From cc960eb3eb0aba3ad28423399c04b691fbae1729 Mon Sep 17 00:00:00 2001 From: ginnoir Date: Wed, 5 Aug 2026 11:13:34 -0500 Subject: [PATCH] fix(caddy): let nextcloud public share links work off-LAN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit files.ginnoir.com imported internal_only, which 403s every non-LAN/tailnet client — including anyone opening a public share link. Replace the blanket import with an inline @blocked matcher that keeps the same IP gate but exempts Nextcloud's public-share surface: /s/*, /public.php*, the files_sharing app, and the static assets the share page loads. Everything else on the host (file browser, /settings, /remote.php/dav) still 403s externally. The nextcloud.ginnoir.com alias is unchanged and stays fully internal-only. Co-Authored-By: Claude Opus 5 --- Caddyfile | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/Caddyfile b/Caddyfile index 61f8f27..fc4213f 100644 --- a/Caddyfile +++ b/Caddyfile @@ -84,7 +84,20 @@ foundry2.ginnoir.com { # FILE STORAGE — internal only (Nextcloud) # ============================================================= files.ginnoir.com { - import internal_only + # Public share links must resolve for external users; the rest of Nextcloud + # stays LAN/tailnet-only. Can't use `import internal_only` here — this needs + # the same IP gate with a path-based exemption, so the matcher is inlined. + # Blocked = external client AND not a public-share path. The /core, /dist, + # /css, /js and theming paths are the assets the share page itself loads; + # without them an external visitor gets an unstyled, non-functional page. + @blocked { + not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1 + not path /s/* /index.php/s/* /public.php /public.php/* + not path /apps/files_sharing/* /index.php/apps/files_sharing/* /ocs/v2.php/apps/files_sharing/* + not path /core/* /dist/* /css/* /js/* /themes/* /apps/theming/* /index.php/apps/theming/* + } + respond @blocked "Access denied" 403 + redir /.well-known/carddav /remote.php/dav 301 redir /.well-known/caldav /remote.php/dav 301 reverse_proxy nextcloud:80 {