From e50abcb9a25d49a90ac609c6037e973420db798e Mon Sep 17 00:00:00 2001
From: Andreas Dueren <contact@due.ren>
Date: Thu, 20 Nov 2025 23:40:08 -0600
Subject: [PATCH] Limit museum API matchers to photos host

---
 start.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/start.sh b/start.sh
index 9541eb0..2be7a76 100755
--- a/start.sh
+++ b/start.sh
@@ -1063,7 +1063,10 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
         }
     }
 
-    @user_api path_regexp user_api ^/users($|/.*)
+    @user_api {
+        host ${PHOTOS_HOST_MATCHERS}
+        path_regexp user_api ^/users($|/.*)
+    }
     handle @user_api {
         reverse_proxy localhost:8080 {
             trusted_proxies private_ranges
@@ -1075,6 +1078,7 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     @museum_api_get {
+        host ${PHOTOS_HOST_MATCHERS}
         method GET HEAD
         path_regexp museum_api_get ^/(admin|authenticator|billing|cast|collections|custom-domain|diff|discount|email-hash|emails-from-hashes|emergency-contacts|family|file|file-link|files|fire|info|job|mail|metrics|multipart-upload-urls|offers|options|pass-info|passkeys|public-collection|push|queue|remote-store|storage-bonus|thumbnail|trash|unknown-api|upload-urls|user|user-entity|verify-password)(/|$)
     }
@@ -1089,6 +1093,7 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     @write_methods {
+        host ${PHOTOS_HOST_MATCHERS}
         not method GET
         not method HEAD
     }