R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.

controller/internal/infra/infra.go

@@ -192,6 +192,13 @@ func RenderCloudflared(d CloudflaredData) (map[string]FileSpec, error) {
 // FileBrowser is put on traefik-public.
 const FileBrowserNetwork = "felhom-filebrowser"
 
+// FilesNetwork (R-1281, operator D44 #23, 2026-10-25) is the ONLY network on which traefik reaches FileBrowser: traefik
+// is on it, the checked FileBrowser container is joined to it after the default-login check (by id, as R-1126 did with
+// traefik-public), and no app is — except OnlyOffice while its FileBrowser link is on (it fetches and saves documents at
+// http://filebrowser:80, and FileBrowser calls http://onlyoffice:80). FileBrowser is never on traefik-public, where every
+// app container is: an app that learnt the secret header name could otherwise sign in as the household.
+const FilesNetwork = "felhom-files"
+
 func RenderFileBrowserCompose(domain string, storageMounts []string, groupAdd ...int) string {
 	// R-691 (v0.275.0): supplementary groups — the owning groups of kept folders the view must READ (a
 	// 0770 folder another user owns, e.g. nextcloud's www-data). Their binds are `:ro`. Absent → the
@@ -229,10 +236,10 @@ services:
     volumes:
       - filebrowser_data:/home/filebrowser/data
       - ./config.yaml:/home/filebrowser/config.yaml:ro%s
-    # R-1126 (D11 = A): NOT on traefik-public at start. The box joins it to traefik-public only after it has checked
-    # THIS run's default login is refused (stacks.ensureFileBrowserPublic), so files.<domain> never answers with
-    # FileBrowser's default password — a re-created container always starts unreachable from outside. The box reaches
-    # it for that check over its own network.
+    # R-1126 (D11 = A): NOT reachable from traefik at start. The box joins it to felhom-files (traefik's route to it,
+    # R-1281 — never traefik-public, where every app is) only after it has checked THIS run's default login is refused
+    # (stacks.ensureFileBrowserPublic), so files.<domain> never answers with FileBrowser's default password — a
+    # re-created container always starts unreachable from outside. The box reaches it for that check over its own network.
     networks:
       - %s
     deploy:
@@ -249,7 +256,7 @@ services:
     # BY NAME. Docker labels made Traefik pick FileBrowser's address once, at container start — on its own network,
     # before the box joined it to traefik-public — and a later "network connect" did not refresh it (demo-hp and the
     # N100 timed out after v0.327.0). By name, the address is resolved per connection, and only while FileBrowser is on
-    # traefik-public.
+    # felhom-files (R-1281; traefik-public before).
 
 volumes:
   filebrowser_data:
@@ -261,7 +268,7 @@ networks:
 }
 
 // RenderFileBrowserRoute is the traefik file-provider route for files.<domain> → http://filebrowser:80 by NAME (R-1126,
-// v0.327.1). The name resolves only while FileBrowser is on traefik-public, which the box allows only after this run's
+// v0.327.1). The name resolves only while FileBrowser is on felhom-files (R-1281), which the box allows only after this run's
 // default login was checked — so the route can stay in place and still never reach an unchecked FileBrowser (502 then).
 // TLS as the old Docker label had it (`tls: {}`, the default certificate store / the wildcard).
 //