feat(rest): external-file endpoints stub

LIST returns []; GET /{path} returns 404. Cozystack manages host
config via Talos system extensions and kubelet, not via LINSTOR's
external-file delivery; the endpoints exist so linstor CLI doesn't
404 on `external-file list`.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

Author: kvaps

PLAN.md

@@ -260,7 +260,7 @@ Full scope list lives in `docs/csi-api-surface.md` (to be created in Phase 1).
 - [x] DRBD proxy enable/disable/configure: 501 Not Implemented stubs (`/v1/resource-definitions/{rd}/drbd-proxy*`). Cozystack-style clusters run flat L2 so DRBD-9's native protocol suffices; proxy isn't needed. Endpoints exist so `linstor drbd-proxy *` returns a deterministic error.
 - [ ] DRBD options: full set from `drbdoptions.json`
 - [x] file storage provider (`pkg/storage/file`): FILE / FILE_THIN behind same Provider seam — fallocate (thick) / truncate (thin) for create, statfs(2) for pool capacity, snapshots intentionally unsupported (caller routes to LVM/ZFS instead). 9 contract tests.
-- [ ] External-file management
+- [x] External-file management stub (`/v1/files` LIST returns []; GET /{path} → 404). Cozystack manages host config via Talos extensions; the endpoints exist so `linstor external-file list` doesn't 404.
 
 ### Phase 7 — Cluster operations + admin
 

pkg/rest/external_files.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rest
+
+import (
+	"net/http"
+)
+
+// registerExternalFiles wires linstor's external-file endpoints. We
+// don't yet ship arbitrary files to satellites — cozystack manages
+// host config via Talos extensions / kubelet — but the `external-file
+// list` CLI hits these on startup.
+//
+// LIST → []. GET on a single path → 404. Wider implementation lands
+// when a real per-cluster need shows up.
+func (s *Server) registerExternalFiles(mux *http.ServeMux) {
+	mux.HandleFunc("GET /v1/files", handleExternalFilesList)
+	mux.HandleFunc("GET /v1/files/{path...}", handleExternalFileGet)
+}
+
+func handleExternalFilesList(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, []map[string]string{})
+}
+
+func handleExternalFileGet(w http.ResponseWriter, _ *http.Request) {
+	writeError(w, http.StatusNotFound, "external file not found")
+}

pkg/rest/external_files_test.go

@@ -0,0 +1,63 @@
+/*
+Copyright 2026 Cozystack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package rest
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/cozystack/blockstor/pkg/store"
+)
+
+// TestExternalFilesEmpty: an empty cluster returns [], not 404. CLI's
+// `external-file list` calls this on every invocation.
+func TestExternalFilesEmpty(t *testing.T) {
+	base, stop := startServerWithStore(t, store.NewInMemory())
+	defer stop()
+
+	resp := httpGet(t, base+"/v1/files")
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status: got %d", resp.StatusCode)
+	}
+
+	var got []any
+
+	err := json.NewDecoder(resp.Body).Decode(&got)
+	if err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	if len(got) != 0 {
+		t.Errorf("expected empty list; got %d", len(got))
+	}
+}
+
+// TestExternalFileGetMissing: 404 on unknown path.
+func TestExternalFileGetMissing(t *testing.T) {
+	base, stop := startServerWithStore(t, store.NewInMemory())
+	defer stop()
+
+	resp := httpGet(t, base+"/v1/files/some-path")
+	_ = resp.Body.Close()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("status: got %d, want 404", resp.StatusCode)
+	}
+}

pkg/rest/server.go

@@ -76,6 +76,7 @@ func (s *Server) Start(ctx context.Context) error {
 	s.registerEncryption(mux)
 	s.registerNodeLifecycle(mux)
 	s.registerDRBDProxy(mux)
+	s.registerExternalFiles(mux)
 
 	srv := &http.Server{
 		Addr:              s.Addr,