FileBrowser is published only after its default login is checked (R-1126); the memory refusal says what to do (R-1125)

R-1126 (D11 = A): FileBrowser starts off traefik-public, on its own network felhom-filebrowser; the controller joins it
there, checks this run's default login, and only then puts FileBrowser on traefik-public (files.<domain> served).
FileBrowser's own admin-password setting re-applies at every start (1.5.6 cmd/user.go:50-57, measured on 9202), so it
cannot carry the box's password without overwriting the household's own. Tests red-proved.
R-1125 (D10 = A): err.stacks.not_enough_memory says the memory is held by the installed apps and to remove one or use
a machine with more memory (HU + EN, reworded on purpose). TestR1125_NotEnoughMemorySaysWhatToDo, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/infra/infra.go

@@ -188,6 +188,10 @@ func RenderCloudflared(d CloudflaredData) (map[string]FileSpec, error) {
 // RenderFileBrowserCompose returns FileBrowser's docker-compose.yml for the given domain and storage
 // volume-mount lines. Ported verbatim from internal/web/handlers.go (the single source of truth now
 // lives here so the pinned image can't diverge between bring-up and the web storage-sync path).
+// FileBrowserNetwork is FileBrowser's own network (R-1126): the controller joins it to check the default login before
+// FileBrowser is put on traefik-public.
+const FileBrowserNetwork = "felhom-filebrowser"
+
 func RenderFileBrowserCompose(domain string, storageMounts []string, groupAdd ...int) string {
 	// R-691 (v0.275.0): supplementary groups — the owning groups of kept folders the view must READ (a
 	// 0770 folder another user owns, e.g. nextcloud's www-data). Their binds are `:ro`. Absent → the
@@ -225,8 +229,12 @@ services:
     volumes:
       - filebrowser_data:/home/filebrowser/data
       - ./config.yaml:/home/filebrowser/config.yaml:ro%s
+    # R-1126 (D11 = A): NOT on traefik-public at start. The box joins it to traefik-public only after it has checked
+    # THIS run's default login is refused (stacks.ensureFileBrowserPublic), so files.<domain> never answers with
+    # FileBrowser's default password — a re-created container always starts unreachable from outside. The box reaches
+    # it for that check over its own network.
     networks:
-      - traefik-public
+      - %s
     deploy:
       resources:
         limits:
@@ -249,9 +257,9 @@ volumes:
   filebrowser_data:
 
 networks:
-  traefik-public:
-    external: true
-`, domain, FileBrowserImage, groupSection, storageSection, domain)
+  %s:
+    name: %s
+`, domain, FileBrowserImage, groupSection, storageSection, FileBrowserNetwork, domain, FileBrowserNetwork, FileBrowserNetwork)
 }
 
 // RenderControllerRoute returns a traefik file-provider dynamic config routing the controller's own

controller/internal/infra/infra_test.go

@@ -247,3 +247,22 @@ func TestFileBrowserRender(t *testing.T) {
 		t.Errorf("filebrowser compose missing the umask-002 entrypoint wrapper: %q", compose)
 	}
 }
+
+// R-1126 (D11 = A): FileBrowser starts OFF traefik-public — the box joins it there only after this run's default login
+// is checked — and on its own network, which the controller joins for that check. The Traefik labels stay, so the route
+// appears the moment the box joins it. RED-PROOF: the service back on traefik-public → this fails.
+func TestFileBrowserRender_R1126_NotPublicAtStart(t *testing.T) {
+	compose := RenderFileBrowserCompose("demo-felhom.eu", nil)
+	svc := compose[strings.Index(compose, "  filebrowser:"):strings.Index(compose, "\nvolumes:")]
+	nets := svc[strings.Index(svc, "    networks:"):]
+	nets = nets[:strings.Index(nets, "    deploy:")]
+	if strings.Contains(nets, "traefik-public") {
+		t.Fatalf("FileBrowser starts on traefik-public — it would be served before its default login is checked:\n%s", nets)
+	}
+	if !strings.Contains(nets, "- "+FileBrowserNetwork) || !strings.Contains(compose, "name: "+FileBrowserNetwork) {
+		t.Fatalf("FileBrowser must sit on %s (named), got:\n%s", FileBrowserNetwork, compose)
+	}
+	if !strings.Contains(compose, "traefik.docker.network=traefik-public") || !strings.Contains(compose, "Host(`files.demo-felhom.eu`)") {
+		t.Fatal("the Traefik labels must stay, so joining traefik-public is all that publishes it")
+	}
+}