Published: October 8, 2025
Last updated: March 10, 2026
Suggest an edit

Control user access to specific directories with allow/deny rules.

How Access Control Works

Rule Variables

  1. User scope — The user must have the source in their scopes.
  2. Deny/Allow — The default behavior is to allow user access, unless the source is configured with denyByDefault.
  3. Access rules — Allow/deny rules for specific directories.

Rule evaluation

When a user accesses a file or directory:

  1. Direct path check — Rules on the exact path are considered first.
  2. Recursive parent check — Parent directories are checked up to the root.
  3. Default behavior — Access is granted if no rule applies, unless denyByDefault is enabled.

Path matching

Starting in v2.1.0+, access rule paths are matched case-insensitively on every source. Rules are stored in lowercase, so /Private and /private are the same rule. On v2.0.x and earlier, rule paths are matched case-sensitively — the rule path must match the requested path exactly, including letter case.

When you upgrade to v2.1.0+, existing rules are normalized at startup: paths are lowercased, and rules that collide after normalization are merged (allow and deny lists are combined). On case-sensitive filesystems, one rule still applies to every case variant of that path — folders that differ only by letter case share the same rule.

Known limitation

Access rules are saved against the source’s configured path. If you change that path in config, existing rules for the source no longer apply and must be recreated.

Rule precedence

More specific paths override broader ones.

  • A rule on /folder/subfolder overrides a rule on /folder.
  • Allow rules take priority over deny rules when both apply.

Creating access rules

In the Web UI

  1. Open User Management or Group Management.
  2. Edit a user or group.
  3. Select a source.
  4. Open Access Rules.
  5. Add allow or deny rules for the directories you need.

Source configuration

denyByDefault

Configure per source in your config:

YAML 
1
2
3
4
5

server:
  sources:
    - path: "/data"
      config:
        denyByDefault: true  # Deny all unless explicitly allowed

With denyByDefault: true:

  • Users can see that the source exists.
  • There is no file access without explicit allow rules.
  • You must add allow rules for each path they should use.

Examples

Basic deny

Rule: Deny user graham access to /.

Result: graham cannot access any files or directories under that scope.

Allow a subfolder only

Rules:

  • Deny user graham access to /.
  • Allow user graham access to /subpath.

Result: graham can only access /subpath and its subdirectories.

Deny all with exceptions

Rules:

  • DenyAll on /vip.
  • Allow user admin access to /vip.

Result: Only admin can access /vip.

Departmental layout

Rules:

  • Allow group sales access to /departments/sales.
  • Allow group engineering access to /departments/engineering.
  • Deny all users access to /departments.

Result: Each department only reaches its own folder.

Rule types

Allow rules

Grant access to a path (read, write, execute, delete).

Deny rules

Explicitly deny access to a path.

DenyAll rules

Deny everyone for that path until a specific allow overrides it.

Troubleshooting

For common issues and fixes, see the Troubleshooting guide.