Arch Linux

Beemo

Member

Registered: 2024-12-20

Posts: 104

[SOLVED] Allow Caddy to access private folder

I want to serve my Music folder using Caddy file_server. The Music folder is on an external drive together with the rest of my backup files (which shouldn't be shared). The Caddy service is run as the caddy user.
Right now I manually mount my drive with udisks2 to the default private path owned by my user (does not allow traversal by others), so Caddy cannot access the Music folder.
I searched online (& asked AI) and found these solutions, but I don't know which one is better or bad:

• (bad) Copy the folder to /srv/http/. It will take up too much internal space on my server, and not automatically sync changes.

• (bad?) Add o+x to the private path manually. This seems to defeat the purpose of private path and allows everyone to traverse. Also changes don't stick.

• Add a bind mount to fstab

• Add an ACL rule for caddy user to allow traversal of the path

Is there any other better way? Bind mount seems ok though I'd prefer not touching fstab directly.
Also how to auto-mount USB drives on a headless server (without low-level modifications such as udev)?

Last edited by Beemo (2026-08-17 22:38:30)

mpan

Member

Registered: 2012-08-01

Posts: 1,638

Website

Re: [SOLVED] Allow Caddy to access private folder

The third option, a bind mount, sounds most reasonable. It doesn’t give any additional access to Caddy, and the server believes it’s just another directory. The server, including any potential thing that could otherwise put your files at risk. It’s guaranteed at kernel level too.

No need to modify the fstab directly. See the systemd mount functionality. An alternative option is using udev rules.

Remember that the files and directories themselves, inside that directory, will have to be readable and traversible by Caddy. Not a problem, just a thing to remember.

---

Paperclips in avatars?

Beemo

Member

Registered: 2024-12-20

Posts: 104

Re: [SOLVED] Allow Caddy to access private folder

Yeah that's what I went with. Though is it possible to auto-mount the drive on plug in?

This post says it's impossible: https://askubuntu.com/questions/1018531 … md#1018548
(And the AI answers were basically slop.)

But I think it might be possible with a "BindsTo=dev-disk-by\x2duuid-(redacted)\x2d(redacted)\x2d(redacted)\x2d(redacted)\x2d(redacted).device"
Since Linux filesystems remembers ownership, even though it'll be mounted by root, the mount point still will belong to me.

p.s.
Oof that systemd device name looks gnarly...
Mounting *any* drive on plug-in like DEs do might still be impossible, but since I'm using files on a specific drive I guess it's ok to limit it.

Last edited by Beemo (2026-08-17 07:48:43)

Beemo

Member

Registered: 2024-12-20

Posts: 104

Re: [SOLVED] Allow Caddy to access private folder

mnt-usb1.mount

[Unit]
Description=Automatic mount and unmount of the backup USB drive
BindsTo=dev-disk-by\x2duuid-(redacted).device

[Mount]
What=UUID=(redacted)
Where=/mnt/usb1/
Type=btrfs
Options=compress=zstd:3,noexec,nosuid,nodev

[Install]
WantedBy=multi-user.target

srv-http-files-Music.mount

[Unit]
Description=Bind mount of music backup to HTTP server dir
BindsTo=mnt-usb1.mount

[Mount]
What=/mnt/usb1/BACKUP/Music/
Where=/srv/http/files/Music/
Type=none
Options=bind,ro,noexec,nosuid,nodev

[Install]
WantedBy=multi-user.target

Last edited by Beemo (2026-08-17 22:38:07)