v0.66.2: FileBrowser umask 002 via entrypoint wrapper

gtstef/filebrowser is a single Go binary that ignores a UMASK env (verified live:
-e UMASK=002 leaves PID1 0022), so RenderFileBrowserCompose wraps the entrypoint
sh -c 'umask 002; exec /home/filebrowser/filebrowser'. Customer-created folders now
come out 2775 (group-writable) so group-1000 apps can write into them. Test asserts
the wrapper is rendered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,16 @@
 ## Changelog
 
+### v0.66.2 — FileBrowser umask 002 (customer folders group-writable) (2026-06-15)
+
+FileBrowser (uid 1000) created folders with umask 022 → mode 2755 (setgid from the parent, but
+group-READ only), so a folder a customer made in FileBrowser could not be written by the content apps
+in group 1000. The gtstef/filebrowser image is a single Go binary (`entrypoint ./filebrowser`) and does
+NOT honor a `UMASK` env (verified live: `-e UMASK=002` leaves PID1 at 0022), so `RenderFileBrowserCompose`
+(`internal/infra/infra.go`) now wraps the entrypoint:
+`["sh","-c","umask 002; exec /home/filebrowser/filebrowser"]`. Customer-created folders now come out
+**2775** (group-writable) so all group-1000 apps can use them. Test asserts the rendered compose carries
+the wrapper. (Pre-existing pre-fix folders stay 2755 — recreated on the demo; no data.)
+
 ### v0.66.1 — fix USERDATA_PATH on first deploy (2026-06-14)
 
 The initial deploy path (`DeployStack` → `composeExecWithEnv`) builds its compose env from the deploy

controller/internal/infra/infra.go

@@ -129,6 +129,11 @@ services:
     image: %s
     container_name: filebrowser
     restart: unless-stopped
+    # umask 002 so folders the customer creates here come out group-writable (2775 with the parent's
+    # setgid), letting the content apps (group 1000) write into them. The gtstef/filebrowser image is a
+    # single Go binary (entrypoint ./filebrowser) and does NOT honor a UMASK env (verified: -e UMASK=002
+    # leaves PID1 at 0022), so we wrap the entrypoint to set the process umask before exec.
+    entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]
     environment:
       - TZ=Europe/Budapest
       - FILEBROWSER_CONFIG=/home/filebrowser/config.yaml

controller/internal/infra/infra_test.go

@@ -223,4 +223,10 @@ func TestFileBrowserRender(t *testing.T) {
 	if !strings.Contains(withMounts, "/mnt/hdd_1:/srv/hdd_1") {
 		t.Errorf("storage mount not wired into filebrowser compose: %q", withMounts)
 	}
+
+	// v0.66.2: the entrypoint wrapper sets umask 002 so customer-created folders are group-writable
+	// (2775). The image doesn't honor a UMASK env, so this MUST be the entrypoint mechanism.
+	if !strings.Contains(compose, `entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]`) {
+		t.Errorf("filebrowser compose missing the umask-002 entrypoint wrapper: %q", compose)
+	}
 }