oierandClaude Opus 4.8
16523e4f62
Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.
- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
(file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).
Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
825 B
Cheetah
32 lines
825 B
Cheetah
{
|
|
"general": {
|
|
"name": "Ulicraft Files",
|
|
"host": "upload.${BASE_DOMAIN}",
|
|
"force_ssl": true,
|
|
"secret_key": "${FILES_SECRET_KEY}",
|
|
"editor": "base",
|
|
"display_hidden": false,
|
|
"upload_button": true,
|
|
"fork_button": false
|
|
},
|
|
"auth": {
|
|
"admin": "${FILES_ADMIN_PASSWORD_HASH}"
|
|
},
|
|
"middleware": {
|
|
"identity_provider": {
|
|
"type": "${FILES_IDP_TYPE}",
|
|
"params": "${FILES_IDP_PARAMS}"
|
|
},
|
|
"attribute_mapping": {
|
|
"related_backend": "files",
|
|
"params": "{\"files\":{\"type\":\"local\",\"path\":\"/data/files/\",\"password\":\"${FILES_LOCAL_SECRET}\"}}"
|
|
}
|
|
},
|
|
"connections": [
|
|
{
|
|
"label": "files",
|
|
"type": "local"
|
|
}
|
|
]
|
|
}
|