# Web sites

Static web sites that Caddy serves on the router, each from its own folder,
`/var/lib/vpn-router/sites/<name>`. The files of a site are on the [Files](site-files.md) tab, and
the name server of their domain on the [DNS](dns.md) tab.

## Settings

- **State:** whether the sites are served.
- **Largest upload:** the largest file or zip archive the Files tab and the router's API take.
- **WebDAV:** whether the folders are served over WebDAV, and its URL with a copy icon.

**Settings** edits them.

## Columns

- **URLs:** the addresses of the site, one per host name; a site without host names answers any
  name on its port.
- **Port** and **Listen:** the TCP port, and the interfaces its firewall opens: internal,
  external or both.
- **TLS:** None (plain HTTP), Let's Encrypt, an issuing CA of the Certificates page, or a
  certificate and key given with the site.
- **Editors:** the group whose members may change the files besides the admins.
- **DNS:** who serves the records of the host names. **User managed:** a DNS provider outside the
  router. **Router managed:** the router's name server gives each host name an A or AAAA record in
  its domain on the [DNS](dns.md) tab, with the router's **Public IP** (the Public IP address of
  the DNS settings), **Internal interface IP** or **External interface IP**. A host name in none of
  the router's domains gets no record.

A host name may be the router's FQDN, on a port of the site's own, such as 443, which the router's
own services leave free. Such a site is User managed: the record of the router's FQDN stays with
the DNS of its domain.

## Actions

- **Add** and **Edit:** the settings of a site; the name is fixed once added.
- **Files** opens the site on the Files tab.
- **Disable**, **Enable**, and **Remove**, which keeps the folder unless asked to remove it.

## Rules

- The router's own ports, such as 22, 7081, 7443, 7444 and 7445, cannot be taken by a site.
- Sites sharing a port need host names of their own, the same Listen and the same kind of TLS.
- Let's Encrypt needs host names that resolve to the router from the internet, and port 80.
- A certificate and key must belong together and name the host names.
- An issuing CA's certificates are trusted by browsers that trust the router's root CA.

## WebDAV

With WebDAV on, a WebDAV client signs in at the WebDAV URL with a user name and password of the
router, followed by the TOTP code for an enrolled user. Admins see a folder for every site, other
users the folders of the sites whose editors group they are members of. An upload reaches the site
a few seconds after it is written.