From ef00dde48753e324d97a13a70ff4f6d85839d98b Mon Sep 17 00:00:00 2001
From: Andreas Dueren <contact@due.ren>
Date: Thu, 20 Nov 2025 12:36:02 -0600
Subject: [PATCH] Restrict museum routes to primary host

---
 start.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/start.sh b/start.sh
index 9d4f3bb..5b8b569 100755
--- a/start.sh
+++ b/start.sh
@@ -1219,7 +1219,9 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
         respond 204
     }
 
-    handle_path /api/* {
+    @api_host host ${PHOTOS_HOST}
+    handle @api_host {
+        handle_path /api/* {
         @api_cors_path header Origin *
         header @api_cors_path {
             Access-Control-Allow-Origin {http.request.header.Origin}
@@ -1236,6 +1238,7 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
             header_up X-Forwarded-For {http.request.header.X-Forwarded-For}
             header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
         }
+        }
     }
 
     handle /health {
@@ -1272,6 +1275,7 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     @museum_api_get_path {
+        host ${PHOTOS_HOST}
         method GET HEAD
         path_regexp museum_api_get_path ^/(admin|authenticator|billing|cast|collections|custom-domain|diff|discount|email-hash|emails-from-hashes|emergency-contacts|family|file|file-link|files|fire|info|job|mail|metrics|multipart-upload-urls|offers|options|pass-info|passkeys|public-collection|push|queue|remote-store|storage-bonus|thumbnail|trash|unknown-api|upload-urls|user|user-entity|verify-password)(/|$)
     }
@@ -1285,6 +1289,7 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     @write_methods_path {
+        host ${PHOTOS_HOST}
         not method GET
         not method HEAD
     }