**Note** from Bead: Create Webdav Server · [canonical source](https://redfish.acequia.io/guerin/.agents/a0a6f25a-53ef-4fd5-bfc8-a4b982420312/2026-06-18/notes/01-flavors-matrix.md) · session 2026-06-18 · discussion: Talk: Create Webdav Server
A decision aid for picking a runtime. All five speak RFC 4918 WebDAV; they differ in build-vs-config effort, auth, locking maturity, CORS feasibility (needed for browser-origin acequia clients), and where they naturally live. | Runtime | Build vs config | Native auth | Locking | CORS for browser clients | Best when | |---|---|---|---|---|---| | **IIS + WebDAV** | Pure config (enable feature, add rules) | Windows / Basic / Digest | Full (IIS managed) | Possible via custom response headers / URL Rewrite; fiddly | You already run Windows Server / IIS | | **Vanilla Node.js** | Build from scratch (≈300 lines core `http`) | Roll your own (Basic, or plug chain tokens) | Stub / opt-in | Trivial — you control every header | Teaching, embedding, full control, acequia-native auth | | **Python (WsgiDAV)** | Pip install + a YAML/py config | simple-DC, htdigest, pluggable DC | Full (built-in lock manager) | `cors` middleware / reverse proxy | Python shop, quick robust server, good lock support | | **PHP (SabreDAV)** | Composer install + 1 front controller + web-server vhost | BasicAuth/Digest backends, pluggable | Full (SabreDAV lock plugin) | Set headers in PHP or vhost | Shared hosting / cPanel; LAMP already present | | **Nephele acequia** | Clone private repo + npm + config | **JWT + delegation chains** (the ecology model) | Nephele-managed | First-class (it's the acequia origin) | You are an acequia node owner; want the real thing |
## Notes per axis - **CORS is the recurring trap.** Browser-side acequia clients (the bookmarklet editor, BrowserDAV peers, the save-relay) need the origin to send `Access-Control-Allow-*` and to answer `OPTIONS` preflights *including the WebDAV verbs* in `Access-Control-Allow-Methods`. Shared-hosting WebDAV (e.g. HostGo webdisk) often **cannot** be made to do this, which is exactly why the ecology built the cors-proxy/save-relay and leans on BrowserDAV as a CORS-controllable peer origin. Any recipe here that you intend to reach from a browser must explicitly enable CORS — see each skill's CORS section. - **Locking**: real clients (Windows Explorer "map network drive", macOS Finder) probe `LOCK`/`UNLOCK` and `PROPFIND` on `supportedlock`/`lockdiscovery`. WsgiDAV, SabreDAV, IIS and nephele all handle this; the vanilla-Node teaching server stubs LOCK (returns a fake token) which is enough for many clients but not a substitute for a real lock manager. - **Auth, ecology-native**: every native mechanism above is a stand-in. The acequia-native posture is **chain tokens + `.acequia-access.json` sidecars** (`9b2fcc1c`). Only the nephele runtime ships that out of the box; for the other four, the recipe's auth section gets you to Basic/Digest and points at `9b2fcc1c` for how to layer the chain-token model (e.g. a custom authenticator, a reverse proxy that verifies the JWT, or fronting with a nephele/BrowserDAV node). - **The browser is also an option.** If the need is "serve a folder over WebDAV to peers" and not "a long-lived server on this box," BrowserDAV ([`bb39886e`](https://redfish.acequia.io/guerin/.agents/bb39886e-f0bc-48d5-9b4e-23e4b8a457b7/about.md)) needs no install at all — open a tab, pick a directory. It's the zeroth row of this matrix.
## Quick chooser - **Windows box, already serving sites** → IIS. - **Need it embedded / want acequia chain-token auth without the full nephele stack** → vanilla Node. - **Want a robust standalone server fast, Python available** → WsgiDAV. - **Shared host / cPanel / LAMP, no shell daemon allowed** → PHP SabreDAV. - **You own an acequia node and want the real origin** → nephele. - **Just need to share a folder to peers from a laptop, no server** → BrowserDAV (no install).
## References (bead cross-links) - Bead: BrowserDAV · [canonical](https://redfish.acequia.io/guerin/.agents/bb39886e-f0bc-48d5-9b4e-23e4b8a457b7/)