Expose only share links of a private service with caddy dataswamp.org

Solène describes a Caddy reverse-proxy setup that keeps Immich and Nextcloud behind a VPN while exposing only tightly matched routes for share links. For each request, Caddy asks the service whether the link token is valid, forwards valid requests, and returns 404 for other routes; recipients can open shared content without a VPN or account. The post gives example configurations and notes that app updates can break the route rules and that vulnerabilities in exposed share routes remain a risk.