WebDAV for RetroArch

_etc_hosts

192.168.5.1 webdav.local

_etc_nginx_nginx.config

# NOTE: you need to adjust paths and whatnot
# password is web/dav, use `htpasswd` or `openssl passwd` to re-generate nginx.users if you don't like plain text

user nginx nginx;
worker_processes 1;
pid /var/run/nginx.pid;
load_module /usr/lib/nginx/modules/ngx_http_dav_ext_module.so;

events {
    worker_connections 16;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    sendfile on;
    keepalive_timeout 65;
    limit_req_zone $binary_remote_addr zone=req_limit_zone:1m rate=5r/s;
    limit_conn_zone $binary_remote_addr zone=conn_limit_zone:1m;

    server { # the actual service
        listen webdav.local:80;
        server_name webdav.local; # only accept FQDN
        location / {
            root /mnt/microsd/webdav; # probably not the path that you want

            dav_methods PUT DELETE MKCOL COPY MOVE;
            dav_ext_methods PROPFIND OPTIONS LOCK UNLOCK; # currently no-op, module always sends full set
            dav_access user:rw group:r;

            auth_basic "WebDAV Access";
            auth_basic_user_file "/etc/nginx/nginx.users";

            # limits so that I do not DoS myself by accident
            limit_req zone=req_limit_zone burst=10;
            limit_conn conn_limit_zone 10;
            limit_rate_after 10m;
            limit_rate 2M;

            client_max_body_size 1G; # not necessarily the limit you want
            charset utf-8;
            autoindex on; # let browsers browse and download contents
        }
    }

    server { # redirect https to http; distributing certs for TLS would be needless PITA
        listen webdav.local:443 ssl;
        server_name webdav.local;
        ssl_certificate /etc/nginx/conf.d/_lan.crt;
        ssl_certificate_key /etc/nginx/conf.d/_lan.key;
        access_log off;
        return 301 http://$host$request_uri;
    }

    server { # 404 for fat fingers
        listen webdav.local:80 default_server;
        access_log off;
        location / {
            internal;
        }
    }
}

_etc_nginx_nginx.users

web:{PLAIN}dav

Be aware of arut/nginx-dav-ext-module#74
One day I might look into how to do it with lighttpd.

Client (or server):

$ curl -v -X MKCOL http://webdav.local/retroarch/ --user web:dav
* Host webdav.local:80 was resolved.
* IPv4: 192.168.5.1
*   Trying 192.168.5.1:80...
* Connected to webdav.local (192.168.5.1) port 80
* using HTTP/1.x
* Server auth using Basic with user 'web'
> MKCOL /retroarch/ HTTP/1.1
> Host: webdav.local
> Authorization: Basic d2ViOmRhdg==
> User-Agent: curl/8.12.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 201 Created
< Server: nginx/1.26.3
< Date: Sat, 26 Apr 2025 11:41:55 GMT
< Content-Length: 0
< Location: http://webdav.local/retroarch/
< Connection: keep-alive
<
* Connection #0 to host webdav.local left intact

server:

# ls -ld /mnt /mnt/microsd /mnt/microsd/webdav /mnt/microsd/webdav/retroarch
drwxr-xr-x    1 root     root           224 Apr 25 17:12 /mnt
drwxr-xr-x    4 root     root          4096 Apr 24 19:21 /mnt/microsd
drwxrwx---    4 nginx    nginx         4096 Apr 26 11:41 /mnt/microsd/webdav
drwxr-x---    2 nginx    nginx         4096 Apr 26 11:41 /mnt/microsd/webdav/retroarch