Seafile Public Proxy

Seafile Server
1

I’m interested in setting up Seafile primarily to share files as links for platforms like Discord which limit maximum file upload sizes.

However I don’t want to expose Seafile publicly. Is there a reverse proxy, kind of like the Github alangrainger/immich-public-proxy project, that acts as a read-only reverse proxy to allow users to download shared Seafile links but not access any other API endpoints?

2

There isn’t a dedicated standalone project like immich-public-proxy for Seafile, but you can achieve the exact same result by configuring a reverse proxy (such as Nginx, Caddy, or HAProxy) to whitelist only the paths required for public share links.

To allow users to access share links while keeping the rest of your Seafile instance (login, API, admin panel) private, you need to expose the following URL paths:

  • /f/: For file share links.
  • /d/: For directory/folder share links.
  • /s/: For internal/custom share links.
  • /seafhttp/: This is critical as it handles the actual data transfer (downloading).
  • /media/: Required to serve CSS, JavaScript, and images so the sharing pages render correctly.
  • /thumbnail/: (Optional) If you want thumbnails to appear in shared folder views.

Example Nginx Logic

You can configure your public-facing Nginx to block everything by default and only proxy the specific paths above:

server {
    listen 443 ssl;
    server_name your-public-seafile-link.com;

    # Block access to the main interface/login by default
    location / {
        return 403;
    }

    # Allow only the sharing-related paths
    location ~ ^/(f|d|s|seafhttp|media|thumbnail)/ {
        proxy_pass http://your-internal-seafile-ip:port;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Adjust timeouts for large file downloads
        proxy_read_timeout 36000s;
    }
}

Note:

  • If you use password-protected links, ensure your proxy allows POST requests to these paths.
  • By excluding paths like /accounts/, /api2/, and /sys/, the login page and administrative APIs will remain inaccessible from the public proxy.
  • For more details on standard Nginx configuration, you can refer to the Seafile Admin Manual.
1 Like