add WebDAV service backed by RustFS S3 for Zotero file sync

refs #94 #95 #96 #97

- Add rclone/rclone container serving WebDAV on port 8080, backed
  by the existing RustFS S3 with a dedicated zotero bucket
- Add rustfs/policies/zotero.json IAM policy for bucket access
- Add Traefik route at webdav.homelab.fhirworx.io
- Add WEBDAV_* env vars to .env.example
- Configure Zotero prefs for WebDAV storage sync

.env.example

@@ -24,6 +24,12 @@ POLARIS_ROOT_SECRET=changeme
 POLARIS_S3_ACCESS_KEY=changeme
 POLARIS_S3_SECRET_KEY=changeme
 
+# Zotero WebDAV (rclone → S3)
+WEBDAV_S3_ACCESS_KEY=changeme
+WEBDAV_S3_SECRET_KEY=changeme
+WEBDAV_USER=zotero
+WEBDAV_PASS=changeme
+
 # Databricks (optional)
 DATABRICKS_HOST=
 DATABRICKS_TOKEN=

compose.yml

@@ -249,6 +249,23 @@ services:
               capabilities: [gpu]
     restart: unless-stopped
 
+  webdav:
+    image: rclone/rclone:latest
+    container_name: webdav
+    networks:
+      - storage
+      - gateway
+    command:
+      - serve
+      - webdav
+      - ":s3,provider=Minio,access_key_id=${WEBDAV_S3_ACCESS_KEY},secret_access_key=${WEBDAV_S3_SECRET_KEY},endpoint=http://rustfs:9000,force_path_style=true:zotero"
+      - --addr=:8080
+      - --user=${WEBDAV_USER:-zotero}
+      - --pass=${WEBDAV_PASS}
+    restart: unless-stopped
+    depends_on:
+      - rustfs
+
   nessie:
     image: ghcr.io/projectnessie/nessie:latest
     container_name: nessie

rustfs/policies/zotero.json

@@ -0,0 +1,29 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetBucketLocation",
+        "s3:ListBucket",
+        "s3:ListBucketMultipartUploads"
+      ],
+      "Resource": [
+        "arn:aws:s3:::zotero"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:ListMultipartUploadParts",
+        "s3:AbortMultipartUpload"
+      ],
+      "Resource": [
+        "arn:aws:s3:::zotero/*"
+      ]
+    }
+  ]
+}

traefik/dynamic/services.yml

@@ -6,6 +6,7 @@
   "woodpecker-server"  (dict "port" "8000"  "theme" true  "subdomain" "ci" "mw" "local-only,secure-headers")
   "notebooks"          (dict "port" "2718"  "theme" true  "mw" "local-only,secure-headers")
   "zotero"             (dict "port" "8080"  "theme" true  "mw" "secure-headers")
+  "webdav"             (dict "port" "8080"  "theme" false "mw" "secure-headers")
   "api"                (dict "port" "8000"  "theme" false "mw" "secure-headers")
   "nessie"             (dict "port" "19120" "theme" false "mw" "local-only,infra-headers")
   "trino"              (dict "port" "8080"  "theme" true  "mw" "local-only,infra-headers")