Expose only share links of a private service with caddy

In self-hosted infrastructures, many services are only accessible via VPN. However, some services like Immich and Nextcloud offer the ability to share content with external users. To add an extra layer of security, the author wanted to create share links that could be clicked without requiring a VPN client or account. The usual approach would be to expose the entire service on the internet, which involves trusting various parts of the application.

The author discovered a solution using the reverse proxy Caddy that allows only requests with valid share links and returns a 404 to all other requests. The process involves using Caddy's forward_auth directive, which sends a request to the service (auth server) to verify the link validity. If the response is a success, the real request is forwarded; otherwise, Caddy returns the auth server's response to the client.

This method is used when most applications respond differently based on whether a share key is valid or not.