Skip to content

Site WebDAV

Path shortcuts: site/.../applications/ is site/src/ecmwf/sites/website/applications/; Lua and nginx paths are relative to site/.../applications/proxy/.

site-webdav is an optional WebDAV application on port 7000 under <site-path>s/dav/. It uses the Site volume as its storage. The operator renders its configuration (webdav.yaml) and the branded header and footer (webdav-header.html, webdav-footer.html) into the Site files ConfigMap; the header and footer are mounted read-only and referenced by path from webdav.yaml. The container itself runs without user accounts (noPassword: true, CRUD permissions): the proxy enforces all access (webdav_auth.lua runs BasicAuth.handle(true)).

The WebDAV BasicAuth password must be a Site token: the master token (Hex64 form) or a Branca token. JSON Web Token (JWT) session tokens are not accepted by the BasicAuth handler (lua/basic.lua). A directory that contains a .htpasswd file is checked by nginx auth_basic instead; a master or administrator token supplied as the password overrides that check completely. On public Sites, directories without a .htpasswd file also accept anonymous read-only WebDAV: the handler sets X-Remote-User: anonymous for read-only methods (lua/basic.lua).

The rendered webdav.yaml carries the WebDAV server's CORS block: enabled, with credentials, allowed_hosts: ['*'], empty exposed_headers, and the method set COPY, DELETE, GET, HEAD, LOCK, MKCOL, MOVE, OPTIONS, PATCH, POST, PROPFIND, PROPPATCH, PUT, UNLOCK. No client reaches the application directly: the site proxy owns the s/dav/ route, enforces authentication, and adds MS-Author-Via: DAV for classic WebDAV client discovery (06 — Endpoint locations), so the wildcard origin never widens access beyond what the proxy admits.

Use cases

  • Interactive file management: browse, upload, and edit content from a desktop file manager or an editor with WebDAV support.
  • Mount the Site as a shared network drive.
  • Keep a tree read-only for anonymous users while editors authenticate with tokens.

Example usage

Browse with PROPFIND, then mount the same URL in a client (Finder, Windows Explorer, GNOME Files, rclone):

curl -u ecbox:${SITE_TOKEN} -X PROPFIND -H "Depth: 1" \
  "https://<domain>/<space>/<site>/s/dav/"

Use the full URL from the Hub Overview, with the trailing slash. The username is ignored; the password is a Site master token or an HTTP access token (end-user WebDAV and S3 guide).

Request flow

flowchart LR
    C["WebDAV client (Basic auth)"] --> P["site-proxy webdav_auth.lua"]
    P --> W["site-webdav :7000"]
    W --> V[("Site content /www/html")]