Caddy pattern exposes only Immich and Nextcloud share links
Original title: Expose only share links of a private service with caddy
The public site returns 404 unless the app itself confirms the share key; everything else stays on the VPN.
A self-hosting write-up describes using Caddy so guests can open Immich and Nextcloud share links without exposing the rest of those services. Before forwarding a request, Caddy asks the application whether the share key is valid and returns 404 otherwise, including for every unmatched URL. Library browsing and uploads stay reachable only through a VPN. The Immich check treats HTTP 403 from a profile route as a valid key, which the author says is a side effect that a later Immich version could change.
Unconfirmed: The Immich validity check depends on a permission side effect that a future version could change.
- A valid Immich share key currently yields 403 on /api/users/me; an invalid or expired key yields 401.
- Share-link passwords are still requested by Immich after the proxy check.
- Public routes are limited with strict path regular expressions, and selected auth headers are stripped.
- The full services remain on a separate internal Caddy instance behind the VPN or an IP restriction.
From the original article
11 min read at dataswamp.orgIn my self-hosted infrastructure, most services are only reachable through my VPN. But some of them have a feature to share something with people outside: Immich has share links for albums and photos, Nextcloud has share links for files and folders.
By dataswamp.org via ggpsv · dataswamp.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.