diff --git a/.gitignore b/.gitignore
index 38e8f9d3..5af43367 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,7 +38,7 @@ terraform.tfstate
 terraform.tfstate.*
 .terraform.lock.hcl
 *.log
-./main.tf
+/main.tf
 
 # Ruflo local secrets and runtime data
 .env
diff --git a/client/src/api/rclone.tsx b/client/src/api/rclone.tsx
index 7939c138..e2062f82 100644
--- a/client/src/api/rclone.tsx
+++ b/client/src/api/rclone.tsx
@@ -71,7 +71,7 @@ export default function createRcloneAPI(apiFetch: ApiFetch) {
         'Content-Type': 'application/json'
       },
       body: JSON.stringify({
-        "fs": remoteName + ":/",
+        "fs": remoteName,
       })
     }))
   }
diff --git a/main.tf b/main.tf
deleted file mode 100644
index 06f6bf00..00000000
--- a/main.tf
+++ /dev/null
@@ -1,56 +0,0 @@
-terraform {
-  required_providers {
-    cosmos = {
-      source  = "cosmos-cloud.io/azukaar/cosmos"
-      version = "0.1.0"
-    }
-  }
-}
-
-provider "cosmos" {
-  base_url = "http://localhost:8080"
-  token    = "cosmos_LUQDv-Wfhd_CaKnAEA6Z48zHFo_5wCpHJof84EbTxvM"
-  insecure = true
-}
-
-# resource "cosmos_route" "test" {
-#   name   = "test-route"
-#   target = "http://localhost:1234"
-#   use_host = true
-#   host   = "localhost:1235"
-#   mode   = "PROXY"
-# }
-
-# resource "cosmos_api_token" "nginx_token" {
-#   name        = "nginx-readonly"
-#   description = "Token for nginx container"
-#   read_only   = true
-#   expiry_days = 30
-# }
-
-# resource "cosmos_docker_service" "nginx" {
-#   name  = "nginx-test"
-#   image = "nginx:latest"
-#   service_json = jsonencode({
-#     ports       = ["8888:80"]
-#     environment = ["COSMOS_TOKEN=${cosmos_api_token.nginx_token.token}"]
-#   })
-# }
-
-# Initialize Constellation VPN
-resource "cosmos_constellation" "vpn" {
-  device_name   = "server"
-  hostname      = "10.255.255.254,192.168.1.102,169.254.83.107"
-  ip_range      = "192.168.201.0/24"
-  is_lighthouse = true
-}
-
-# Device without nickname
-resource "cosmos_constellation_device" "cosmos-2" {
-  device_name = "cosmos-2"
-  ip          = "192.168.201.3"
-  is_lighthouse = true
-  public_hostname      = "192.168.1.204"
-  cosmos_node = 1
-  depends_on  = [cosmos_constellation.vpn]
-} 
diff --git a/src/storage/rclone_api.go b/src/storage/rclone_api.go
index b36d5049..c3b06126 100644
--- a/src/storage/rclone_api.go
+++ b/src/storage/rclone_api.go
@@ -277,12 +277,29 @@ func API_RClone_OperationsAbout(w http.ResponseWriter, req *http.Request) {
 	}
 
 	ctx := context.Background()
-	fsPath := payload.Fs
-	if !strings.HasSuffix(fsPath, ":") && !strings.Contains(fsPath, ":/") {
-		fsPath = fsPath + ":"
+
+	ensureRCloneConfig()
+
+	// payload.Fs must be a bare, admin-configured remote name because command can be injected otherwise
+	name := strings.TrimSuffix(strings.TrimSuffix(payload.Fs, "/"), ":")
+	if name == "" || strings.ContainsAny(name, ":,/") {
+		utils.HTTPError(w, "Invalid remote name", http.StatusBadRequest, "RCL006")
+		return
 	}
 
-	f, err := fs.NewFs(ctx, fsPath)
+	allowed := false
+	for _, n := range config.GetRemoteNames() {
+		if n == name {
+			allowed = true
+			break
+		}
+	}
+	if !allowed {
+		utils.HTTPError(w, "Unknown remote", http.StatusBadRequest, "RCL006")
+		return
+	}
+
+	f, err := fs.NewFs(ctx, name+":")
 	if err != nil {
 		utils.HTTPError(w, "Failed to access remote: "+err.Error(), http.StatusInternalServerError, "RCL007")
 		return