Ability to define an external host/URL for properly generating public shared links

[FlorentLM]

Is your feature request related to a problem? Please describe.

Currently, when SFTPGo generates share links, it assumes the same host/URL that SFTPGo sees internally. In many setups—especially when running behind a reverse proxy like Traefik—this internal host may not match the actual external domain that end-users should use to access the public shares.

As a result, links copied from the web GUI are inaccessible from the public internet and need to be manually edited.

Describe the solution you'd like

Would be cool to see SFTPGo support a dedicated “external host” or “public URL” configuration so that all share links are consistently generated with the correct external domain.

Ideally, this should put all the content related to shared links (i.e., including the static css and js files) under that same external host

Describe alternatives you've considered

Reverse-proxy rewriting: I can access the public share on the external public url, but the static files are 404ing - I would need to also catch all /static subpath and that's not ideal.

And that still requires to edit the links manually after they're copied

What are you using SFTPGo for?

Private user, home usecase (home backup/VPS)

Additional context

Absolutely love it otherwise! :)

[drakkan]

Hello,

please provide more info about your setup, do you have something like https://<ip/host>/web/client/pubshares/.. internally and https://<different ip/host>/<different path>/pubshares/.. externally?

The host is what you see in the browser location so as long as you haven't rewritten the relative paths it should work (if you copy the share link accessing SFTPGo using the external host/IP)

[FlorentLM]

Hi,

Apologies I should have given more details straight away.

So I mainly use SFTPGo on my own server to replace SMB and access my files as a NAS - althtough I don't do it locally but over Tailscale. Because SMB is very sensitive to latency, it was a nightmare, but SFTP works wondefully.

Sometimes I like to send a file or two to a friend, and for that I have been using Nextcloud until recently. But that had too many useless features for my usecase, and its permission control over local files was meh.

So I have the SFTPGo container with:

• port 2022 exposed on 127.0.0.1 only, and Tailscale proxying it to its interface (with tailscale serve)
• a Traefik route https://sftpgo.internal.blabla.bla that directs all requests to http://sftpgo:8080 for internal use - only accessed by me (the *.internal.blabla.bla record points to a local IP)
• a second Traefik route https://share.blabla.bla (with a record to my public IP) that directs only some requests to sftpgo (see config below)

http:
  routers:

    # This router is to serve the static content and the links that specifically have /web/client/pubshares
    publicshares-static:
      rule: "Host(`share.blabla.bla`) && (PathPrefix(`/static`) || PathPrefix(`/web/client/pubshares`))"
      entryPoints:
        - websecure
      service: publicshares
      tls:
        certResolver: letsencrypt
        options: modern@file
      priority: 30    # Highest priority

    # This router is to serve 404 to the rest
    publicshares-fallback:
      rule: "Host(`share.blabla.bla`) && PathPrefix(`/web`)"
      entryPoints:
        - websecure
      service: noop@internal
      tls:
        certResolver: letsencrypt
        options: modern@file
      priority: 20   # High priority

    # Anything else is assumed to be a share ID string, so that goes to /web/client/pubshares via the middleware
    publicshares:
      rule: "Host(`share.blabla.bla`)"
      entryPoints:
        - websecure
      service: publicshares
      middlewares:
        - sftpgo-share-rewrite
      tls:
        certResolver: letsencrypt
        options: modern@file
      priority: 10   # Lower priority

  services:
    publicshares:
      loadBalancer:
        servers:
          - url: "http://sftpgo:8080"

  middlewares:
    sftpgo-share-rewrite:
      replacePathRegex:
        regex: "^/(.*)"
        replacement: "/web/client/pubshares/$1"

This way, I can create a shareable link from the WebGUI only accessed internally, and my friends can download stuff from https://shares.blabla.bla/r4nD0mCh4raCt3rs which is pretty clear. But I have to rewrite the URL myself when copying it, because I only access the gui from inside and never from the outside.

Also, I'm assuming that my setup is secure enough, but all the files under /static are still always accessible from the outside - it's not a big deal but it's not the cleanest.
Having a way to serve the static files under the random ID so that they are only accessible if one has a real share ID would maybe be the cherry on top.

Hope that clears things up :)

Cheers!

Edited for typos