Configura un servidor WebDAV con Nginx en Linux (guía 2026)

# Check base module
nginx -V 2>&1 | grep -o with-http_dav_module

# Check ext module (Debian/Ubuntu)
ls /usr/lib/nginx/modules/ | grep dav

# Create share directories
sudo mkdir -p /var/www/webdav/{documents,media,projects,shared}

# Create temp directory on the SAME filesystem (important, see note below)
sudo mkdir -p /var/www/webdav/.tmp

# Set ownership to www-data (Nginx user)
sudo chown -R www-data:www-data /var/www/webdav

# Set permissions
sudo chmod -R 755 /var/www/webdav

# Install Certbot
sudo apt install certbot python3-certbot-nginx -y

# Obtain SSL certificate (replace with your domain)
sudo certbot --nginx -d webdav.yourdomain.com

# Verify certificate auto-renewal works
sudo certbot renew --dry-run

sudo nano /etc/nginx/sites-available/webdav

# /etc/nginx/sites-available/webdav
#
# Requires dav_ext_lock_zone in http{} context. See "Enable File Locking" below.
# Make sure /var/www/webdav/.tmp exists on the same filesystem as /var/www/webdav.

server {
    listen 80;
    server_name webdav.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    http2 on;

    server_name webdav.yourdomain.com;

    # SSL Configuration
    ssl_certificate     /etc/letsencrypt/live/webdav.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/webdav.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;

    # Authentication
    auth_basic "WebDAV Access";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # WebDAV root
    location / {
        root /var/www/webdav;

        # Write methods (base module)
        dav_methods PUT DELETE MKCOL COPY MOVE;

        # Read/lock methods (dav-ext module)
        # NOTE: PROPPATCH is NOT supported — do not add it here
        dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK;

        # Enable real LOCK/UNLOCK (requires dav_ext_lock_zone in http{})
        dav_ext_lock zone=davlock;

        dav_access user:rw group:rw all:r;
        create_full_put_path on;
        min_delete_depth 1;

        # Temp path on same filesystem
        client_body_temp_path /var/www/webdav/.tmp;
        client_max_body_size 10G;
        client_body_timeout 300s;

        # Fix macOS Finder MKCOL-without-slash (creates dirs without trailing /)
        set $x $uri$request_method;
        if ($x ~ [^/]MKCOL$) { rewrite ^(.*)$ $1/; }

        # Logging
        access_log /var/log/nginx/webdav_access.log;
        error_log  /var/log/nginx/webdav_error.log;
    }

    # Block access to hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

http {
    # ... existing config ...

    # WebDAV lock zone — shared memory for tracking locks
    # 10MB handles thousands of concurrent locks; 300s timeout
    dav_ext_lock_zone zone=davlock:10m timeout=300;
}

curl -i -X OPTIONS https://webdav.yourdomain.com/ -u webdavuser:password

# Create password file with first user (use -B for bcrypt)
sudo htpasswd -cB /etc/nginx/.htpasswd webdavuser

# Add additional users (no -c flag after first user)
sudo htpasswd -B /etc/nginx/.htpasswd john
sudo htpasswd -B /etc/nginx/.htpasswd mary

# Secure the password file
sudo chmod 640 /etc/nginx/.htpasswd
sudo chown root:www-data /etc/nginx/.htpasswd

# Admin access — full WebDAV methods
location /admin {
    alias /var/www/webdav/admin;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK;
    dav_ext_lock zone=davlock;
    dav_access user:rw group:rw all:r;
    create_full_put_path on;

    auth_basic "Admin WebDAV";
    auth_basic_user_file /etc/nginx/.htpasswd-admin;
}

# User access — limited methods
location /users {
    alias /var/www/webdav/users;
    dav_methods PUT DELETE MKCOL;
    dav_ext_methods PROPFIND OPTIONS;
    dav_access user:rw group:rw all:r;
    create_full_put_path on;

    auth_basic "User WebDAV";
    auth_basic_user_file /etc/nginx/.htpasswd-users;
}

# Public read-only access
location /public {
    alias /var/www/webdav/public;
    limit_except GET {
        deny all;
    }
    autoindex on;
    autoindex_exact_size off;
    autoindex_localtime on;
}

# Test configuration syntax
sudo nginx -t

# Enable the site
sudo ln -s /etc/nginx/sites-available/webdav /etc/nginx/sites-enabled/

# Remove default site if it conflicts
sudo rm -f /etc/nginx/sites-enabled/default

# Restart and enable nginx
sudo systemctl restart nginx
sudo systemctl enable nginx

# Check status
sudo systemctl status nginx

# 1. Module loaded?
nginx -V 2>&1 | grep -o with-http_dav_module

# 2. Config valid?
sudo nginx -t

# 3. Methods advertised? (expect DAV: 2 + Allow list)
curl -i -X OPTIONS https://webdav.yourdomain.com/ -u webdavuser:password

# 4. Directory listing works?
curl -i -X PROPFIND https://webdav.yourdomain.com/ -u webdavuser:password -H "Depth: 1"

# 5. Upload works?
curl -i -T test.txt https://webdav.yourdomain.com/test.txt -u webdavuser:password

# 6. Move works?
curl -i -X MOVE https://webdav.yourdomain.com/test.txt \
  -H "Destination: https://webdav.yourdomain.com/final.txt" \
  -u webdavuser:password

# Map WebDAV as network drive
net use W: https://webdav.yourdomain.com /user:webdavuser

# Or via File Explorer:
# 1. Open File Explorer
# 2. Right-click "This PC" → "Map network drive"
# 3. Enter: https://webdav.yourdomain.com
# 4. Check "Connect using different credentials"
# 5. Enter username and password

# Install davfs2
sudo apt install davfs2 -y

# Create mount point
sudo mkdir /mnt/webdav

# Mount WebDAV share
sudo mount -t davfs https://webdav.yourdomain.com /mnt/webdav

# Verify
mount | grep webdav

# Add credentials (one line per share)
sudo nano /etc/davfs2/secrets
# Add: https://webdav.yourdomain.com webdavuser your_password

# Secure the secrets file
sudo chmod 600 /etc/davfs2/secrets

# Add to fstab for auto-mount on boot
sudo nano /etc/fstab
# Add: https://webdav.yourdomain.com /mnt/webdav davfs _netdev,user,uid=1000,gid=1000 0 0

# Nautilus (GNOME): Other Locations → Connect to Server
# Enter: davs://webdav.yourdomain.com

# Dolphin (KDE): Network → Add Network Folder → WebDAV

mkdir ~/webdav
mount_webdav https://webdav.yourdomain.com ~/webdav

# Unmount
umount ~/webdav

# Install rclone
curl https://rclone.org/install.sh | sudo bash

# Configure a WebDAV remote
rclone config
# Choose: New remote → name: webdav-remote → type: webdav → vendor: other
# URL: https://webdav.yourdomain.com
# User: webdavuser / Password: your_password

# Sync a local directory to WebDAV
rclone sync /data/source webdav-remote:backup

# Mount WebDAV as a local directory (with caching)
rclone mount webdav-remote: ~/webdav --vfs-cache-mode full

# List files
rclone ls webdav-remote:

# Serve a local directory over WebDAV (single binary, TLS, user/pass)
rclone serve webdav /data/to/share --addr :8080 --user admin --pass secret

# Restrict access by IP range
location / {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;

    # ... rest of WebDAV configuration ...
}

http {
    limit_req_zone $binary_remote_addr zone=webdav:10m rate=30r/s;

    location / {
        limit_req zone=webdav burst=50 nodelay;
        # ... WebDAV configuration ...
    }
}

# Internal auth endpoint
location /auth {
    internal;
    proxy_pass http://your-auth-service/verify;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}

# Apply to WebDAV location
location / {
    auth_request /auth;
    # ... WebDAV configuration ...
}

# In the WebDAV location block
client_max_body_size 50G;
client_body_buffer_size 256k;
client_body_timeout 600s;
client_header_timeout 300s;
keepalive_timeout 300s;
send_timeout 300s;

# Use sendfile for downloads
sendfile on;
sendfile_max_chunk 1m;
tcp_nopush on;
tcp_nodelay on;

# Symlink NFS and Samba shares into WebDAV
sudo ln -s /srv/samba/media /var/www/webdav/media
sudo ln -s /srv/nfs/documents /var/www/webdav/documents

# Set ownership on symlinks (note -h flag)
sudo chown -h www-data:www-data /var/www/webdav/media
sudo chown -h www-data:www-data /var/www/webdav/documents

#!/bin/bash
# webdav-backup.sh
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="/var/www/webdav/backups"

mkdir -p "$BACKUP_DIR/$DATE"

# Backup configs
cp /etc/nginx/sites-available/webdav "$BACKUP_DIR/$DATE/"
cp /etc/nginx/.htpasswd "$BACKUP_DIR/$DATE/"

# Backup content (use -l to preserve symlinks as-is)
rsync -av /var/www/webdav/documents/ "$BACKUP_DIR/$DATE/documents/"

# Monitor access in real time
sudo tail -f /var/log/nginx/webdav_access.log

# Check for errors
sudo tail -f /var/log/nginx/webdav_error.log

# Top IPs by request count
sudo awk '{print $1}' /var/log/nginx/webdav_access.log | sort | uniq -c | sort -nr | head -20

# Recent PUT/GET activity
sudo grep -E "(PUT|GET)" /var/log/nginx/webdav_access.log | tail -20

# Install fail2ban
sudo apt install fail2ban -y

# Create WebDAV jail
sudo nano /etc/fail2ban/jail.local

[webdav]
enabled  = true
port     = 443
filter   = webdav
logpath  = /var/log/nginx/webdav_access.log
maxretry = 5
bantime  = 3600
findtime = 600

sudo nano /etc/fail2ban/filter.d/webdav.conf

[Definition]
failregex = ^<HOST> -.*"(GET|POST|PUT|DELETE|PROPFIND|MKCOL|COPY|MOVE|LOCK|UNLOCK)" .* (401|403) .*$
ignoreregex =

# Verify module
nginx -V 2>&1 | grep dav

# Check config syntax
sudo nginx -t

# Test methods
curl -X OPTIONS https://webdav.yourdomain.com/ -u webdavuser:password -v

# Check password file exists and is readable
ls -la /etc/nginx/.htpasswd

# Test auth with curl
curl -X GET https://webdav.yourdomain.com/ -u webdavuser:password -v

# Reset a user's password
sudo htpasswd -B /etc/nginx/.htpasswd webdavuser

# Test SSL handshake
openssl s_client -connect webdav.yourdomain.com:443 -servername webdav.yourdomain.com

# Check certificate validity
sudo certbot certificates

# Force renewal
sudo certbot renew --force-renewal -d webdav.yourdomain.com

# Set the correct SELinux context
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/webdav(/.*)?"
sudo restorecon -Rv /var/www/webdav

# Verify
ls -laZ /var/www/webdav/

# Increase buffer sizes
client_body_buffer_size 256k;
large_client_header_buffers 4 256k;

# Optimize workers
worker_processes auto;
worker_connections 1024;

# Enable HTTP/2 (use the directive, not the deprecated listen parameter)
http2 on;

location /work {
    alias /var/www/webdav/work;
    dav_methods PUT DELETE MKCOL COPY MOVE;
    dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK;
    dav_ext_lock zone=davlock;
    dav_access user:rw group:rw all:r;
    create_full_put_path on;

    auth_basic "Work Files";
    auth_basic_user_file /etc/nginx/.htpasswd-work;
}

location /photos {
    alias /var/www/webdav/photos;
    dav_methods PUT MKCOL;
    dav_ext_methods PROPFIND OPTIONS;
    dav_access user:rw group:rw all:r;
    create_full_put_path on;

    # Allow large image uploads
    client_max_body_size 100M;

    auth_basic "Photo Backup";
    auth_basic_user_file /etc/nginx/.htpasswd-photos;
}

# Create unified access point
sudo mkdir -p /var/www/webdav/unified
sudo ln -s /srv/nfs/media /var/www/webdav/unified/media-nfs
sudo ln -s /srv/samba/documents /var/www/webdav/unified/docs-samba
sudo ln -s /var/lib/docker/volumes /var/www/webdav/unified/container-data

# Set permissions on symlinks
sudo chown -h www-data:www-data /var/www/webdav/unified/*