Seafile Pro

Seafile Pro is the Blueprint’s file sync and sharing platform — private cloud storage with browser-based Office editing (OnlyOffice), collaborative document editing (SeaDoc), full-text search (SeaSearch), and antivirus scanning (ClamAV). All ten services deploy as a single Compose stack.

Written against 13.0.21 · no verification recorded against that version

Not exercised: backup and restore. Three databases, the block store and the search index have to be recovered in order, and none of it has been rehearsed.

Needs: Traefik running, a hostname, a Seafile Pro commercial license, and an external OnlyOffice instance for .docx/.xlsx/.pptx editing (optional — all other features work without it).

Installation

From apps/seafile-pro/:

1. cp .env.example .env

2. Set required values in .env:

   APP_TRAEFIK_HOST=files.example.com
   SEAFILE_ADMIN_EMAIL=admin@example.com
   TZ=Europe/Vienna

3. Generate passwords and the JWT key:

   sed -i "s|^INIT_SEAFILE_MYSQL_ROOT_PASSWORD=.*|INIT_SEAFILE_MYSQL_ROOT_PASSWORD=$(openssl rand -base64 32 | tr -d '\n')|" .env
   sed -i "s|^SEAFILE_MYSQL_DB_PASSWORD=.*|SEAFILE_MYSQL_DB_PASSWORD=$(openssl rand -base64 32 | tr -d '\n')|" .env
   sed -i "s|^INIT_SEAFILE_ADMIN_PASSWORD=.*|INIT_SEAFILE_ADMIN_PASSWORD=$(openssl rand -base64 32 | tr -d '\n')|" .env
   sed -i "s|^JWT_PRIVATE_KEY=.*|JWT_PRIVATE_KEY=$(openssl rand -base64 48 | tr -d '\n')|" .env
   sed -i "s|^REDIS_PASSWORD=.*|REDIS_PASSWORD=$(openssl rand -hex 32)|" .env

4. If using OnlyOffice, set the hostname and copy the JWT secret — it must match the OnlyOffice server exactly:

   ONLYOFFICE_HOST=office.example.com

   # sed -i "s|^ONLYOFFICE_JWT_SECRET=.*|ONLYOFFICE_JWT_SECRET=<value-from-core/onlyoffice>|" .env

5. Pull images:

   docker compose pull

6. Start the stack:

   docker compose up -d

7. Wait for all containers to be healthy — first boot initialises the databases and takes roughly three minutes:

   docker compose ps

8. Required: restart the app container once to inject Blueprint configs into Seafile’s settings files. This step only needs to run once — a marker prevents it from repeating on subsequent restarts:

   docker compose restart app

9. Build the initial full-text search index:

   docker exec seafile-pro-app /opt/seafile/seafile-server-latest/pro/pro.py search --update

Verify

docker compose ps   # all ten containers up; app, db, redis, clamav should show healthy

Confirm the config injection from step 8 ran:

docker exec seafile-pro-app grep "Blueprint" /shared/seafile/conf/seahub_settings.py
docker exec seafile-pro-app grep "SEASEARCH"  /shared/seafile/conf/seafevents.conf
docker exec seafile-pro-app grep "virus_scan" /shared/seafile/conf/seafile.conf

Each command should return a matching line. No output means the injection step was skipped — run docker compose restart app and recheck.

Confirm the notification server is reachable:

curl -s https://your-domain/notification/ping   # {"ret": "pong"}

Test antivirus:

docker exec seafile-pro-app bash -c "curl -s https://secure.eicar.org/eicar.com.txt | clamdscan -"
# Expected: stream: Eicar-Test-Signature FOUND

Then in the browser, confirm each service works:

• Log in with the admin account.
• Upload a file and download it back.
• Create and edit a Markdown (.md) file.
• Open a .docx in the OnlyOffice editor (requires OnlyOffice configured).
• Create a .sdoc file and open it in SeaDoc.
• Search for a word from an uploaded file — SeaSearch should return it.

OnlyOffice

OnlyOffice embeds a browser-based Office editor into Seafile. It runs as a separate server — either another Blueprint stack or a different machine — and both sides share the same JWT secret.

Server-to-server path: OnlyOffice needs a direct network route to Seafile’s configured hostname to fetch files and save edits back. That path can be a public internet connection or a private route such as Tailscale. If DNS for the Seafile hostname resolves to a Tailscale address on the OnlyOffice host, it will use that path automatically — no additional configuration is needed on the OnlyOffice side for the network path itself.

Allowed origins: On the OnlyOffice server, add the Seafile origin to ONLYOFFICE_ALLOWED_ORIGINS in its .env so browsers are permitted to embed the editor in an iframe. In the Blueprint’s core/onlyoffice stack this value is embedded in a Traefik label — changing it takes effect only after recreating the container, not after a plain restart:

# On the OnlyOffice server — restart is NOT enough:
docker compose up -d --force-recreate

Note

APP_TRAEFIK_ACCESS is a Traefik middleware setting, not a network exposure control. acc-public removes the source-IP allowlist inside Traefik; it does not bypass an upstream firewall or make the service reachable if it wasn’t already. If OnlyOffice traffic arrives via Tailscale but Traefik still rejects it under acc-tailscale, the source IP Traefik sees may differ from the actual client address — see Traefik troubleshooting for the known caveat and investigation steps.

Going further

SMTP

SMTP is optional but required for password reset emails, share invitations, and file change notifications. Set the SMTP variables in .env:

SEAFILE_SMTP_HOST=smtp.example.com
SEAFILE_SMTP_PORT=587
SEAFILE_SMTP_USER=user@example.com
SEAFILE_SMTP_FROM=seafile@example.com
SEAFILE_SMTP_USE_TLS=true
SEAFILE_SMTP_PASSWORD=your-smtp-password

Then recreate the app so it picks up the new values — docker compose restart keeps the environment the container was created with, so a changed .env would have no effect:

docker compose up -d app

Caution

SMTP delivery is not verified end-to-end in this Blueprint guide. After configuring, send a test email from the Seafile admin panel to confirm delivery before relying on it for password resets.

Access

The default APP_TRAEFIK_ACCESS=acc-public removes Traefik’s source-IP allowlist. Whether the service is actually reachable from the public internet depends on your DNS records, routing, and upstream firewall — the acc-public middleware setting does not control any of that.

Setting APP_TRAEFIK_ACCESS=acc-tailscale enforces a source-IP allowlist for Tailscale addresses, restricting access to clients connected to the same Tailnet. Server-to-server integrations (OnlyOffice, notifications) must also reach Seafile via Tailscale for this to apply to them.

Note

acc-tailscale has a known source-IP caveat when traffic arrives through Docker published ports — Traefik may see the Docker bridge gateway address rather than the original Tailscale client address. See Traefik troubleshooting for the cause and investigation steps. acc-public is the working alternative when this caveat applies.

Antivirus

ClamAV is included in the default COMPOSE_FILE and configured automatically when the Blueprint config injection runs (step 8 of the installation). Uploaded files are scanned on write.

To verify ClamAV is active:

docker exec seafile-pro-app bash -c "curl -s https://secure.eicar.org/eicar.com.txt | clamdscan -"
# Expected: stream: Eicar-Test-Signature FOUND

A startup log warning about the clamd socket (Clamd was NOT notified) is expected during container initialisation — it is a timing race and does not affect scanning once the container is up.

Search

SeaSearch is the default full-text search backend. It is lightweight and configured automatically by the config injection step — no manual setup required.

Elasticsearch is available in the repository as a reference compose file (elasticsearch.yml) but is not active by default and not included in COMPOSE_FILE. Do not add it alongside SeaSearch — both cannot run simultaneously.

Trigger a manual index rebuild after bulk uploads or a first install:

docker exec seafile-pro-app /opt/seafile/seafile-server-latest/pro/pro.py search --update

Backup

Backup and restore covers the host side — Borgmatic, the repository, the schedule and the database hooks. What this stack contributes:

• volumes/seafile-data/ — all user files and library data
• volumes/mysql/ — all three databases (Seafile, Seahub, Ccnet)
• volumes/seadoc-data/ — collaborative document state
• The .env file and any secrets

Caution

Nothing here has been rehearsed for this stack. A restore that recovers the databases without the matching file volumes — or the reverse — leaves the installation inconsistent rather than merely incomplete, and the three databases have to come back together. Establish and test a restore yourself before this holds anything you would miss.

Updates

1. Read the Seafile Pro release notes and the Docker upgrade guide for breaking changes.

2. Back up all volumes before touching the stack.

3. Update image tags in .env — APP_TAG for the main server, and the tags for any component services that changed.

4. Pull and recreate:

   docker compose pull
   docker compose up -d

5. Watch app logs for any database migration output:

   docker compose logs -f app

6. Verify login, file access, editing, and search after the update.

Caution

This update sequence has not been tested end-to-end in this Blueprint guide — it follows the upstream documented procedure. Read the Seafile release notes before running it.

Troubleshooting

Caution

OnlyOffice editor not loading — the most common causes are a JWT mismatch (ONLYOFFICE_JWT_SECRET in apps/seafile-pro/.env must match the secret on the OnlyOffice server exactly) or the Seafile origin missing from ONLYOFFICE_ALLOWED_ORIGINS on the OnlyOffice side.

Caution

Allowed-origins change has no effect — ONLYOFFICE_ALLOWED_ORIGINS is embedded in a Traefik label at container creation time. A plain docker compose restart on the OnlyOffice server does not pick up a new value. Recreate the container: docker compose up -d --force-recreate on the OnlyOffice server.

Note

ClamAV socket warning in startup logs — the line Clamd was NOT notified: Can't connect to clamd through /tmp/clamd.sock is a timing race during container initialisation and is non-fatal. Run the EICAR test in Verify to confirm scanning is active.

Note

MariaDB io_uring warning or Redis memory overcommit warning — both are host-level configuration notices, not application errors. The stack continues to function.

To silence the Redis warning, set vm.overcommit_memory = 1 in /etc/sysctl.conf on the host and apply it with sysctl -p. The MariaDB notice needs no action — it falls back to libaio on its own.

Note

acc-tailscale returning 403 for a Tailscale client — see Traefik troubleshooting for the source-IP caveat when traffic arrives through Docker published ports.

Repository files

• apps/seafile-pro/README.md — full setup, config injection details, and verification commands
• apps/seafile-pro/UPSTREAM.md — upstream notes, known limitations, troubleshooting table, and upgrade checklist
• apps/seafile-pro/.env.example — all configurable variables with inline comments