oierandClaude Opus 4.8
16523e4f62
Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.
- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
(file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).
Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
15 lines
692 B
Plaintext
15 lines
692 B
Plaintext
# Upload — Filestash player file share (filestash service). Shared login,
|
|
# writable. See plan/20-files.md.
|
|
#
|
|
# Filestash blocks any request whose Host header doesn't match its configured
|
|
# `general.host` (https://upload.${BASE_DOMAIN}), with "only traffic from X is
|
|
# allowed". The host nginx forwards the original Host, and caddy passes it
|
|
# through untouched — do NOT rewrite it here or every request 403s.
|
|
#
|
|
# Filestash CANNOT be served under a subpath (SPA hardcodes /api, /assets, /login
|
|
# at root), so it gets its own subdomain. The read-only browse of the same share
|
|
# lives at files.${BASE_DOMAIN} (62-files.caddy).
|
|
http://upload.{$BASE_DOMAIN} {
|
|
reverse_proxy filestash:8334
|
|
}
|