oierandClaude Opus 4.8
16523e4f62
Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.
- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
(file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).
Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
9 lines
355 B
Plaintext
9 lines
355 B
Plaintext
# Files — read-only static browse of the shared upload dir (FILES_DATA_DIR,
|
|
# mounted at /srv/files). NO AUTH: every uploaded file is publicly listable and
|
|
# downloadable here. Writes happen through filestash at upload.${BASE_DOMAIN}
|
|
# (60-upload.caddy); this vhost is browse-only.
|
|
http://files.{$BASE_DOMAIN} {
|
|
root * /srv/files
|
|
file_server browse
|
|
}
|