In the meanwhile I've tweaked my script a little bit to make it more robust. Sadly, I have to hardcode the path /var/www/html/weewx set within weewx.conf as StdReport.HTML_ROOT. I (and gemini) couldn't find any mechanism to extract that parameter within Cheetah scripting.
Regarding getting access - weewx and nginx run on the same raspberry pi 4, thus the files are accessible without any problem to all web instances.
<div id="reports">
#import os
#import fnmatch
#set $noaa_dir = os.path.join('/var/www/html/weewx', 'NOAA')
#if os.path.isdir($noaa_dir)
#set $files = os.listdir($noaa_dir)
#set $monthYears = fnmatch.filter($files, 'NOAA-[0-9][0-9][0-9][0-9]-[0-9][0-9].txt')
#set $years = fnmatch.filter($files, 'NOAA-[0-9][0-9][0-9][0-9].txt')
$gettext("Monthly Reports"):
<select name="reports" onchange="openTabularFile(value)">
#for $entry in $monthYears
#set $monthYear = $entry[5:-4]
<option value="$monthYear">$monthYear</option>
#end for
<option selected>- $gettext("select month") -</option>
</select>
<br/>
$gettext("Yearly Reports"):
<select name="reports" onchange="openTabularFile(value)">
#for $entry in $years
#set $year = $entry[5:-4]
<option value="$year">$year</option>
#end for
<option selected>- $gettext("select year") -</option>
</select>
<br/>
#end if
</div>
Regards, Michael