From ea00b49a2a26ceec29b056eba0803b8af5f6675a Mon Sep 17 00:00:00 2001 From: Luccin Masirika Date: Sat, 13 Jun 2026 14:32:34 +0200 Subject: [PATCH 1/2] Document that file_server's hide can be used multiple times As of caddyserver/caddy#7817, repeated hide subdirectives append to the list instead of overwriting, so note that multiple uses combine (useful for composing imported snippets with site-specific hides). --- src/docs/markdown/caddyfile/directives/file_server.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/docs/markdown/caddyfile/directives/file_server.md b/src/docs/markdown/caddyfile/directives/file_server.md index 9fa8bf39..37574d0c 100644 --- a/src/docs/markdown/caddyfile/directives/file_server.md +++ b/src/docs/markdown/caddyfile/directives/file_server.md @@ -60,7 +60,7 @@ file_server [] [browse] { - **root** sets the path to the site root. It's similar to the [`root`](root) directive except it applies to this file server instance only and overrides any other site root that may have been defined. Default: `{http.vars.root}` or the current working directory. Note: This subdirective only changes the root for this handler. For other directives (like [`try_files`](try_files) or [`templates`](templates)) to know the same site root, use the [`root`](root) directive instead. -- **hide** is a list of files or folders to hide; if requested, the file server will pretend they do not exist. Accepts placeholders and glob patterns. Note that these are _file system_ paths, NOT request paths. In other words, relative paths use the current working directory as a base, NOT the site root; and all paths are transformed to their absolute form before comparisons (if possible). Specifying a file name or pattern without a path separator will hide all files with a matching name regardless of its location; otherwise, a path prefix match will be attempted, and then a globular match. Since this is a Caddyfile config, the active configuration file(s) will be added by default. Hide comparisons are case-sensitive; on case-insensitive filesystems, a differently-cased request path may still resolve to the same on-disk path, so `hide` should not be treated as a security boundary for sensitive paths. +- **hide** is a list of files or folders to hide; if requested, the file server will pretend they do not exist. Accepts placeholders and glob patterns. Note that these are _file system_ paths, NOT request paths. In other words, relative paths use the current working directory as a base, NOT the site root; and all paths are transformed to their absolute form before comparisons (if possible). Specifying a file name or pattern without a path separator will hide all files with a matching name regardless of its location; otherwise, a path prefix match will be attempted, and then a globular match. Since this is a Caddyfile config, the active configuration file(s) will be added by default. The subdirective may be specified more than once; each use appends to the list rather than replacing it, which lets an imported snippet contribute common hides that combine with site-specific ones. Hide comparisons are case-sensitive; on case-insensitive filesystems, a differently-cased request path may still resolve to the same on-disk path, so `hide` should not be treated as a security boundary for sensitive paths. - **index** is a list of filenames to look for as index files. Default: `index.html index.txt` From 8efb08853f39485031d8ba80c749e34f3c7f8b66 Mon Sep 17 00:00:00 2001 From: Luccin Masirika <53916378+luccinmasirika@users.noreply.github.com> Date: Sat, 13 Jun 2026 14:44:13 +0200 Subject: [PATCH 2/2] Update src/docs/markdown/caddyfile/directives/file_server.md Co-authored-by: Zen Dodd --- src/docs/markdown/caddyfile/directives/file_server.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/docs/markdown/caddyfile/directives/file_server.md b/src/docs/markdown/caddyfile/directives/file_server.md index 37574d0c..34b80137 100644 --- a/src/docs/markdown/caddyfile/directives/file_server.md +++ b/src/docs/markdown/caddyfile/directives/file_server.md @@ -60,7 +60,7 @@ file_server [] [browse] { - **root** sets the path to the site root. It's similar to the [`root`](root) directive except it applies to this file server instance only and overrides any other site root that may have been defined. Default: `{http.vars.root}` or the current working directory. Note: This subdirective only changes the root for this handler. For other directives (like [`try_files`](try_files) or [`templates`](templates)) to know the same site root, use the [`root`](root) directive instead. -- **hide** is a list of files or folders to hide; if requested, the file server will pretend they do not exist. Accepts placeholders and glob patterns. Note that these are _file system_ paths, NOT request paths. In other words, relative paths use the current working directory as a base, NOT the site root; and all paths are transformed to their absolute form before comparisons (if possible). Specifying a file name or pattern without a path separator will hide all files with a matching name regardless of its location; otherwise, a path prefix match will be attempted, and then a globular match. Since this is a Caddyfile config, the active configuration file(s) will be added by default. The subdirective may be specified more than once; each use appends to the list rather than replacing it, which lets an imported snippet contribute common hides that combine with site-specific ones. Hide comparisons are case-sensitive; on case-insensitive filesystems, a differently-cased request path may still resolve to the same on-disk path, so `hide` should not be treated as a security boundary for sensitive paths. +- **hide** is a list of files or folders to hide; if requested, the file server will pretend they do not exist. Accepts placeholders and glob patterns. Note that these are _file system_ paths, NOT request paths. In other words, relative paths use the current working directory as a base, NOT the site root; and all paths are transformed to their absolute form before comparisons (if possible). Specifying a file name or pattern without a path separator will hide all files with a matching name regardless of its location; otherwise, a path prefix match will be attempted, and then a globular match. Since this is a Caddyfile config, the active configuration file(s) will be added by default. The subdirective may be specified more than once; each use appends to the list rather than replacing it, which lets an imported snippet contribute common hides that combine with site-specific hides. Hide comparisons are case-sensitive; on case-insensitive filesystems, a differently-cased request path may still resolve to the same on-disk path, so `hide` should not be treated as a security boundary for sensitive paths. - **index** is a list of filenames to look for as index files. Default: `index.html index.txt`