From 20d9ca87223263bcba003f1eb94f00f07d4059cd Mon Sep 17 00:00:00 2001
From: Matt Hill <9935159+MattDHill@users.noreply.github.com>
Date: Thu, 17 Sep 2026 21:21:45 -0600
Subject: [PATCH] =?UTF-8?q?feat:=20surface=20NextExplorer=20as=20external?=
 =?UTF-8?q?=20storage;=2034.0.4:1=20=E2=86=92=2034.0.4:3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NextExplorer replaces FileBrowser Quantum as the recommended file server
and the hub other services route through, so it joins the external
storage registry. The mount is the same shape as FileBrowser Quantum's,
uid 1000 idmapped to www-data, but the files_external entry exposes only
the Files drive: NextExplorer's volume root also holds `_users`, one
private directory per account, which an all-users mount would hand to
every Nextcloud user. That is what the new `dataDir` field carries.

The dependency floor is the community release, 2.2.7:0, so a box that
installed it from there before the move still satisfies it.

The revision skips :2, which is already on alpha.

Verified on the dev box: selecting NextExplorer declares the dependency,
Nextcloud restarts with the volume mounted as www-data, files_external
lists /NextExplorer with datadir /mnt/nextexplorer/Files, a file written
as www-data lands on disk as uid 1000, and NextExplorer reads and deletes
it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 AGENTS.md                                 |  4 ++--
 README.md                                 | 24 ++++++++++++-----------
 instructions.md                           |  4 ++--
 package-lock.json                         | 10 +++++++++-
 package.json                              |  3 ++-
 startos/dependencies.ts                   |  6 ++++++
 startos/externalStorage.ts                | 17 ++++++++++++++--
 startos/fileModels/store.json.ts          |  2 +-
 startos/i18n/dictionaries/default.ts      |  1 +
 startos/i18n/dictionaries/translations.ts |  4 ++++
 startos/main.ts                           | 15 ++++++++++++--
 startos/manifest/i18n.ts                  | 13 ++++++++++++
 startos/manifest/index.ts                 |  9 +++++++++
 startos/versions/current.ts               | 22 +++++++++++++++------
 14 files changed, 106 insertions(+), 28 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 4409fed..7b33a38 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,8 +36,8 @@ verified, tried, and decided belongs in the commit message and the PR body.
 - **A value the `config.php` grammar cannot model is carried through as source text — never narrow `Raw` into a hard failure.** `occ` runs inside the service container, so a value that stops the read is a brick with no way to reach the command that would remove it. Malformed input must still fail loudly, which is what bounds `Raw` to a single line: `var_export` never spreads a scalar expression over two, so a run that reaches a newline is a broken file rather than an unmodelled value. A carried-through value is `{ __raw: <source> }`, so a PHP array whose only key is `__raw` and whose value is a string is indistinguishable from one.
 - **Comments have to parse.** Nextcloud 34 prepends a banner comment between `<?php` and `$CONFIG` on every config write.
 - **A `config.php` number the double cannot print back exactly is carried through as source text too**, so `9223372036854775807`, `1.0` and `1.0E+30` survive a write. Ordinary values stay real numbers, which is what keeps `maintenance_window_start` and `redis.port` reaching their validators — do not widen this into writing every integer as a float.
-- **The FileBrowser Quantum mount's `idmap` (uid 1000 → `www-data` 33) is what makes the integration work at all**, and it needs StartOS 0.4.0-beta.10+. Files other services drop into FileBrowser Quantum's volume under a different uid surface as `nobody` until those services idmap their own mount to 1000 too.
-- **Adding an external-storage source is a registry edit in `startos/externalStorage.ts` plus a typed mount.** FileBrowser Quantum is the shared hub most services route through, so a direct source is worth adding only for a service whose files live browsably on its own volume.
+- **The external-storage mounts' `idmap` (uid 1000 → `www-data` 33) is what makes the integration work at all**, and it needs StartOS 0.4.0-beta.10+. Files other services drop into NextExplorer's or FileBrowser Quantum's volume under a different uid surface as `nobody` until those services idmap their own mount to 1000 too.
+- **Adding an external-storage source is a registry edit in `startos/externalStorage.ts` plus a typed mount.** NextExplorer is the shared hub most services route through, so a direct source is worth adding only for a service whose files live browsably on its own volume. Keep NextExplorer's `dataDir` on the `Files` drive: its volume root also holds every account's private `_users` tree.
 - **`richdocuments` drops the Microsoft formats the moment a second office connector is enabled** (`CapabilitiesService::hasOtherOOXMLApps` checks `onlyoffice` and `officeonline`), and the second app does not claim them unless it is configured — so Word, Excel and PowerPoint open in neither and silently download. That is what the `office-connectors` health check exists to catch; don't simplify it away because the reconcile disables the outgoing connector on a switch, which does not stop a user enabling one by hand.
 - **`richdocuments:activate-config` fetches the discovery document as it runs, so the `office-suite` oneshot waits on the document server's own health check before it touches anything** — a bridge address resolves well before `coolwsd` accepts a connection. Do not turn that wait into a retry: a oneshot whose fn rejects is re-invoked on a widening backoff forever, so a suite selected against a stopped or uninstalled service would run `occ` for the life of the chain. Past the gate the steps do throw, and that same re-invocation is what retries them — gate first, so a server that goes away parks the retry.
 - **Install and upgrade progress phases are driven by the stock entrypoint's own log lines** — `Initializing nextcloud`, `Starting nextcloud installation`, and the `pre-upgrade` hook scan. Re-read `/entrypoint.sh` when bumping the image: a reword leaves a bar indeterminate instead of failing anything, so nothing else will tell you.
diff --git a/README.md b/README.md
index 5ecc5f2..8fe54db 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ Three volumes.
 | `db`        | `/var/lib/postgresql` | The PostgreSQL data directory                                                |
 | `main`      | — (host side)         | `store.json`; never mounted into a container                                 |
 
-An external-storage source's volume is mounted into the Nextcloud container as well — FileBrowser Quantum's lands at `/mnt/filebrowser`, outside the `nextcloud` volume. **That mount uses `idmap`** to remap the source's on-disk uid to `www-data`, so Nextcloud simply owns the tree: it reads, writes, and moves files with no permission machinery, and the files it creates land back on disk under the source's own uid so the source can still manage them.
+An external-storage source's volume is mounted into the Nextcloud container as well — NextExplorer's lands at `/mnt/nextexplorer` and FileBrowser Quantum's at `/mnt/filebrowser`, outside the `nextcloud` volume. NextExplorer's `files_external` entry exposes only its `Files` drive, because the volume root also holds every account's private `_users` tree. **That mount uses `idmap`** to remap the source's on-disk uid to `www-data`, so Nextcloud simply owns the tree: it reads, writes, and moves files with no permission machinery, and the files it creates land back on disk under the source's own uid so the source can still manage them.
 
 ## File Models
 
@@ -105,13 +105,14 @@ Three settings depart from what upstream would do:
 
 ## Dependencies
 
-None are required. Both are optional and exist only while they are selected.
+None are required. All are optional and exist only while they are selected.
 
-| Dependency         | Kind      | Health checks    | Required                                                                                             |
-| ------------------ | --------- | ---------------- | ---------------------------------------------------------------------------------------------------- |
-| `filebrowser`      | `exists`  | —                | Only while chosen in the External Storage action                                                     |
-| `coturn`           | `running` | **none**         | Only while Talk call relaying is on in the Configure action                                          |
-| `collabora-online` | `running` | `cool`           | Only while chosen in the Office Suite action                                                         |
+| Dependency         | Kind      | Health checks    | Required                                                                                              |
+| ------------------ | --------- | ---------------- | ----------------------------------------------------------------------------------------------------- |
+| `nextexplorer`     | `exists`  | —                | Only while chosen in the External Storage action                                                      |
+| `filebrowser`      | `exists`  | —                | Only while chosen in the External Storage action                                                      |
+| `coturn`           | `running` | **none**         | Only while Talk call relaying is on in the Configure action                                           |
+| `collabora-online` | `running` | `cool`           | Only while chosen in the Office Suite action                                                          |
 | `onlyoffice-docs`  | `running` | `documentserver` | Only while chosen in the Office Suite action; published to the Community Registry, not the Start9 one |
 
 The External Storage action offers only the sources whose backing service is actually installed, so an uninstalled one never appears in the form.
@@ -192,7 +193,7 @@ Selects the document server that opens office files — Collabora Online, ONLYOF
 
 The wait is a subscription, not a poll. It runs no commands, cannot fail, and releases the moment the service becomes ready — a few tens of seconds into an ordinary start, or whenever the user installs the service if they selected it first. A bridge address is not a usable readiness signal here: the port is bound, and the address therefore resolves, well before `coolwsd` accepts its first connection.
 
-**A step that fails past that gate is retried, not reported.** The oneshot throws, so the SDK re-invokes it on a widening backoff capped at thirty seconds, and every attempt passes through the gate first — a document server that has gone away parks the retry rather than spinning it. The command's output is in the service log on each attempt, and the Office Connector check reads *Setting up …* until an attempt succeeds. Nothing else is needed to recover: an app installed by hand, or an app store that comes back, is picked up by the next attempt.
+**A step that fails past that gate is retried, not reported.** The oneshot throws, so the SDK re-invokes it on a widening backoff capped at thirty seconds, and every attempt passes through the gate first — a document server that has gone away parks the retry rather than spinning it. The command's output is in the service log on each attempt, and the Office Connector check reads _Setting up …_ until an attempt succeeds. Nothing else is needed to recover: an app installed by hand, or an app store that comes back, is picked up by the next attempt.
 
 **The `trusted_domains` entry is load-bearing.** A document server fetches and saves files over the host bridge, and without that entry Nextcloud answers every one of those requests with `Trusted domain error` — the editor opens and then fails to load the document. Nextcloud matches on the host alone, so the bare IP covers whatever port the binding was assigned.
 
@@ -253,9 +254,9 @@ A web-interface failure after the grace period is Nextcloud itself: an app that
 
 The transient checks — Recognize Model Download, Memories Indexing, Memories Map Setup, File Scan, Repair — exist only while their task is pending, and report `loading` with a progress message throughout.
 
-**Office Connector** (`office-connectors`) — present only while an office suite is selected, and stateless: each poll re-derives its result from `store.json`, the dependency's status and Nextcloud's enabled-app list, so every state heals on its own. Until the `office-suite` oneshot has applied the selection it reports `loading`: *Waiting for Collabora Online to be ready* while the document server's own health check is not passing — the dependency entry on the service page already says why — and *Setting up Nextcloud Office (Collabora)…* once it is, while the connector is installed and configured. Once applied, it reads the enabled-app list and fails in two distinct cases, each with its own instruction. Reading that list boots PHP, so a passing check polls every two minutes and a failing one every fifteen seconds; the loading states, which read nothing from Nextcloud, poll every five. The two-minute ceiling is also how long a connector someone has just switched off keeps reading as enabled.
+**Office Connector** (`office-connectors`) — present only while an office suite is selected, and stateless: each poll re-derives its result from `store.json`, the dependency's status and Nextcloud's enabled-app list, so every state heals on its own. Until the `office-suite` oneshot has applied the selection it reports `loading`: _Waiting for Collabora Online to be ready_ while the document server's own health check is not passing — the dependency entry on the service page already says why — and _Setting up Nextcloud Office (Collabora)…_ once it is, while the connector is installed and configured. Once applied, it reads the enabled-app list and fails in two distinct cases, each with its own instruction. Reading that list boots PHP, so a passing check polls every two minutes and a failing one every fifteen seconds; the loading states, which read nothing from Nextcloud, poll every five. The two-minute ceiling is also how long a connector someone has just switched off keeps reading as enabled.
 
-**The selected suite's connector is not enabled.** It has been removed or switched off since the package set it up. The message says *Install* or *Enable* accordingly — telling someone to install what they already have is how a message stops being read — and names the other way out: selecting `None` in the Office Suite action. Without this the failure is silent: the document server runs, and nothing in Nextcloud opens in it.
+**The selected suite's connector is not enabled.** It has been removed or switched off since the package set it up. The message says _Install_ or _Enable_ accordingly — telling someone to install what they already have is how a message stops being read — and names the other way out: selecting `None` in the Office Suite action. Without this the failure is silent: the document server runs, and nothing in Nextcloud opens in it.
 
 **More than one office connector is enabled.** Everything is running and OpenDocument files still open; what breaks is Word, Excel and PowerPoint, silently. `richdocuments` demotes those formats the moment it sees a rival connector enabled, and the rival does not claim them unless it is configured too. The message names the app to disable.
 
@@ -281,7 +282,7 @@ Mixed, and each half is scoped deliberately.
 5. **PostgreSQL and Valkey are private sidecars.** Neither can be shared with another service or replaced with an external instance.
 6. **The admin password is shown once and then discarded.** Reset Admin Password is the only recovery.
 7. **The long-running actions restart the service** to run their work, and continue after the action returns.
-8. **External storage is limited to registered sources** — currently FileBrowser Quantum — and only while that service is installed.
+8. **External storage is limited to registered sources** — NextExplorer and FileBrowser Quantum — and only while that service is installed.
 9. **Talk's default `stun.nextcloud.com:443` is left in place** when relaying is enabled. Coturn's own STUN entry is added alongside it rather than replacing it, since removing an entry the package did not add is the admin's call; delete it in Talk's admin settings to keep reflexive discovery entirely on your own server.
 10. **Talk call relaying is Coturn or nothing.** There is no field for an external TURN server — configure one directly in Talk's admin settings instead, and leave the toggle off.
 11. **No riscv64 build.** x86_64 and aarch64 only.
@@ -321,6 +322,7 @@ startos_managed_env_vars:
   - NEXTCLOUD_ADMIN_PASSWORD # install only
   - NEXTCLOUD_UPDATE # the init-time upgrade run only
 dependencies:
+  - nextexplorer # optional, exists; only while selected as an external-storage source
   - filebrowser # optional, exists; only while selected as an external-storage source
   - coturn # optional, running, no health checks; only while Talk call relaying is on
   - collabora-online # optional, running, health check `cool`; only while selected as the office suite
diff --git a/instructions.md b/instructions.md
index efab1e9..0c4c8ac 100644
--- a/instructions.md
+++ b/instructions.md
@@ -34,7 +34,7 @@ Point a Nextcloud desktop or mobile client (or any WebDAV client) at the **WebDA
 ### Actions
 
 - **Configure** — set the default locale, default phone region, how long deleted files are kept before Nextcloud removes them for good (**Delete Files in Trash** — by default they are kept at least 30 days and then cleared only when disk space runs short, so trash can pile up on a server with room to spare), the UTC start hour of Nextcloud's nightly maintenance window for background jobs, a toggle to stop seeding new user accounts with Nextcloud's default skeleton files (sample documents, photos, README), and **Relay Talk Calls Through Coturn** (see below).
-- **External Storage** — surface another StartOS service's storage as a folder in your Nextcloud **Files**, using Nextcloud's built-in External Storage app. The action lists a dropdown for each supported service **you have installed** (today just **FileBrowser Quantum** → a `/FileBrowser` folder). Each dropdown is **Not mounted** (off), **Available to all users**, or **Available to specific users** (which then lets you pick exactly which Nextcloud users see it). The folder is read-write, so you can **move files out of it into Nextcloud**. Nextcloud must be **running** to run this action (it reads your live user list). Files other services add to FileBrowser Quantum appear automatically when you open the folder — so FileBrowser Quantum acts as the shared hub: point any service that should be visible in Nextcloud at FileBrowser Quantum.
+- **External Storage** — surface another StartOS service's storage as a folder in your Nextcloud **Files**, using Nextcloud's built-in External Storage app. The action lists a dropdown for each supported service **you have installed** (**NextExplorer** → a `/NextExplorer` folder showing its Files drive, **FileBrowser Quantum** → a `/FileBrowser` folder). Each dropdown is **Not mounted** (off), **Available to all users**, or **Available to specific users** (which then lets you pick exactly which Nextcloud users see it). The folder is read-write, so you can **move files out of it into Nextcloud**. Nextcloud must be **running** to run this action (it reads your live user list). Files other services add to NextExplorer or FileBrowser Quantum appear automatically when you open the folder — so NextExplorer acts as the shared hub: point any service that should be visible in Nextcloud at NextExplorer.
 - **Reset Admin Password** — pick an admin user and generate a new random password. Use this if the admin password is lost or you want to rotate it.
 - **Disable Maintenance Mode** (Maintenance group) — runs `occ maintenance:mode --off`. Brief maintenance mode after an update or restart is normal — wait at least 15 minutes before resorting to this. Nextcloud version updates now run as part of the StartOS update step and roll back cleanly if they fail, so you should rarely need this.
 - **Disable Non-default Apps** (Maintenance group) — disables every enabled app that Nextcloud does not ship, keeping the bundled set plus Calendar and Contacts. Use this if a third-party app has broken the UI with an Internal Server Error. The result lists what was disabled, and separately anything that could not be, so a single stuck app does not stop the rest. Stable apps must then be re-enabled individually from the Nextcloud Apps page.
@@ -80,7 +80,7 @@ For one document that costs you nothing — you would never notice, and you coul
 
 ## Limitations
 
-- **No arbitrary host directory mounts.** You can surface another StartOS service's files with the **External Storage** action (currently FileBrowser Quantum), and you can attach remote storage (S3, WebDAV, SMB, etc.) through Nextcloud's built-in External Storage app. StartOS does not expose arbitrary host directories to the container.
+- **No arbitrary host directory mounts.** You can surface another StartOS service's files with the **External Storage** action (NextExplorer or FileBrowser Quantum), and you can attach remote storage (S3, WebDAV, SMB, etc.) through Nextcloud's built-in External Storage app. StartOS does not expose arbitrary host directories to the container.
 - **No built-in SMTP.** Configure email under Nextcloud's **Administration settings → Basic settings → Email server**.
 - **PHP memory limit is 1024 MB and the per-file upload limit is 20 GB.** These are not user-configurable.
 - **Update one major Nextcloud version at a time.** Nextcloud only supports upgrading a single major version per step. An update that would jump more than one major version at once is refused with a clear message before anything changes; install the release it names from the version list, then update again. Keep the service updated regularly rather than letting several releases pile up.
diff --git a/package-lock.json b/package-lock.json
index 3ce0cde..4a1d188 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7,7 +7,8 @@
       "name": "nextcloud-startos",
       "dependencies": {
         "@start9labs/start-sdk": "2.0.9",
-        "filebrowser-startos": "github:Start9Labs/filebrowser-startos#next"
+        "filebrowser-startos": "github:Start9Labs/filebrowser-startos#next",
+        "nextexplorer-startos": "github:Start9Labs/nextexplorer-startos#next"
       },
       "devDependencies": {
         "@types/node": "^22.19.0",
@@ -1659,6 +1660,13 @@
         "node": ">=16"
       }
     },
+    "node_modules/nextexplorer-startos": {
+      "resolved": "git+ssh://git@github.com/Start9Labs/nextexplorer-startos.git#d8588c6874e0f7e5ca1e160dc58e1fcf06c0ef59",
+      "dependencies": {
+        "@start9labs/start-sdk": "2.0.9",
+        "filebrowser-startos": "github:Start9Labs/filebrowser-startos#next"
+      }
+    },
     "node_modules/node-fetch": {
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
diff --git a/package.json b/package.json
index d038842..37ace15 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,8 @@
   },
   "dependencies": {
     "@start9labs/start-sdk": "2.0.9",
-    "filebrowser-startos": "github:Start9Labs/filebrowser-startos#next"
+    "filebrowser-startos": "github:Start9Labs/filebrowser-startos#next",
+    "nextexplorer-startos": "github:Start9Labs/nextexplorer-startos#next"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",
diff --git a/startos/dependencies.ts b/startos/dependencies.ts
index c1925d4..6de7890 100644
--- a/startos/dependencies.ts
+++ b/startos/dependencies.ts
@@ -16,6 +16,12 @@ export const setDependencies = sdk.setupDependencies(async ({ effects }) => {
 
   // Only require a source while it's selected. `exists` (not `running`) — we
   // only need the source's volume present on disk to mount and read/write it.
+  if (sources.includes('nextexplorer')) {
+    deps['nextexplorer'] = {
+      kind: 'exists',
+      versionRange: externalStorageMeta.nextexplorer.versionRange,
+    }
+  }
   if (sources.includes('filebrowser')) {
     deps['filebrowser'] = {
       kind: 'exists',
diff --git a/startos/externalStorage.ts b/startos/externalStorage.ts
index 991f982..ad85af9 100644
--- a/startos/externalStorage.ts
+++ b/startos/externalStorage.ts
@@ -23,12 +23,12 @@ import { I18nKey } from './i18n/dictionaries/default'
  * downloads/media/documents directory) — e.g. qBittorrent (`main`/`downloads`).
  * AVOID app-managed content-addressed stores that intermingle a database with
  * hash-named blobs (e.g. Docuseal): surfacing those exposes the DB and shows
- * unbrowsable files. FileBrowser Quantum is the intended shared hub other services
+ * unbrowsable files. NextExplorer is the intended shared hub other services
  * route through, so a direct source is only worth adding for a service whose
  * files live in its own volume.
  */
 
-export const EXTERNAL_STORAGE_SOURCES = ['filebrowser'] as const
+export const EXTERNAL_STORAGE_SOURCES = ['nextexplorer', 'filebrowser'] as const
 export type ExternalStorageSource = (typeof EXTERNAL_STORAGE_SOURCES)[number]
 
 export type ExternalStorageMeta = {
@@ -38,6 +38,8 @@ export type ExternalStorageMeta = {
   label: I18nKey
   /** Where the source's volume is mounted inside Nextcloud's container. */
   mountpoint: string
+  /** The directory under `mountpoint` the `files_external` entry exposes. */
+  dataDir: string
   /**
    * The mount point (folder name) of the `files_external` entry as shown in
    * the Nextcloud Files UI. Also used to find the entry again for deletion.
@@ -56,10 +58,21 @@ export const externalStorageMeta: Record<
   ExternalStorageSource,
   ExternalStorageMeta
 > = {
+  nextexplorer: {
+    packageId: 'nextexplorer',
+    label: 'NextExplorer',
+    mountpoint: '/mnt/nextexplorer',
+    // The default drive only. The volume root also holds `_users`, one private
+    // directory per NextExplorer account, which an all-users mount would expose.
+    dataDir: '/mnt/nextexplorer/Files',
+    ncMountPoint: '/NextExplorer',
+    versionRange: '>=2.2.7:0',
+  },
   filebrowser: {
     packageId: 'filebrowser',
     label: 'FileBrowser Quantum',
     mountpoint: '/mnt/filebrowser',
+    dataDir: '/mnt/filebrowser',
     ncMountPoint: '/FileBrowser',
     // 2.62.2:1 restructured the volumes (`data` volume, files owned by uid
     // 1000) — everything the idmap mount in main.ts relies on.
diff --git a/startos/fileModels/store.json.ts b/startos/fileModels/store.json.ts
index c09e52d..90df39e 100644
--- a/startos/fileModels/store.json.ts
+++ b/startos/fileModels/store.json.ts
@@ -32,7 +32,7 @@ const shape = z.object({
   // `external-storage` action, read reactively in setupMain/setDependencies.
   // Keep the enum in sync with EXTERNAL_STORAGE_SOURCES.
   externalStorages: z
-    .array(z.enum(['filebrowser']))
+    .array(z.enum(['nextexplorer', 'filebrowser']))
     .catch([])
     .default([]),
   // Per-source applicable users: source id -> Nextcloud user list. An empty or
diff --git a/startos/i18n/dictionaries/default.ts b/startos/i18n/dictionaries/default.ts
index 9fcee6c..07ddbfb 100644
--- a/startos/i18n/dictionaries/default.ts
+++ b/startos/i18n/dictionaries/default.ts
@@ -182,6 +182,7 @@ const dict = {
   'External Storage': 121,
   'Each selected service is mounted into Nextcloud and added to Files. FileBrowser Quantum is mounted read-write, so you can move its files into Nextcloud. Clear a selection to remove it.': 122,
   'FileBrowser Quantum': 123,
+  NextExplorer: 163,
   "Show other StartOS services' files as folders in Nextcloud Files, via the built-in External Storage app.": 124,
   'Available to Users': 125,
   'Which Nextcloud users see the selected storage in their Files. Leave empty to make it available to all users.': 126,
diff --git a/startos/i18n/dictionaries/translations.ts b/startos/i18n/dictionaries/translations.ts
index a7a5922..9aa3d30 100644
--- a/startos/i18n/dictionaries/translations.ts
+++ b/startos/i18n/dictionaries/translations.ts
@@ -126,6 +126,7 @@ export default {
     121: 'Almacenamiento externo',
     122: 'Cada servicio seleccionado se monta en Nextcloud y se añade a Archivos. FileBrowser Quantum se monta con permisos de lectura y escritura, para que pueda mover sus archivos a Nextcloud. Anule la selección para eliminarlo.',
     123: 'FileBrowser Quantum',
+    163: 'NextExplorer',
     124: 'Muestra los archivos de otros servicios de StartOS como carpetas en Archivos de Nextcloud, mediante la aplicación integrada de Almacenamiento externo.',
     125: 'Disponible para los usuarios',
     126: 'Qué usuarios de Nextcloud ven el almacenamiento seleccionado en sus Archivos. Déjelo vacío para que esté disponible para todos los usuarios.',
@@ -285,6 +286,7 @@ export default {
     121: 'Externer Speicher',
     122: 'Jeder ausgewählte Dienst wird in Nextcloud eingebunden und zu Dateien hinzugefügt. FileBrowser Quantum wird mit Lese- und Schreibzugriff eingebunden, sodass Sie dessen Dateien nach Nextcloud verschieben können. Heben Sie die Auswahl auf, um ihn zu entfernen.',
     123: 'FileBrowser Quantum',
+    163: 'NextExplorer',
     124: 'Zeigt Dateien anderer StartOS-Dienste als Ordner in Nextcloud Dateien an, über die integrierte App für externen Speicher.',
     125: 'Verfügbar für Benutzer',
     126: 'Welche Nextcloud-Benutzer den ausgewählten Speicher in ihren Dateien sehen. Leer lassen, um ihn für alle Benutzer verfügbar zu machen.',
@@ -444,6 +446,7 @@ export default {
     121: 'Magazyn zewnętrzny',
     122: 'Każda wybrana usługa jest montowana w Nextcloud i dodawana do aplikacji Pliki. FileBrowser Quantum jest montowany w trybie do odczytu i zapisu, dzięki czemu możesz przenosić jego pliki do Nextcloud. Usuń zaznaczenie, aby ją odłączyć.',
     123: 'FileBrowser Quantum',
+    163: 'NextExplorer',
     124: 'Pokazuje pliki innych usług StartOS jako foldery w aplikacji Pliki w Nextcloud, korzystając z wbudowanej aplikacji Magazyn zewnętrzny.',
     125: 'Dostępne dla użytkowników',
     126: 'Którzy użytkownicy Nextcloud widzą wybrany magazyn w swoich Plikach. Pozostaw puste, aby był dostępny dla wszystkich użytkowników.',
@@ -603,6 +606,7 @@ export default {
     121: 'Stockage externe',
     122: 'Chaque service sélectionné est monté dans Nextcloud et ajouté à Fichiers. FileBrowser Quantum est monté en lecture-écriture, ce qui vous permet de déplacer ses fichiers vers Nextcloud. Désélectionnez-le pour le retirer.',
     123: 'FileBrowser Quantum',
+    163: 'NextExplorer',
     124: "Affiche les fichiers d'autres services StartOS sous forme de dossiers dans Fichiers de Nextcloud, via l'application intégrée Stockage externe.",
     125: 'Disponible pour les utilisateurs',
     126: 'Quels utilisateurs Nextcloud voient le stockage sélectionné dans leurs Fichiers. Laissez vide pour le rendre disponible à tous les utilisateurs.',
diff --git a/startos/main.ts b/startos/main.ts
index 6580834..06f0115 100644
--- a/startos/main.ts
+++ b/startos/main.ts
@@ -1,4 +1,5 @@
 import { manifest as filebrowserManifest } from 'filebrowser-startos/startos/manifest'
+import { manifest as nextexplorerManifest } from 'nextexplorer-startos/startos/manifest'
 import { T } from '@start9labs/start-sdk'
 import {
   EXTERNAL_STORAGE_SOURCES,
@@ -310,6 +311,16 @@ export const main = sdk.setupMain(async ({ effects }) => {
   // writes and MOVES files with no permission machinery, and files it creates
   // land back on disk as the source's uid so the source can manage them too.
   let mounts = nextcloudMount
+  if (sources.includes('nextexplorer')) {
+    mounts = mounts.mountDependency<typeof nextexplorerManifest>({
+      dependencyId: 'nextexplorer',
+      volumeId: 'data',
+      subpath: null,
+      mountpoint: externalStorageMeta.nextexplorer.mountpoint,
+      readonly: false,
+      idmap: [{ fromId: 1000, toId: 33 }],
+    })
+  }
   if (sources.includes('filebrowser')) {
     mounts = mounts.mountDependency<typeof filebrowserManifest>({
       dependencyId: 'filebrowser',
@@ -1209,7 +1220,7 @@ async function reconcileExternalStorage(
   // previous selection: selected → ensure + set applicable; unselected → delete.
   for (const id of EXTERNAL_STORAGE_SOURCES) {
     if (abort.aborted) return
-    const { ncMountPoint, mountpoint } = externalStorageMeta[id]
+    const { ncMountPoint, dataDir } = externalStorageMeta[id]
     try {
       if (desired.includes(id)) {
         let mount = matchingMounts(await listMounts(), ncMountPoint)[0]
@@ -1220,7 +1231,7 @@ async function reconcileExternalStorage(
             'local',
             'null::null',
             '-c',
-            `datadir=${mountpoint}`,
+            `datadir=${dataDir}`,
           ])
           if (create.exitCode !== 0) {
             allOk = false
diff --git a/startos/manifest/i18n.ts b/startos/manifest/i18n.ts
index 88aef7a..cf940af 100644
--- a/startos/manifest/i18n.ts
+++ b/startos/manifest/i18n.ts
@@ -6,6 +6,19 @@ export const short = {
   fr_FR: 'Un foyer sûr pour toutes vos données',
 }
 
+export const nextexplorerDescription = {
+  en_US:
+    'Provides shared file storage that Nextcloud can surface as a folder in Files.',
+  es_ES:
+    'Proporciona almacenamiento de archivos compartido que Nextcloud puede mostrar como una carpeta en Archivos.',
+  de_DE:
+    'Stellt gemeinsam genutzten Dateispeicher bereit, den Nextcloud als Ordner in Dateien anzeigen kann.',
+  pl_PL:
+    'Zapewnia współdzielony magazyn plików, który Nextcloud może pokazać jako folder w Plikach.',
+  fr_FR:
+    'Fournit un stockage de fichiers partagé que Nextcloud peut présenter comme un dossier dans Fichiers.',
+}
+
 export const filebrowserDescription = {
   en_US:
     'Provides shared file storage that Nextcloud can surface as a folder in Files.',
diff --git a/startos/manifest/index.ts b/startos/manifest/index.ts
index e26f17e..03bfbb7 100644
--- a/startos/manifest/index.ts
+++ b/startos/manifest/index.ts
@@ -4,6 +4,7 @@ import {
   coturnDescription,
   filebrowserDescription,
   long,
+  nextexplorerDescription,
   onlyofficeDescription,
   short,
 } from './i18n'
@@ -41,6 +42,14 @@ export const manifest = setupManifest({
     },
   },
   dependencies: {
+    nextexplorer: {
+      description: nextexplorerDescription,
+      optional: true,
+      metadata: {
+        title: 'NextExplorer',
+        icon: 'https://raw.githubusercontent.com/Start9Labs/nextexplorer-startos/04f7ecbfc31ad2205e0222dd7568fb881aa06c79/icon.svg',
+      },
+    },
     filebrowser: {
       description: filebrowserDescription,
       optional: true,
diff --git a/startos/versions/current.ts b/startos/versions/current.ts
index b079c9f..bda02e6 100644
--- a/startos/versions/current.ts
+++ b/startos/versions/current.ts
@@ -1,13 +1,23 @@
 import { IMPOSSIBLE, VersionInfo } from '@start9labs/start-sdk'
 
 export const current = VersionInfo.of({
-  version: '34.0.4:1',
+  version: '34.0.4:3',
   releaseNotes: {
-    en_US: `An update that would skip a Nextcloud major version is refused before anything on disk changes. Install the Nextcloud 33 release from the version list first, then update again — this also works on a server where an earlier attempt at this update failed.`,
-    es_ES: `Una actualización que saltaría una versión mayor de Nextcloud se rechaza antes de que cambie nada en el disco. Instale primero la versión con Nextcloud 33 desde la lista de versiones y vuelva a actualizar; esto también funciona en un servidor donde un intento anterior de esta actualización falló.`,
-    de_DE: `Ein Update, das eine Nextcloud-Hauptversion überspringen würde, wird abgelehnt, bevor sich etwas auf der Festplatte ändert. Installieren Sie zuerst die Version mit Nextcloud 33 aus der Versionsliste und aktualisieren Sie dann erneut — das funktioniert auch auf einem Server, auf dem ein früherer Versuch dieses Updates fehlgeschlagen ist.`,
-    pl_PL: `Aktualizacja, która pominęłaby główną wersję Nextcloud, jest odrzucana, zanim cokolwiek zmieni się na dysku. Najpierw zainstaluj wydanie z Nextcloud 33 z listy wersji, a następnie zaktualizuj ponownie — działa to również na serwerze, na którym wcześniejsza próba tej aktualizacji się nie powiodła.`,
-    fr_FR: `Une mise à jour qui sauterait une version majeure de Nextcloud est refusée avant que quoi que ce soit ne change sur le disque. Installez d'abord la version avec Nextcloud 33 depuis la liste des versions, puis mettez à jour à nouveau — cela fonctionne aussi sur un serveur où une tentative précédente de cette mise à jour a échoué.`,
+    en_US: `**External Storage** can now surface NextExplorer, the recommended file server: its Files drive appears as a NextExplorer folder in Nextcloud Files.
+
+An update that would skip a Nextcloud major version is refused before anything on disk changes. Install the Nextcloud 33 release from the version list first, then update again — this also works on a server where an earlier attempt at this update failed.`,
+    es_ES: `**Almacenamiento externo** ahora puede mostrar NextExplorer, el servidor de archivos recomendado: su unidad Files aparece como una carpeta NextExplorer en Archivos de Nextcloud.
+
+Una actualización que saltaría una versión mayor de Nextcloud se rechaza antes de que cambie nada en el disco. Instale primero la versión con Nextcloud 33 desde la lista de versiones y vuelva a actualizar; esto también funciona en un servidor donde un intento anterior de esta actualización falló.`,
+    de_DE: `**Externer Speicher** kann jetzt NextExplorer einbinden, den empfohlenen Dateiserver: sein Laufwerk Files erscheint als Ordner NextExplorer in Nextcloud Dateien.
+
+Ein Update, das eine Nextcloud-Hauptversion überspringen würde, wird abgelehnt, bevor sich etwas auf der Festplatte ändert. Installieren Sie zuerst die Version mit Nextcloud 33 aus der Versionsliste und aktualisieren Sie dann erneut — das funktioniert auch auf einem Server, auf dem ein früherer Versuch dieses Updates fehlgeschlagen ist.`,
+    pl_PL: `**Magazyn zewnętrzny** może teraz pokazać NextExplorer, zalecany serwer plików: jego dysk Files pojawia się jako folder NextExplorer w Plikach Nextcloud.
+
+Aktualizacja, która pominęłaby główną wersję Nextcloud, jest odrzucana, zanim cokolwiek zmieni się na dysku. Najpierw zainstaluj wydanie z Nextcloud 33 z listy wersji, a następnie zaktualizuj ponownie — działa to również na serwerze, na którym wcześniejsza próba tej aktualizacji się nie powiodła.`,
+    fr_FR: `**Stockage externe** peut désormais présenter NextExplorer, le serveur de fichiers recommandé : son lecteur Files apparaît comme un dossier NextExplorer dans Fichiers de Nextcloud.
+
+Une mise à jour qui sauterait une version majeure de Nextcloud est refusée avant que quoi que ce soit ne change sur le disque. Installez d'abord la version avec Nextcloud 33 depuis la liste des versions, puis mettez à jour à nouveau — cela fonctionne aussi sur un serveur où une tentative précédente de cette mise à jour a échoué.`,
   },
   migrations: {
     up: async () => {},