to seahub_db) by design. SeaDoc is an extension of Seahub (the web interface), not the core file server, so it uses the seahub database.

stavros-k · 2026-06-22T14:59:23Z

+{% do seafile.environment.add_user_envs(values.seafile.additional_envs) %}
+{% do seafile.add_extra_host(values.seafile.server_hostname, "host-gateway") %}
+
+{% do seafile.add_storage("/shared", values.storage.data) %}


what does it share with seadoc?

The seafile and seadoc containers both mount storage at /shared, but they map to different host paths (values.storage.data and values.storage.seadoc_data respectively). They don't share data — the paths just happen to have the same internal container name.

stavros-k · 2026-06-22T14:59:43Z

+    repository: mariadb
+    tag: 10.11.18
+  redis_image:
+    repository: redis


why do we use redis while ALL other apps use valkey?

Switched to valkey/valkey:9.1.0. Had to add --stop-writes-on-bgsave-error no because Seafile's redis client triggers BGSAVE on first session write, and valkey's default blocks writes when RDB persistence encounters issues — this caused a 500 error on the login page on first access. Verified working with this change.

stavros-k · 2026-06-22T15:00:39Z

+    tag: 1.0.2
+
+consts:
+  seafile_container_name: seafile


why do all containers get a seafile suffix? this will generate a weirdly repeated container name

Good point. Renamed to bare names: seafile-db → db (matching the upstream seafile-server.yml service name), seafile-nginx → nginx, seafile-seadoc → seadoc. This matches the convention used by wger, n8n, and others.

I dont think we have any apps that names the container db

stavros-k · 2026-06-22T15:00:46Z

+  nginx_container_name: seafile-nginx
+  seadoc_container_name: seafile-seadoc
+  perms_container_name: permissions
+  mariadb_port: 3306


why are these consts here?

Container name consts are defined in every community app and are used across the template (env vars, depends_on, networks). Removed redis_port and mariadb_port consts — those are just standard ports and are now written directly where they're used, matching how other apps handle them.

stavros-k · 2026-06-22T15:01:19Z

+  {% do seadoc.environment.add_env("NON_ROOT", "false") %}
+  {% do seadoc.healthcheck.set_test("tcp", {"port": 80}) %}
+  {% do seadoc.depends.add_dependency(values.consts.mariadb_container_name, "service_healthy") %}
+  {% do perm_container.add_or_skip_action("seadoc_data", values.storage.seadoc_data, {"uid": 0, "gid": 0, "mode": "check"}) %}


why do we need permissions action here if it runs as root?

Removed the permissions action for seadoc_data. Since the seadoc container runs as root, it can create files with any ownership it needs.

stavros-k · 2026-06-22T15:02:03Z

+{% from "macros/nginx.conf" import nginx_config %}
+{% set tpl = ix_lib.base.render.Render(values) %}
+
+{% if not values.seafile.server_hostname %}


isnt this enforced by the questions schema?

You're right. Removed the Jinja validation — the required: true in questions.yaml already prevents empty values.

stavros-k · 2026-06-22T15:04:22Z

Why do we ship seadoc with seafile? Isn't that a compatible WOPI server?
ie like collabora? Shouldnt we have it separately?

stavros-k · 2026-06-22T15:05:03Z

+    tag: 13.0.24
+  mariadb_image:
+    repository: mariadb
+    tag: 10.11.18


why is mariadb 2 major versions behind?

The upstream seafile-server.yml uses ${SEAFILE_DB_IMAGE:-mariadb:10.11} as its default, so we matched that initially. Updated to mariadb:12.3.2 to match what other apps use. Verified working in local tests.

stavros-k · 2026-06-22T15:06:18Z

+          label: Server Hostname
+          description: |
+            The hostname or IP address where Seafile will be accessible.</br>
+            Do not include the port — it will be added automatically based on the network configuration.</br>


That's going to cause issues if you construct it from network config.
One can have it listen on port 1234 on LAN, but 443 on external.
Your method will pin the hostname to xxx:1234 and will be invalid when accessed from outside.

Changed to: the user provides a bare hostname, and the template appends the port from the network config. The user controls the hostname, so they can enter their external domain regardless of the internal port.

stavros-k · 2026-06-22T15:07:37Z

+                description: Memory limit for Seafile.
+                schema:
+                  type: int
+                  default: 2048


Why is this default different from ALL other apps?

The upstream recommends 2GB minimum for Seafile CE, but the community catalog standard is 4096 as the default across virtually all apps. Changed to 4096 for consistency.

mreid-tt · 2026-06-22T15:23:33Z

Why do we ship seadoc with seafile? Isn't that a compatible WOPI server?
ie like collabora? Shouldnt we have it separately?

SeaDoc is included as part of Seafile because it's Seafile-specific — it shares Seafile's MariaDB database, requires Seafile's JWT secret, and fetches document content through Seafile's HTTP API. It cannot function without a Seafile server. The upstream docs treat it the same way, listing seadoc.yml alongside seafile-server.yml in the default COMPOSE_FILE.

That said, if you feel the added complexity isn't worth it, happy to drop SeaDoc and keep the app simpler. We'll defer to your judgment.

- Replace Caddy with nginx (nginxinc/nginx-unprivileged:1.31.1) - Remove NET_BIND_SERVICE capability (dynamic ports >= 1024) - Switch to valkey/valkey:9.1.0 with --stop-writes-on-bgsave-error no - Update MariaDB to 12.3.2 - Rename containers to bare names: seafile-db→db, seafile-nginx→nginx, seafile-seadoc→seadoc - Move passwords under seafile: dict, remove database section - Simplify hostname: user provides bare hostname, template appends port - Set start_period(120) for fresh DB init - Change memory default to 4096, cpu to 2 - Remove mariadb_port/redis_port consts, hardcode ports - Remove seadoc permissions action (runs as root) - Remove server_hostname template validation (schema enforces) - Remove healthcheck timing overrides, use native bools - Update test values for new structure

mreid-tt · 2026-06-22T19:46:30Z

Thank you @stavros-k for the thorough review. I've worked through each of your comments — all CI checks are now passing. Let me know if there's anything else you'd like me to address.

EDIT: Regarding running as non-root — I attempted setting NON_ROOT=true on both the seafile and seadoc containers. The image creates a seafile user (uid 8000) internally when this is set. However, the seafile-mc image's init process creates directories and files as root during its bootstrap, before the permission check runs. This causes the permission validation to fail on every startup, as the newly created files are still root-owned.

The upstream's own documentation for non-root mode requires a manual chmod -R a+rwx on the host after the first deploy, then a container restart — which isn't practical in an automated deployment. The upstream defaults to root for both containers, so I've left it that way for now.

mreid-tt · 2026-06-23T01:43:35Z

I've pushed a commit to run seafile and seadoc as non-root. The image supports NON_ROOT=true which creates a seafile user (uid 8000) internally and drops privileges. I also added an nginx dependency on seadoc (when enabled) to fix a startup ordering issue.

Two things needed custom workarounds:

A startup script injected via Docker config — The image's init process creates directories as root during boot, then checks that they're owned by uid 8000. The permissions container can't fix files that don't exist yet, so I inject a script at /etc/my_init.d/99_fix_permissions.sh that runs chown after the directories are created but before the ownership check. This uses the image's built-in extension mechanism rather than modifying its entrypoint.
Nginx dependency on seadoc — Nginx resolves upstream hostnames at startup. Without this dependency, seadoc may not be resolvable yet when nginx parses its config, causing nginx to fail.

Happy to revert to root mode if either of these workarounds is undesirable — the upstream defaults to root for both containers.

stavros-k · 2026-06-23T14:20:57Z

+  "volume": values.storage.redis_data,
+} %}
+{% set cache = tpl.deps.redis(values.consts.redis_container_name, "redis_image", cache_config, perm_container) %}
+{% do cache.container.set_command(["--port", "6379", "--requirepass", values.seafile.redis_password, "--stop-writes-on-bgsave-error", "no"]) %}


What is this?

stavros-k · 2026-06-23T14:23:17Z

+{% do seafile.environment.add_env("ENABLE_GO_FILESERVER", true) %}
+{% do seafile.environment.add_env("JWT_PRIVATE_KEY", values.seafile.jwt_private_key) %}
+{% do seafile.environment.add_env("NON_ROOT", true) %}
+{% do seafile.configs.add("fix-perms-seafile", "#!/bin/sh\nchown -R 8000:8000 /shared\n", "/etc/my_init.d/99_fix_permissions.sh", "0500") %}


Absolutely no.
The permissions container purposefully does not alter data permissions.
Bails out on non empty dirs. And a bunch of other checks.

This changes every time permissions of a directory that could contain data.

Still does not make sense, as it seems like it DOES chown
https://github.com/haiwen/seafile-docker/blob/f4906bc142b6ad422745bde407fdacb216045696/scripts/scripts_9.0/enterpoint.sh#L26-L37

And to address the elephant in the room.
Its is not "NON ROOT". PID 1 is still running as root.

stavros-k · 2026-06-23T14:32:24Z

+server {
+    listen {{ values.network.web_port.port_number }};
+    location /health {
+        return 200;
+    }
+    return 301 https://$host{{ ":" ~ values.network.https_port.port_number if values.network.https_port.port_number != 443 else "" }}$request_uri;
+}
+
+server {
+    listen {{ values.network.https_port.port_number }} ssl;
+    ssl_certificate {{ values.consts.ssl_cert_path }};
+    ssl_certificate_key {{ values.consts.ssl_key_path }};
+{% else %}
+server {
+    listen {{ values.network.web_port.port_number }};
+{% endif %}


I still dont get why we need both?

stavros-k · 2026-06-23T14:32:32Z

+    location /health {
+        return 200;
+    }
+    return 301 https://$host{{ ":" ~ values.network.https_port.port_number if values.network.https_port.port_number != 443 else "" }}$request_uri;


… on seadoc" This reverts commit a92abc3.

Reverts non-root changes (NON_ROOT, fix-perms scripts, perms actions) due to reviewer concerns. Keeps nginx dependency on seadoc (needed for startup ordering). Renames mariadb container from db to mariadb to match convention used by all other community apps.

mreid-tt and others added 8 commits May 16, 2026 10:46

feat: add Seafile 13 app with Caddy reverse proxy and optional SeaDoc

bc01192

fix: remove empty migrations file (no migrations needed)

a21de11

fix: update default port to 30426 (was conflicting with maintainerr)

247b08b

fix: rename primary image key to 'image' to match community conventio…

a5c8af5

…n, fix custom-storage paths

fix: add backup to ix_volumes in custom-storage test values

c892f3b

fix: add seafile-seadoc to network container enum (CI validation)

5eddf90

fix: use single category 'storage' (CI requires exactly 1)

6ab7a10

fix: update metadata

c9cd966

mreid-tt changed the title ~~feat: add Seafile 13 app with Caddy reverse proxy and optional SeaDoc~~ Add Seafile app with optional SeaDoc May 16, 2026

mreid-tt added 11 commits May 16, 2026 12:53

test: add https-values.yaml for HTTPS certificate testing

c762fc8

fix: give HTTPS portal unique name to avoid duplicate portal error

afd20a4

test: add https-values.yaml for HTTPS certificate testing

23dd3f3

fix: update metadata

33114f8

fix: add trailing newline to docker-compose.yaml

bf8fbfd

chore: remove unused mariadb_port const

40f272c

fix: use mariadb_port const instead of hardcoded 3306

f61b10a

feat: auto-construct SEAFILE_SERVER_HOSTNAME from hostname + port

ff18b48

- User enters bare hostname (no port), port appended automatically - Only appends :port when non-standard (not 80/443) - Also feeds into SeaDoc URL and extra_hosts - Add TCP healthcheck to seadoc container

refactor: remove seadoc_server_url question, always auto-construct

098ed43

- seadoc always runs on the same server behind Caddy - No need for user-configurable seadoc_server_url override - Match upstream behavior of always auto-constructing the URL

fix: include HTTPS port in Caddy redirect for non-standard ports

737370d

stavros-k marked this pull request as draft May 18, 2026 16:20

stavros-k reviewed May 19, 2026

View reviewed changes

mreid-tt and others added 2 commits June 17, 2026 14:51

Merge branch 'master' into seafile-app

7d2ac58

mreid-tt marked this pull request as ready for review June 17, 2026 20:09

truenas added 4 commits June 17, 2026 16:22

fix: change https port from 30043 to 30050 (conflict with navidrome)

3855e46

fix: update library version from 2.3.5 to 2.3.6

485e518

chore: update app metadata and library to 2.3.6

6222417

fix: change https port from 30050 to 30440 (conflict with prowlarr)

e3f9ea9

stavros-k reviewed Jun 22, 2026

View reviewed changes

stavros-k marked this pull request as draft June 22, 2026 15:08

stavros-k added the ai-slop-requires-extended-review label Jun 22, 2026

truenas added 2 commits June 22, 2026 15:32

chore: update seafile app metadata to 1.0.2

967648f

fix: run seafile and seadoc as non-root, set nginx dependency on seadoc

a92abc3

Merge branch 'master' into seafile-app

77f111d

mreid-tt marked this pull request as ready for review June 23, 2026 09:49

stavros-k reviewed Jun 23, 2026

View reviewed changes

stavros-k marked this pull request as draft June 23, 2026 14:36

truenas added 2 commits June 23, 2026 11:02

Revert "fix: run seafile and seadoc as non-root, set nginx dependency…

dbdd63c

… on seadoc" This reverts commit a92abc3.

Conversation

mreid-tt commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

App Addition

AI

Description

App Information

Testing

Icons and Screenshots

Special Notes

Checklist

Uh oh!

mreid-tt commented May 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Krysztal May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mreid-tt Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stavros-k commented Jun 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mreid-tt commented May 16, 2026 •

edited

Loading

Krysztal May 30, 2026 •

edited

Loading

mreid-tt Jun 22, 2026 •

edited

Loading

mreid-tt commented Jun 22, 2026 •

edited

Loading

mreid-tt commented Jun 22, 2026 •

edited

Loading