Expose only share links of a private service with caddy
Summary
An in-depth guide on exposing only the share links of a private service using Caddy's forward_auth and reverse_proxy. The article covers how to validate a share key against the application (Immich and Nextcloud examples), provides concrete caddyfile snippets, and discusses how this pattern reduces the public attack surface, plus its limitations and security considerations.