Every Nextcloud is also a WebDAV server. WebDAV is the HTTP file protocol the sync clients speak, and it is always on — no app to install, no setting to enable. That makes any Nextcloud scriptable from the command line with nothing but `curl`. This page explains the protocol, shows the CLI verbs, and records the Host-header trick that repaired this farm's TLS outage in July 2026.
## How Webdav Works
WebDAV — Web Distributed Authoring and Versioning — extends plain HTTP with verbs for filesystems. `GET` and `PUT` download and upload files. `MKCOL` makes a folder. `DELETE`, `MOVE` and `COPY` do what they say. `PROPFIND` lists a folder or reads file metadata. A WebDAV server is just a web server that answers these extra verbs, so every HTTP tool works on it.
Nextcloud mounts each account's files at a well-known path. Everything under it is your synced tree, one URL per file or folder:
https://SERVER/remote.php/dav/files/USERNAME/
## Always On
You do not have to check whether your Nextcloud configuration "has" WebDAV. WebDAV *is* Nextcloud's file API — the desktop and mobile sync clients are WebDAV clients, and the web interface rides the same endpoints. If sync works, WebDAV works. The only thing you need is a credential: an app password, minted under Personal Settings → Security, or already sitting in your keychain because the desktop client stored one there.
## Webdav on the Cli
List a folder — `PROPFIND` with depth 1 returns one XML entry per child:
curl -u USER:APP_PASSWORD -X PROPFIND -H 'Depth: 1' \ https://SERVER/remote.php/dav/files/USER/some/folder/
Download and upload are plain HTTP:
curl -u USER:APP_PASSWORD -O https://SERVER/remote.php/dav/files/USER/notes.md curl -u USER:APP_PASSWORD -T notes.md https://SERVER/remote.php/dav/files/USER/notes.md
Make a folder with `MKCOL` — expect `201 Created`, or `405` if it already exists:
curl -u USER:APP_PASSWORD -X MKCOL https://SERVER/remote.php/dav/files/USER/new-folder
On a Mac, keep the password out of the command line entirely. The desktop client already stores an app password in the login Keychain under the service name `Nextcloud`; read it with `security` and feed it to curl on stdin, so it never appears in `ps`, shell history, or a transcript:
PW=$(security find-generic-password -s Nextcloud -w) printf 'user = "USER:%s"\n' "$PW" | \ curl --config - -X MKCOL https://SERVER/remote.php/dav/files/USER/new-folder unset PW
## The Host Header Trick
In July 2026 this farm's Nextcloud went unreachable: its certificate hit the renewal window, on-demand issuance was refused, and every TLS handshake to `nextcloud.hitchhikers.earth` died before HTTP began. The server itself was healthy — only that hostname's certificate was broken. See Caddy Automatic Https for how on-demand certificates work.
The way in: a reverse proxy routes by the `Host` *header*, but TLS is negotiated on the `SNI` — the hostname you *connect* to. Those are normally the same. They don't have to be. Connect to any sibling domain on the same proxy that still has a valid certificate, and hand it the broken site's Host header:
curl -H 'Host: nextcloud.hitchhikers.earth' https://hitchhikers.earth/status.php
The handshake succeeds against the healthy certificate; the proxy reads the header and routes to Nextcloud anyway. Full WebDAV works through the same door. Two `MKCOL` calls through it created the folders the certificate gate was checking for, the certificates issued within seconds, and sync healed itself. The whole repair was four curl commands.
## Links
- RFC 4918 
— the WebDAV specification
- Nextcloud WebDAV docs — official client access guide
# Assets
nextcloud-webdav