From 5a1535bc6f6c2affc6b99464aa0461b35c2e1de5 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Sat, 10 Oct 2026 02:33:39 +0200 Subject: [PATCH 1/2] Copyparty: require your own password --- services/copyparty/.env | 3 +++ services/copyparty/README.md | 8 ++++++-- services/copyparty/compose.yaml | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/services/copyparty/.env b/services/copyparty/.env index cca550be..cc1cf0df 100644 --- a/services/copyparty/.env +++ b/services/copyparty/.env @@ -19,4 +19,7 @@ TZ=Europe/Amsterdam # See: https://en.wikipedia.org/wiki/List_of_tz_database_tim # Optional Service variables # PUID=1000 +# Required: password of the account admin. Generate it with: openssl rand -hex 32 +COPYPARTY_PASSWORD= + #EXAMPLE_VAR="Environment variable" diff --git a/services/copyparty/README.md b/services/copyparty/README.md index f8464711..66ec6021 100644 --- a/services/copyparty/README.md +++ b/services/copyparty/README.md @@ -17,7 +17,7 @@ This stack runs Copyparty with a Tailscale sidecar, as described in [the standar ## Before you start - **Choose the folder to share.** Replace `/path/to/your/fileshare/top/folder` in `compose.yaml` with the absolute path of a folder on the Docker host. User `1000` needs write access to it. -- **Change the password.** The `copyparty-config` block in `compose.yaml` creates the account `admin` with the password `changeme`. Replace the password. +- **Set the password.** Set `COPYPARTY_PASSWORD` in `.env` to the password of the account `admin`. Generate one with `openssl rand -hex 32`. Compose stops with an error if it is empty. Use letters and digits only: Copyparty reads the password from one line of its configuration file, and it cuts a line at a `#` that follows two spaces. ## Deviations from the standard setup @@ -27,7 +27,11 @@ This stack runs Copyparty with a Tailscale sidecar, as described in [the standar ## First run -Open the web interface and log in with the password from the `copyparty-config` block. Copyparty then shows the files of your folder. +Open the web interface and log in as `admin` with the value of `COPYPARTY_PASSWORD` in `.env`. Copyparty then shows the files of your folder. + +## Upgrading + +Earlier versions of this stack created the account `admin` with the password `changeme` in `compose.yaml`. The password is now in `.env`, and Compose stops with an error until you set `COPYPARTY_PASSWORD`. If you changed the password in `compose.yaml`, move it to `.env`. If you kept `changeme`, set `COPYPARTY_PASSWORD=changeme` to keep the same login, or choose a new password. Then restart the stack. ## Links diff --git a/services/copyparty/compose.yaml b/services/copyparty/compose.yaml index 2da0de56..2598538d 100644 --- a/services/copyparty/compose.yaml +++ b/services/copyparty/compose.yaml @@ -14,7 +14,7 @@ configs: rproxy: -1 [accounts] - admin:changeme + admin:${COPYPARTY_PASSWORD:?Set COPYPARTY_PASSWORD in .env} [/] /w From 58dde8b7cfedd5067ee0da7b0a98d1adfc417c33 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:13:04 +0200 Subject: [PATCH 2/2] Copyparty: apply the new password with a forced recreate Compose writes the configuration file only when it creates the container. After the upgrade, a restart or a plain docker compose up -d kept the old file, so changeme stayed valid although .env held a new password. The README now gives docker compose up -d --force-recreate for the upgrade and for later password changes, and says that the file holds the password in plain text. --- services/copyparty/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/copyparty/README.md b/services/copyparty/README.md index 66ec6021..376bbf4a 100644 --- a/services/copyparty/README.md +++ b/services/copyparty/README.md @@ -17,11 +17,11 @@ This stack runs Copyparty with a Tailscale sidecar, as described in [the standar ## Before you start - **Choose the folder to share.** Replace `/path/to/your/fileshare/top/folder` in `compose.yaml` with the absolute path of a folder on the Docker host. User `1000` needs write access to it. -- **Set the password.** Set `COPYPARTY_PASSWORD` in `.env` to the password of the account `admin`. Generate one with `openssl rand -hex 32`. Compose stops with an error if it is empty. Use letters and digits only: Copyparty reads the password from one line of its configuration file, and it cuts a line at a `#` that follows two spaces. +- **Set the password.** Set `COPYPARTY_PASSWORD` in `.env` to the password of the account `admin`. Generate one with `openssl rand -hex 32`. Compose stops with an error if it is empty. Use letters and digits only: Copyparty reads the password from one line of its configuration file, and it cuts a line at a `#` that follows two spaces. To change the password later, edit `.env` and run `docker compose up -d --force-recreate`. ## Deviations from the standard setup -- **Configuration in `compose.yaml`.** The `copyparty-config` block is the Copyparty configuration file. It defines the account and gives it read and write access to the shared folder. +- **Configuration in `compose.yaml`.** The `copyparty-config` block is the Copyparty configuration file. It defines the account and gives it read and write access to the shared folder. Compose writes it to `./config/copyparty.conf` when it creates the container. That file holds the password as plain text, and every user of the Docker host can read it. - **Fixed user.** The `application` container runs as user and group `1000` through the `user` setting. - **Shared configuration folder.** Copyparty mounts `./config`, the folder that also holds the Tailscale configuration files. @@ -31,7 +31,7 @@ Open the web interface and log in as `admin` with the value of `COPYPARTY_PASSWO ## Upgrading -Earlier versions of this stack created the account `admin` with the password `changeme` in `compose.yaml`. The password is now in `.env`, and Compose stops with an error until you set `COPYPARTY_PASSWORD`. If you changed the password in `compose.yaml`, move it to `.env`. If you kept `changeme`, set `COPYPARTY_PASSWORD=changeme` to keep the same login, or choose a new password. Then restart the stack. +Earlier versions of this stack created the account `admin` with the password `changeme` in `compose.yaml`. The password is now in `.env`, and Compose stops with an error until you set `COPYPARTY_PASSWORD`. If you changed the password in `compose.yaml`, move it to `.env`. If you kept `changeme`, set `COPYPARTY_PASSWORD=changeme` to keep the same login, or choose a new password. Then run `docker compose up -d --force-recreate`. A restart or a plain `docker compose up -d` keeps the old configuration file, so the old password stays valid. ## Links