From 15083af8030152b3b4f86c8c16dc19b8aa8364cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E3=81=B0=E3=81=8B=E9=9B=AA?= <165359296+bakayukii@users.noreply.github.com> Date: Wed, 3 Apr 2024 00:38:31 +0900 Subject: [PATCH] feat(sftpgo): add plugins and docs (#20144) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Description** Hello, This changes the image from v2.5.6 to v2.5.6-plugins and makes basic environmental variables available in chart. It also adds documentation for how to activate plugins once they are configured. ⚒️ Fixes # **⚙️ Type of change** - [X] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code **🧪 How Has This Been Tested?** **📃 Notes:** I'm sure there is probably a way to do this with checkboxes and maybe tpl code in common template but i don't know how to do that yet >.< **✔️ Checklist:** - [X] ⚖️ My code follows the style guidelines of this project - [X] 👀 I have performed a self-review of my own code - [X] #️⃣ I have commented my code, particularly in hard-to-understand areas - [X] 📄 I have made corresponding changes to the documentation - [ ] ⚠️ My changes generate no new warnings - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [X] ⬆️ I increased versions for any altered app according to semantic versioning - [X] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):` or `chore(chart-name):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: bitpushr <91350598+bitpushr@users.noreply.github.com> Signed-off-by: Xstar97TheNoob <9399967+xstar97@users.noreply.github.com> Co-authored-by: bitpushr <91350598+bitpushr@users.noreply.github.com> Co-authored-by: Xstar97TheNoob <9399967+xstar97@users.noreply.github.com> --- charts/stable/sftpgo/Chart.yaml | 2 +- charts/stable/sftpgo/docs/plugins.md | 39 +++++++ charts/stable/sftpgo/questions.yaml | 145 +++++++++++++++++++++++++++ charts/stable/sftpgo/values.yaml | 36 ++++++- 4 files changed, 220 insertions(+), 2 deletions(-) create mode 100644 charts/stable/sftpgo/docs/plugins.md diff --git a/charts/stable/sftpgo/Chart.yaml b/charts/stable/sftpgo/Chart.yaml index dc9165de206..f1155c58aa6 100644 --- a/charts/stable/sftpgo/Chart.yaml +++ b/charts/stable/sftpgo/Chart.yaml @@ -34,4 +34,4 @@ sources: - https://github.com/truecharts/charts/tree/master/charts/stable/sftpgo - https://ghcr.io/drakkan/sftpgo type: application -version: 6.7.5 +version: 6.7.6 diff --git a/charts/stable/sftpgo/docs/plugins.md b/charts/stable/sftpgo/docs/plugins.md new file mode 100644 index 00000000000..9b51dd421f2 --- /dev/null +++ b/charts/stable/sftpgo/docs/plugins.md @@ -0,0 +1,39 @@ +# SFTPGo Plugins +Due to a number of different possible combinations of plugins, final configuration +must be done through manually set environmental variables. Please refer to examples below. + +Note that all examples still require their env variables to be set in the proper chart +area, however without these manual additons those env variables won't add any functions to +the container. + +## Examples +### LDAP Only +```yaml + SFTPGO_PLUGINS__0__TYPE: auth + SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE: 5 + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-auth" + SFTPGO_PLUGINS__0__ARGS: "serve" + SFTPGO_PLUGINS__0__AUTO_MTLS: 1 +``` +### LDAP & Geoblocking +```yaml + SFTPGO_PLUGINS__0__TYPE: auth + SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE: 5 + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-auth" + SFTPGO_PLUGINS__0__ARGS: "serve" + SFTPGO_PLUGINS__0__AUTO_MTLS: 1 + SFTPGO_PLUGINS__1__TYPE: geoipfilter + SFTPGO_PLUGINS__1__CMD: "/usr/local/bin/sftpgo-plugin-geoipfilter" + SFTPGO_PLUGINS__1__ARGS: "serve" +``` +### Geoblocking Only +```yaml + SFTPGO_PLUGINS__0__TYPE: geoipfilter + SFTPGO_PLUGINS__0__CMD: "/usr/local/bin/sftpgo-plugin-geoipfilter" + SFTPGO_PLUGINS__0__ARGS: "serve" +``` + +### Tip +There are [some variables][1] which can only be found by looking at code. + +[1]: https://github.com/drakkan/sftpgo/blob/cb3bc3f6043791081d28b9b1666a053a33e2a962/internal/config/config.go#L920 diff --git a/charts/stable/sftpgo/questions.yaml b/charts/stable/sftpgo/questions.yaml index 1b6e5b08bf2..6b5a45f5778 100644 --- a/charts/stable/sftpgo/questions.yaml +++ b/charts/stable/sftpgo/questions.yaml @@ -54,6 +54,151 @@ questions: schema: type: string default: "0" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_URL + label: "SFTPGO_PLUGIN_AUTH_LDAP_URL" + description: "LDAP url" + schema: + type: string + default: "ldap://lldap-ldap.ix-lldap.svc.cluster.local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN + label: "SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN" + description: "The base DN defines the address of the root object in the LDAP directory" + schema: + type: string + default: "dc=mylab,dc=local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN + label: "SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN" + description: "The bind DN used to log in at the LDAP server in order to perform searches. This should be a read-only user." + schema: + type: string + default: "cn=Administrator,cn=users,dc=mylab,dc=local" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD + label: "SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD" + description: "The password for the defined ldap-bind-dn. If empty an anonymous bind will be attempted." + schema: + type: string + default: "Password.123456" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY + label: "SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY" + description: "The ldap query to use to find users attempting to login. The %username% placeholder will be replaced with the username attempting to log in" + schema: + type: string + default: "(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%))" + - variable: SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES + label: "SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES" + description: "The ldap attributes containing the groups the users are members of." + schema: + type: string + default: "memberOf" + - variable: SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to the primary group for SFTPGo users. SFTPGo users can have only one primary group." + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to secondary groups of SFTPGo users" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX + label: "SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX" + description: "Prefix for LDAP groups to map to membership groups of SFTPGo users" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS + label: "SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS" + description: "Require authenticated users to be members of at least one SFTPGo group" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_AUTH_STARTTLS + label: "SFTPGO_PLUGIN_AUTH_STARTTLS" + description: "STARTTLS is the preferred method of encrypting an LDAP connection. Use it instead of using the ldaps:// URL schema. (0 = false, 1 = true)" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR + label: "SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR" + description: "Users default base directory. Leave empty if already set in SFTPGo. If set it must be an absolute path" + schema: + type: string + default: "/mnt/home" + - variable: SFTPGO_PLUGIN_AUTH_CACHE_TIME + label: "SFTPGO_PLUGIN_AUTH_CACHE_TIME" + description: "Defines the cache time, in seconds, for authenticated users. 0 means no cache" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY + label: "SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY" + description: "If set to 1 the plugin accepts any TLS certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES + label: "SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES" + description: "If set to 1 the plugin accepts any TLS certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing" + schema: + type: string + default: "0" + + - variable: SFTPGO_PLUGIN_EVENTSEARCH_DRIVER + label: "SFTPGO_PLUGIN_EVENTSEARCH_DRIVER" + description: "Database driver (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSEARCH_DSN + label: "SFTPGO_PLUGIN_EVENTSEARCH_DSN" + description: "Data source URI (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_DRIVER + label: "SFTPGO_PLUGIN_EVENTSTORE_DRIVER" + description: "Database driver (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_DSN + label: "SFTPGO_PLUGIN_EVENTSTORE_DSN" + description: "Data source URI (required)" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID + label: "SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID" + description: "Instance identifier" + schema: + type: string + default: "" + - variable: SFTPGO_PLUGIN_EVENTSTORE_RETENTION + label: "SFTPGO_PLUGIN_EVENTSTORE_RETENTION" + description: "Events older than the specified number of hours will be deleted. 0 means no events will be deleted" + schema: + type: string + default: "0" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE + label: "SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE" + description: "Path to the MaxMind GeoLite2 or GeoIP2 database" + schema: + type: string + default: "/mnt/database/geolite.db" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES + label: "SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES" + description: "Comma separated allowed countries in ISO 3166-1 alpha-2 format" + schema: + type: string + default: "JP" + - variable: SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES + label: "SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES" + description: "Comma separated denied countries in ISO 3166-1 alpha-2 format" + schema: + type: string + default: "KP" # Include{containerBasic} # Include{containerAdvanced} # Include{containerConfig} diff --git a/charts/stable/sftpgo/values.yaml b/charts/stable/sftpgo/values.yaml index 2edb28bd4d6..15ede012dfb 100644 --- a/charts/stable/sftpgo/values.yaml +++ b/charts/stable/sftpgo/values.yaml @@ -1,7 +1,7 @@ image: pullPolicy: IfNotPresent repository: ghcr.io/drakkan/sftpgo - tag: v2.5.6@sha256:584298589ff92a1fdb5f4b9c5152a4a7de7a58dc95b4606c0074259f86ee9e9c + tag: v2.5.6-plugins@sha256:2cbae10931877edbebfa7f86488eb5017d1d3f6f50d81af099f348620d774ff3 securityContext: container: runAsNonRoot: false @@ -60,6 +60,40 @@ workload: SFTPGO_FTPD__PASSIVE_PORT_RANGE__END: "50100" SFTPGO_FTPD__PASSIVE_PORT_RANGE__START: "50000" SFTPGO_WEBDAVD__BINDINGS__0__PORT: "10080" + # plugins section + # each plugin will require couple more manual settings due to + # how they can each be combined differently. see docs on truecharts website + # ref - https://github.com/sftpgo/sftpgo-plugin-auth + SFTPGO_PLUGIN_AUTH_LDAP_URL: "ldap://192.168.1.5:389" + SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN: "dc=mylab,dc=local" + SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN: "cn=Administrator,cn=users,dc=mylab,dc=local" + SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD: "Password.123456" + SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY: "(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%))" + SFTPGO_PLUGIN_AUTH_LDAP_GROUP_ATTRIBUTES: "memberOf" + SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_SECONDARY_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_MEMBERSHIP_GROUP_PREFIX: "" + SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS: "" + SFTPGO_PLUGIN_AUTH_STARTTLS: "0" + SFTPGO_PLUGIN_AUTH_USERS_BASE_DIR: "/mnt/home" + SFTPGO_PLUGIN_AUTH_CACHE_TIME: 0 + SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY: "0" + SFTPGO_PLUGIN_AUTH_CA_CERTIFICATES: "" + # ref - https://github.com/sftpgo/sftpgo-plugin-eventsearch + SFTPGO_PLUGIN_EVENTSEARCH_DRIVER: "" + SFTPGO_PLUGIN_EVENTSEARCH_DSN: "" + # ref - https://github.com/sftpgo/sftpgo-plugin-eventstore + SFTPGO_PLUGIN_EVENTSTORE_DRIVER: "" + SFTPGO_PLUGIN_EVENTSTORE_DSN: "" + SFTPGO_PLUGIN_EVENTSTORE_INSTANCE_ID: "" + SFTPGO_PLUGIN_EVENTSTORE_RETENTION: "0" + # ref - https://github.com/sftpgo/sftpgo-plugin-geoipfilter + SFTPGO_PLUGIN_GEOIPFILTER_DB_FILE: "/mnt/database/geolite.db" + SFTPGO_PLUGIN_GEOIPFILTER_ALLOWED_COUNTRIES: "JP" + SFTPGO_PLUGIN_GEOIPFILTER_DENIED_COUNTRIES: "KP" + # ref - https://github.com/sftpgo/sftpgo-plugin-kms + # ref - https://github.com/sftpgo/sftpgo-plugin-pubsub + persistence: backupdirectory: enabled: true