The challenge
What the system needed to solve
Provide convenient browser-based file operations without exposing an SMB share or broad host filesystem access to the internet.
The build
Engineering decisions
01
Mounted only approved storage roots into a dedicated file-management workload.
02
Protected the web interface with the shared identity layer and applied default-deny networking.
03
Separated application configuration from bulk file data and documented the recovery boundary.
04
Added availability, volume, and storage-capacity monitoring.
Architecture
How the pieces connect
- 1Authenticated browser
- 2Identity-aware edge
- 3Scoped file manager
- 4Approved persistent storage roots
Results
What changed
- Routine file operations work remotely without a VPN-mounted network filesystem.
- The application cannot browse arbitrary host paths.
- Storage health remains visible independently of the web interface.
