https://blog.aristocat.in/tags/caddy/ Recent content in Caddy on Thariq's workplace https://blog.aristocat.in/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://blog.aristocat.in/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.147.1 en thariq shah Wed, 22 Jul 2026 02:56:00 +0530 https://blog.aristocat.in/posts/self-hosting-ente-photos/ Wed, 22 Jul 2026 02:56:00 +0530 https://blog.aristocat.in/posts/self-hosting-ente-photos/ <h2 id="summary">Summary</h2> <p>This is a complete account of standing up <a href="https://ente.com">Ente</a> — an end-to-end encrypted photo and video backup service — on a home server, exposed to the internet through a Cloudflare Tunnel, with mobile and web clients connecting to it from arbitrary networks. The straightforward part of this project was running <code>docker compose up</code>. The interesting part, and the reason this write-up exists, is a single architectural constraint that determines almost every other decision in the stack: <strong>Ente&rsquo;s storage layer issues AWS SigV4 pre-signed URLs directly to the client, and pre-signed URL validation is byte-for-byte sensitive to header mutation along the request path.</strong> Any reverse proxy sitting between the client and the object store is a candidate for silently breaking uploads and downloads — and Cloudflare&rsquo;s edge, which every hostname routed through a Cloudflare Tunnel passes through, is exactly this kind of proxy.</p>