undefined | Better HN

0 pointsachairapart4y ago0 comments

Sorry Matt, didn't want to be rude. But yes, it does. Using the file_serve directive, dotfiles are served by default.

Here are some random domains taken from the Caddy Forum threads:

https://www.aspecthq.com/.git/HEAD

Those people are unaware of serving their git (or .env files or other secrets) over the internet, probably because are used to other webservers that just block this behaviour by default.

And it's ok to not do or be like the others, but this should at least be mentioned in the docs.

0 comments

3 comments · 2 top-level

mholt4y ago· 1 in thread

With all due respect, you're wrong. If Caddy is serving any files, the user explicitly enabled that functionality. And when enabled, it only serves files within the root directory specified by the user, or the current working directory, and the docs are very clear about this: https://caddyserver.com/docs/modules/http.handlers.file_serv...

achairapartOP4y ago

I stand corrected about the docs, somehow I missed the additional clarifications.

SirGiggles4y ago

What you initially stated implies a completely different meaning.

You initially made the implication that Caddy would enable the file server implicitly when it does not. That was what I interpreted upon first reading.

Your correction states that dotfiles are served using the file_server directive which is correct and and example is given in hiding the .git folder [1]

[1] https://caddyserver.com/docs/caddyfile/directives/file_serve...

j / k navigate · click thread line to collapse