The article describes a Caddy reverse proxy pattern using forward_auth to expose only share links from self-hosted services like Immich and Nextcloud without revealing the full service to the internet. The approach uses the service itself as an auth server—valid share links get forwarded while everything else returns a 404, reducing attack surface compared to exposing the entire application.
Background
Self-hosted services like Immich and Nextcloud are typically kept behind a VPN, but sharing content with external users requires some public access. This article presents a lightweight reverse proxy pattern as an alternative to full internet exposure.
- Source
- Lobsters
- Published
- Oct 23, 2026 at 12:30 AM
- Score
- 5.0 / 10