diff --git a/charts/stable/sftpgo/Chart.yaml b/charts/stable/sftpgo/Chart.yaml index dc9165de206..f1155c58aa6 100644 --- a/charts/stable/sftpgo/Chart.yaml +++ b/charts/stable/sftpgo/Chart.yaml @@ -34,4 +34,4 @@ sources: - https://github.com/truecharts/charts/tree/master/charts/stable/sftpgo - https://ghcr.io/drakkan/sftpgo type: application -version: 6.7.5 +version: 6.7.6 diff --git a/charts/stable/sftpgo/docs/plugins.md b/charts/stable/sftpgo/docs/plugins.md new file mode 100644 index 00000000000..9b51dd421f2 --- /dev/null +++ b/charts/stable/sftpgo/docs/plugins.md @@ -0,0 +1,39 @@ +# SFTPGo Plugins +Due to a number of different possible combinations of plugins, final configuration +must be done through manually set environmental variables. Please refer to examples below. + +Note that all examples still require their env variables to be set in the proper chart +area, however without these manual additons those env variables won't add any functions to +the container. + +## Examples +### LDAP Only +```yaml + SFTPGO_PLUGINS__0__TYPE: auth + SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE: 5 + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-auth" + SFTPGO_PLUGINS__0__ARGS: "serve" + SFTPGO_PLUGINS__0__AUTO_MTLS: 1 +``` +### LDAP & Geoblocking +```yaml + SFTPGO_PLUGINS__0__TYPE: auth + SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE: 5 + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-auth" + SFTPGO_PLUGINS__0__ARGS: "serve" + SFTPGO_PLUGINS__0__AUTO_MTLS: 1 + SFTPGO_PLUGINS__1__TYPE: geoipfilter + SFTPGO_PLUGINS__1__CMD: "/usr/local/bin/sftpgo-plugin-geoipfilter" + SFTPGO_PLUGINS__1__ARGS: "serve" +``` +### Geoblocking Only +```yaml + SFTPGO_PLUGINS__0__TYPE: geoipfilter + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-geoipfilter" + SFTPGO_PLUGINS__0__ARGS: "serve" +``` + +### Tip +There are [some variables][1] which can only be found by looking at code. + +[1]: https://github.com/drakkan/sftpgo/blob/cb3bc3f6043791081d28b9b1666a053a33e2a962/internal/config/config.go#L920 diff --git a/charts/stable/sftpgo/questions.yaml b/charts/stable/sftpgo/questions.yaml index 1b6e5b08bf2..6b5a45f5778 100644 --- a/charts/stable/sftpgo/questions.yaml +++ b/charts/stable/sftpgo/questions.yaml @@ -54,6 +54,151 @@ questions: schema: type: string default: "0" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_URL + label: "SFTPGO_PLUGIN_AUTH_LDAP_URL" + description: "LDAP url" + schema: + type: string + default: "ldap://lldap-ldap.ix-lldap.svc.cluster.local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN + label: "SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN" + description: "The base DN defines the address of the root object in the LDAP directory" + schema: + type: string + default: "dc=mylab,dc=local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN + label: "SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN" + description: "The bind DN used to log in at the LDAP server in order to perform searches. This should be a read-only user." + schema: + type: string + default: "cn=Administrator,cn=users,dc=mylab,dc=local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD + label: "SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD" + description: "The password for the defined ldap-bind-dn. If empty an anonymous bind will be attempted." + schema: + type: string + default: "Password.123456" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY + label: "SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY" + description: "The ldap query to use to find users attempting to login. The %username% placeholder will be replaced with the username attempting to log in" + schema: + type: string + default: "(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%))" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES + label: "SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES" + description: "The ldap attributes containing the groups the users are members of." + schema: + type: string + default: "memberOf" + - variable: SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to the primary group for SFTPGo users. SFTPGo users can have only one primary group." + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to secondary groups of SFTPGo users" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to membership groups of SFTPGo users" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS + label: "SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS" + description: "Require authenticated users to be members of at least one SFTPGo group" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_STARTTLS + label: "SFTPGO_PLUGIN_AUTH_STARTTLS" + description: "STARTTLS is the preferred method of encrypting an LDAP connection. Use it instead of using the ldaps:// URL schema. (0 = false, 1 = true)" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR + label: "SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR" + description: "Users default base directory. Leave empty if already set in SFTPGo. If set it must be an absolute path" + schema: + type: string + default: "/mnt/home" + - variable: SFTPGO_PLUGIN_AUTH_CACHE_TIME + label: "SFTPGO_PLUGIN_AUTH_CACHE_TIME" + description: "Defines the cache time, in seconds, for authenticated users. 0 means no cache" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY + label: "SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY" + description: "If set to 1 the plugin accepts any TLS certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES + label: "SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES" + description: "If set to 1 the plugin accepts any TLS certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing" + schema: + type: string + default: "0" + + - variable: SFTPGO_PLUGIN_EVENTSEARCH_DRIVER + label: "SFTPGO_PLUGIN_EVENTSEARCH_DRIVER" + description: "Database driver (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSEARCH_DSN + label: "SFTPGO_PLUGIN_EVENTSEARCH_DSN" + description: "Data source URI (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_DRIVER + label: "SFTPGO_PLUGIN_EVENTSTORE_DRIVER" + description: "Database driver (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_DSN + label: "SFTPGO_PLUGIN_EVENTSTORE_DSN" + description: "Data source URI (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID + label: "SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID" + description: "Instance identifier" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_RETENTION + label: "SFTPGO_PLUGIN_EVENTSTORE_RETENTION" + description: "Events older than the specified number of hours will be deleted. 0 means no events will be deleted" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE + label: "SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE" + description: "Path to the MaxMind GeoLite2 or GeoIP2 database" + schema: + type: string + default: "/mnt/database/geolite.db" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES + label: "SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES" + description: "Comma separated allowed countries in ISO 3166-1 alpha-2 format" + schema: + type: string + default: "JP" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES + label: "SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES" + description: "Comma separated denied countries in ISO 3166-1 alpha-2 format" + schema: + type: string + default: "KP" # Include{containerBasic} # Include{containerAdvanced} # Include{containerConfig} diff --git a/charts/stable/sftpgo/values.yaml b/charts/stable/sftpgo/values.yaml index 2edb28bd4d6..15ede012dfb 100644 --- a/charts/stable/sftpgo/values.yaml +++ b/charts/stable/sftpgo/values.yaml @@ -1,7 +1,7 @@ image: pullPolicy: IfNotPresent repository: ghcr.io/drakkan/sftpgo - tag: v2.5.6@sha256:584298589ff92a1fdb5f4b9c5152a4a7de7a58dc95b4606c0074259f86ee9e9c + tag: v2.5.6-plugins@sha256:2cbae10931877edbebfa7f86488eb5017d1d3f6f50d81af099f348620d774ff3 securityContext: container: runAsNonRoot: false @@ -60,6 +60,40 @@ workload: SFTPGO_FTPD__PASSIVE_PORT_RANGE__END: "50100" SFTPGO_FTPD__PASSIVE_PORT_RANGE__START: "50000" SFTPGO_WEBDAVD__BINDINGS__0__PORT: "10080" + # plugins section + # each plugin will require couple more manual settings due to + # how they can each be combined differently. see docs on truecharts website + # ref - https://github.com/sftpgo/sftpgo-plugin-auth + SFTPGO_PLUGIN_AUTH_LDAP_URL: "ldap://192.168.1.5:389" + SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN: "dc=mylab,dc=local" + SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN: "cn=Administrator,cn=users,dc=mylab,dc=local" + SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD: "Password.123456" + SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY: "(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%))" + SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES: "memberOf" + SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS: "" + SFTPGO_PLUGIN_AUTH_STARTTLS: "0" + SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR: "/mnt/home" + SFTPGO_PLUGIN_AUTH_CACHE_TIME: 0 + SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY: "0" + SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES: "" + # ref - https://github.com/sftpgo/sftpgo-plugin-eventsearch + SFTPGO_PLUGIN_EVENTSEARCH_DRIVER: "" + SFTPGO_PLUGIN_EVENTSEARCH_DSN: "" + # ref - https://github.com/sftpgo/sftpgo-plugin-eventstore + SFTPGO_PLUGIN_EVENTSTORE_DRIVER: "" + SFTPGO_PLUGIN_EVENTSTORE_DSN: "" + SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID: "" + SFTPGO_PLUGIN_EVENTSTORE_RETENTION: "0" + # ref - https://github.com/sftpgo/sftpgo-plugin-geoipfilter + SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE: "/mnt/database/geolite.db" + SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES: "JP" + SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES: "KP" + # ref - https://github.com/sftpgo/sftpgo-plugin-kms + # ref - https://github.com/sftpgo/sftpgo-plugin-pubsub + persistence: backupdirectory: enabled: true