Expose only share links of a private service with caddy

# Introduction In my self-hosted infrastructure, most services are only reachable through my VPN. But some of them have a feature to share something with people outside: Immich has share links for albums and photos, Nextcloud has share links for files and folders. => https://dataswamp.org/~solene/2026-10-15-selfhosting-infrastructure-incus-os.html My self-hosted infrastructure with Incus OS I wanted to add some extra security, but the people receiving a link should not have to install a VPN client or create an account, they must be able to click on it and see the content. The usual way to do this is to expose the whole service on the Internet, and then you have to trust the login page, the API and every route of the application. I found a simple pattern with the reverse proxy caddy that only lets in requests carrying a valid share link, and answers a 404 to everything else. The service itself is used to check if the link is valid. => https://caddyserver.com/ caddy official website In…