WsgiDAV WebDAV Server on Ubuntu 24.04 LTS

WsgiDAV is a generic and extensible WebDAV server written in Python. It publishes a directory on your server as a WebDAV share, so files can be opened, edited and saved straight from the file manager your team already uses, with no client software to install and no proprietary sync agent. Because it implements WebDAV class 2 it supports resource locking as well as create, read, update, delete, copy and move, and custom properties on files and folders. Alongside the protocol it serves a browsable web view, so the same share opens in an ordinary web browser.

What you get

• WsgiDAV 4.3.5 at a pinned upstream release, in a dedicated Python virtual environment
• Cheroot as the production WSGI server, bound to the loopback interface
• nginx as the reverse proxy and the only routable listener, with streamed uploads and downloads and no request size cap
• A dedicated share directory owned by an unprivileged, non login service account
• A unique WebDAV password generated on the first boot of every instance
• A built in end to end WebDAV check you can run at any time
• A paired step by step deployment guide and 24/7 cloudimg support

Closed by default

The upstream quick start is built for local experimentation: it serves a directory anonymously, writeably, on every interface. This image does the opposite, and proves it on every boot. Authentication is mandatory on every route, including the browsable web view and its own assets, and there is no anonymous access and no anonymous read only fallback. Passwords are held only as bcrypt hashes, never as plain text in a configuration file. A dedicated data directory is published rather than the whole filesystem or a home directory, symbolic links cannot be used to read outside it, and the service account can write to that directory and nothing else.

No shared or default credential ever ships. On the first boot of every instance a unique password is generated and written to a root only file, and until that has happened nothing is listening on the public port at all, so there is no window in which a new instance is reachable with a credential somebody else could know. Credentials never reach the system journal or the authentication log. Each instance proves on its own first boot that anonymous requests are refused, that guessed passwords are refused, and that a full authenticated round trip works, including uploading a file, reading it back and comparing it byte for byte.

Before you expose it

WebDAV Basic authentication sends the password with every request, base64 encoded but not encrypted. Terminate TLS in front of the instance before using it over any untrusted network, using an Azure Application Gateway, Azure Front Door, or a certificate on the instance itself, and restrict the network security group to the addresses that need the share. The deployment guide walks through both, and copy and move operations are already configured to work correctly behind a TLS terminator or a load balancer on a non default port.

Licensing

WsgiDAV is open source software distributed under the MIT licence, and every library it ships is permissive: MIT, BSD, Apache 2.0 or the Python Software Foundation licence. There is no licence fee. The cloudimg charge of $0.04 per vCPU per hour covers packaging, security patching, image maintenance and 24/7 support. cloudimg is not affiliated with, endorsed by, or sponsored by the WsgiDAV project or its maintainers. All trademarks are the property of their respective owners.