# 监听地址，默认 0.0.0.0（所有网卡）
address: 0.0.0.0

# 监听端口，默认 6065
port: 6065

# 是否启用 TLS，默认 false
tls: false

# TLS 证书文件路径，默认 cert.pem
cert: cert.pem

# TLS 私钥文件路径，默认 key.pem
key: key.pem

# WebDAV URL 路径前缀，默认 /
prefix: /

# 调试日志，默认 false
debug: false

# 关闭内容嗅探（禁止根据文件内容推断 Content-Type），默认 false
noSniff: false

# 是否在可信反向代理之后。为 true 时日志使用 X-Forwarded-For 记录远端地址，默认 false
behindProxy: false

# 指向工作目录（裸机默认）；compose 场景常见 /data
directory: /data

directories:
  - media: /data/media          # 虚拟挂载名 media → /data/media
  - /data/archive               # 无名字段：直接用路径作为条目标识
  - name: backups               # 显式命名
    path: /data/backups

permissions: CRUD

rules: []

# 对 /some/file 完全禁权
- path: /some/file
  permissions: none

# 允许在 /public/access/ 下全部操作
- path: /public/access/
  permissions: CRUD

# 只允许读
- path: /docs/
  permissions: R

rulesBehavior: overwrite

log:
  # 日志格式：console | json，默认 console
  format: console

  # 是否启用彩色输出，默认 true；仅 format=console 生效
  colors: true

  # 日志输出目标，可多个，默认 ['stderr']
  outputs:
    - stderr
    - /var/log/webdav.log

cors:
  # 是否启用 CORS 处理，默认 false
  enabled: true

  # 是否允许携带凭证，默认 false
  credentials: true

  # 允许 Private Network Access 预检请求，默认 false
  allow_private_network: false

  # 允许的主机，默认 ['*']
  allowed_hosts:
    - '*'

  # 允许的请求头，默认含 Authorization/Content-Type/Content-Range/Depth/If/Lock-Token 等
  allowed_headers:
    - Authorization
    - Content-Type
    - Content-Range
    - Depth
    - If
    - Lock-Token
    - Overwrite
    - TimeOut
    - Translate
    - X-Update-Range

  # 允许的方法，默认含全部 WebDAV 方法
  allowed_methods:
    - COPY
    - DELETE
    - GET
    - HEAD
    - LOCK
    - UNLOCK
    - MKCOL
    - MOVE
    - OPTIONS
    - PATCH
    - POST
    - PROPFIND
    - PROPPATCH
    - PUT

  # 暴露给浏览器的响应头
  exposed_headers: []

listing:
  # 启用 HTML 目录列表，默认 false
  enabled: true

  # 是否隐藏父目录(../)链接，默认 false
  hide_parent_dir: false

  # 是否显示 "Index of <path>" 标题；自定义 header 时忽略，默认 true
  show_path: true

  # 自定义页壳 header / footer（内联或从文件）
  # header: "<!DOCTYPE html><html><head><title>WebDAV</title></head><body>"
  # header_file: /etc/webdav/header.html
  # footer: "</body></html>"
  # footer_file: /etc/webdav/footer.html

users:
  # 管理员：明文密码 + 全权限
  - username: admin
    password: admin123
    permissions: CRUD

  # john：bcrypt 密码 + 专属目录
  - username: john
    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
    directory: /data/john

  # 从环境变量注入用户名/密码
  - username: "{env}ENV_USERNAME"
    password: "{env}ENV_PASSWORD"

  # 高级权限：规则覆盖
  - username: basic
    password: basic
    permissions: CRUD
    rules:
      # 不能访问 {user}/some/file
      - path: /some/file
        permissions: none
      # 可在 {user}/public/access/ 内 CRUD
      - path: /public/access/
        permissions: CRUD

export ENV_USERNAME=demo
export ENV_PASSWORD=demo123

export WD_PORT=6065
export WD_ADDRESS=0.0.0.0
webdav -c /etc/webdav/config.yml

flags（命令行）  >  环境变量（WD_*）  >  配置文件  >  内置默认值

# /etc/webdav/config.yml
address: 0.0.0.0
port: 6065
tls: true
cert: /etc/webdav/cert.pem
key: /etc/webdav/key.pem
prefix: /
debug: false
noSniff: false
behindProxy: true

directory: /data
permissions: R
rulesBehavior: overwrite

log:
  format: console
  colors: true
  outputs:
    - stderr

cors:
  enabled: true
  credentials: true
  allowed_hosts:
    - '*'

listing:
  enabled: true
  hide_parent_dir: false

users:
  - username: admin
    password: "{bcrypt}$2a$10$Vytaibe9E8eRgXDGB9.DE.QqzsLrkUQsJ5QyukdIoiTXCTVVqwqdS"
    permissions: CRUD
    rules:
      - path: /public/access/
        permissions: CRUD
  - username: bob
    password: "{env}ENV_BOB_PASSWORD"
    directory: /data/bob
    permissions: CRUD