hacdias/webdav

go install github.com/hacdias/webdav/v5@latest

brew install webdav

# GitHub Registry
docker pull ghcr.io/hacdias/webdav:latest

# Docker Hub
docker pull hacdias/webdav:latest

docker run \
  -p 6065:6065 \
  -v ./config.yml:/config.yml:ro \
  -v ./data:/data \
  ghcr.io/hacdias/webdav -c /config.yml

--log-driver journald \
--name webdav \

address: 0.0.0.0
port: 6065

# TLS-related settings if you want to enable TLS directly.
tls: false
cert: cert.pem
key: key.pem

# Send a Strict-Transport-Security header on HTTPS responses, so browsers only
# use HTTPS with this host. Set to true for 'max-age=31536000' (a year), or to
# the header value, such as 'max-age=31536000; includeSubDomains'. Only applies
# when this server handles TLS itself: behind a proxy, set the header there.
# Default is 'false'.
hsts: false

# Prefix to apply to the WebDAV path-ing. Default is '/'.
prefix: /

# Enable or disable debug logging. Default is 'false'.
debug: false

# Disable sniffing the files to detect their content type. Default is 'false'.
noSniff: false

# Whether the server runs behind a trusted proxy or not. When this is true,
# the last entry of the X-Forwarded-For header, which the proxy appends, is
# logged as the remote address (if available).
behindProxy: false

# The directory that will be able to be accessed by the users when connecting.
# This directory will be used by users unless they have their own 'directory' defined.
# By default it points to the working directory. In the case of the compose file above,
# that is /data.
directory: /data

# Alternatively, replace 'directory' with 'directories' to expose multiple
# directories as virtual root entries. This option is mutually exclusive with
# 'directory' in the same scope. Rules should include the virtual mount name,
# such as /media/public/access/.
# directories:
#   - media: /data/media
#   - /data/archive
#   - name: backups
#     path: /data/backups

# The default permissions for users. This is a case insensitive option. Possible
# permissions: C (Create), R (Read), U (Update), D (Delete). You can combine multiple
# permissions. For example, to allow to read and create, set "RC". Default is "R".
# LOCK counts as a write: it needs U on a path that exists and C on one that does
# not, since locking a path that does not exist creates it.
# Being overwritten counts as well: a COPY or MOVE onto an existing file replaces
# it and needs U, while one onto an existing collection removes everything it
# holds and needs D, on the collection and on every path under it.
permissions: R

# The default permissions rules for users. Default is none. Rules are applied
# from last to first, that is, the first rule that matches the request, starting
# from the end, will be applied to the request. Rule paths are always relative to
# the user's directory.
rules: []

# The behavior of redefining the rules for users. It can be:
# - overwrite: when a user has rules defined, these will overwrite any global
#   rules already defined. That is, the global rules are not applicable to the
#   user.
# - append: when a user has rules defined, these will be appended to the global
#   rules already defined. That is, for this user, their own specific rules will
#   be checked first, and then the global rules.
# Default is 'overwrite'.
rulesBehavior: overwrite

# Logging configuration
log:
  # Logging format ('console', 'json'). Default is 'console'.
  format: console
  # Enable or disable colors. Default is 'true'. Only applied if format is 'console'.
  colors: true
  # Logging outputs. You can have more than one output. Default is only 'stderr'.
  outputs:
    - stderr

# CORS configuration
cors:
  # Whether or not CORS configuration should be applied. Default is 'false'.
  enabled: true
  credentials: true
  # Allow Private Network Access preflight requests. Default is 'false'.
  allow_private_network: false
  # The following are the default CORS settings when it is enabled.
  allowed_hosts:
    - '*'
  allowed_headers:
    - Authorization
    - Content-Type
    - Content-Range
    - Depth
    - Destination
    - If
    - Lock-Token
    - Overwrite
    - TimeOut
    - Translate
    - X-Update-Range
  allowed_methods:
    - COPY
    - DELETE
    - GET
    - HEAD
    - LOCK
    - UNLOCK
    - MKCOL
    - MOVE
    - OPTIONS
    - PATCH
    - POST
    - PROPFIND
    - PROPPATCH
    - PUT
  exposed_headers: []

# HTML Directory Listing configuration
listing:
  # Serve an HTML listing on GET requests to a collection, instead of the
  # PROPFIND response. Sort with ?C=N|M|S (name, modified, size) and ?O=A|D
  # (ascending, descending). Default is 'false'.
  enabled: true
  # Hide the parent directory (../) link. Default is 'false'.
  hide_parent_dir: false
  # Show the "Index of <path>" title. Ignored with a custom header. Default is 'true'.
  show_path: true
  # Custom HTML replacing the page shell: header up to and including <body>,
  # footer from </body>. Both must be set, inline or from a file.
  # header: "<!DOCTYPE html><html><head><title>WebDAV</title></head><body>"
  # header_file: /etc/webdav/header.html
  # footer: "</body></html>"
  # footer_file: /etc/webdav/footer.html

# You define here the list of users.
# Basic authentication is automatically be configured when users are detected 
# below, else there will be no authentication.
# Customize to your needs and don't forget to comment out the users you don't need.
users:
  # Example 'admin' user with plaintext password.
  - username: admin
    password: admin

  # Example 'john' user with bcrypt encrypted password, with custom directory.
  # Tip: you can generate a bcrypt-encrypted password by using the 'webdav bcrypt'
  # command lint utility, or htpasswd on Linux.
  - username: john
    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
    directory: /data/john
  # Example user whose details will be picked up from the environment.
  - username: "{env}ENV_USERNAME"
    password: "{env}ENV_PASSWORD"
  # Example user with advanced control over his permissions
  - username: basic
    password: basic
    permissions: CRUD # Override default permissions.
    rules:
      # With this rule, the user CANNOT access {user directory}/some/files.
      - path: /some/file
        permissions: none
      # With this rule, the user CAN create, read, update and delete within
      # {user directory}/public/access.
      - path: /public/access/
        permissions: CRUD
      # With this rule, the user CAN read and update all files ending with .js.
      # It uses a regular expression.
      - regex: '^.+\.js$'
        permissions: RU
  # Example user for android SeedVault backuping
  - username: android
    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
    directory: /data/android
    permissions: CRUD

# If you're delegating the authentication to a different service, you can proxy
# the username using basic authentication, and then disable webdav's password
# check using the option:
# noPassword: true

location / {
  proxy_pass http://127.0.0.1:8080;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header REMOTE-HOST $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $host;
  proxy_redirect off;

  # Ensure COPY and MOVE commands work by rewriting the Destination header to
  # contain only the path, e.g. /test.txt. Note that the captured group already
  # includes the leading slash: adding another one would produce a Destination
  # such as //test.txt, which is parsed as a host name and rejected.
  set $dest $http_destination;
  if ($http_destination ~ "^https?://[^/]+(?<path>/.*)$") {
    set $dest $path;
  }
  proxy_set_header Destination $dest;
}

example.com {
    tls internal # for local development
    # tls [email protected] # so that Caddy gets certs for you via Letsencrypt

    # Rewrites destination to remove host and include only the path e.g. /test.txt
    @hasDest header_regexp dest ^https?://[^/]+(.*)$
    header @hasDest Destination {re.dest.1}

    # if running on the same network in docker you can just point to the service name e.g. webdav:6065
    reverse_proxy 127.0.0.1:6065 {
        header_up X-Real-IP {remote_host}
        header_up REMOTE-HOST {remote_host}
    }
}

prefix: /webdav

example.com {
    @hasDest header_regexp dest ^https?://[^/]+(.*)$
    header @hasDest Destination {re.dest.1}

    handle /webdav* {
        reverse_proxy 127.0.0.1:6065 {
            header_up X-Real-IP {remote_host}
            header_up REMOTE-HOST {remote_host}
        }
    }
}

location /webdav {
  proxy_pass http://127.0.0.1:6065;
  # ... the remaining headers, as above.
}

[Unit]
Description=WebDAV
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/bin/webdav --config /opt/webdav.yml
Restart=on-failure

[Install]
WantedBy=multi-user.target

[INCLUDES]
before = common.conf

[Definition]
# Failregex to match failed logins and extract remote_address only. With
# behindProxy, the address is logged without a port.
failregex = ^.*invalid (?:password|username)\s*\{.*"remote_address":\s*"<HOST>(?::\d+)?"

ignoreregex =

[webdav]

enabled = true
port = [your_port]
filter = webdav
logpath = [your_log_path]
banaction = iptables-allports
ignoreself = false