From d238d5ccc7a927b9ddf175433d6e7425516444ac Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 7 Jul 2026 18:05:13 +0200
Subject: [PATCH] Fix Nextcloud file-drop WebDAV URL for backup uploads.

Public file-drop shares require /public.php/dav/filesdrop/<token>/;
/public.php/webdav/ returns HTTP 409 on PUT.
---
 docs/backup-restore.md     | 22 ++++++++++++++++------
 tools/cmd/railiance-backup |  2 +-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/docs/backup-restore.md b/docs/backup-restore.md
index 2c2c24d..0a02117 100644
--- a/docs/backup-restore.md
+++ b/docs/backup-restore.md
@@ -46,13 +46,23 @@ grep "public key" ~/.config/age/railiance-backup.key
 
 ## Destination
 
-Backups are uploaded to a Nextcloud file drop (upload-only, no credentials
-required to write, cannot be read back without Nextcloud admin access). The
-endpoint URL is stored locally in `wiki/260225-backup-dropoff-link.txt`
-(gitignored).
+Backups are uploaded to a Nextcloud **file drop** share (upload-only; cannot be
+read back without Nextcloud admin access). The human-facing share link is in
+`260225-backup-dropoff-link.txt`; credentials live in OpenBao
+(`platform/workloads/railiance/backup/offsite-lane`).
 
-Uploads use a direct HTTP PUT via curl — rclone is not used because Nextcloud
-file drop links only permit PUT requests.
+WebDAV uploads must target the **filesdrop** endpoint, not generic WebDAV:
+
+```text
+https://<host>/public.php/dav/filesdrop/<share-token>/<filename>
+```
+
+Using `/public.php/webdav/` returns HTTP **409** (*Files cannot be created in
+non-existent collections*) on current Nextcloud — that path is not valid for
+public file-drop shares.
+
+Uploads use a direct HTTP PUT via curl (`-u <token>:`). rclone is optional;
+the backup scripts do not require it.
 
 A local cache of the last 7 backups of each type is kept in
 `~/.cache/railiance/backups/`.
diff --git a/tools/cmd/railiance-backup b/tools/cmd/railiance-backup
index ddb19cc..f7b124b 100755
--- a/tools/cmd/railiance-backup
+++ b/tools/cmd/railiance-backup
@@ -17,7 +17,7 @@ if [[ -z "${NC_TOKEN}" || -z "${NC_WEBDAV_URL}" ]] && command -v bao >/dev/null
     NC_WEBDAV_URL="$(bao kv get -field=NC_WEBDAV_URL "${BAO_PATH}")"
   fi
 fi
-: "${NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/webdav}"
+: "${NC_WEBDAV_URL:=https://nx4069.your-storageshare.de/public.php/dav/filesdrop/${NC_TOKEN}}"
 if [[ -z "${NC_TOKEN}" ]]; then
   bad "credentials" "set RAILIANCE_BACKUP_NC_TOKEN or: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read"
   exit 1