From f14ac7d548a43969855f2489dabcb68e877804ad Mon Sep 17 00:00:00 2001 From: openclouders Date: Wed, 7 Oct 2026 00:08:45 +0000 Subject: [PATCH 1/2] Update docs with latest env vars --- docs/_static/env-vars/auth-guest.yaml | 62 ++++++++++ .../_static/env-vars/auth-guest_configvars.md | 38 ++++++ .../env-vars/auth-guest_deprecation.md | 0 docs/_static/env-vars/auth-guest_readme.md | 114 ++++++++++++++++++ docs/_static/env-vars/collaboration.yaml | 4 + .../env-vars/collaboration_configvars.md | 4 + docs/_static/env-vars/collaboration_readme.md | 11 ++ docs/_static/env-vars/frontend_configvars.md | 2 +- docs/_static/env-vars/frontend_readme.md | 5 - docs/_static/env-vars/gateway.yaml | 1 + docs/_static/env-vars/gateway_configvars.md | 1 + docs/_static/env-vars/global_configvars.md | 86 ++++++------- docs/_static/env-vars/proxy.yaml | 10 +- docs/_static/env-vars/proxy_configvars.md | 3 +- docs/_static/env-vars/proxy_readme.md | 31 ++++- docs/_static/env-vars/sharing_readme.md | 8 +- .../env-vars/storage-users_configvars.md | 2 +- docs/_static/env-vars/storage-users_readme.md | 49 +++++++- docs/_static/env-vars/web_configvars.md | 2 +- 19 files changed, 369 insertions(+), 64 deletions(-) create mode 100644 docs/_static/env-vars/auth-guest.yaml create mode 100644 docs/_static/env-vars/auth-guest_configvars.md create mode 100644 docs/_static/env-vars/auth-guest_deprecation.md create mode 100755 docs/_static/env-vars/auth-guest_readme.md diff --git a/docs/_static/env-vars/auth-guest.yaml b/docs/_static/env-vars/auth-guest.yaml new file mode 100644 index 000000000..c45b2f2bb --- /dev/null +++ b/docs/_static/env-vars/auth-guest.yaml @@ -0,0 +1,62 @@ +# Autogenerated +# Filename: auth-guest.yaml + +loglevel: error +debug: + addr: 127.0.0.1:9267 + token: "" + pprof: false + zpages: false +events: + disabled: false + endpoint: 127.0.0.1:9233 + cluster: opencloud-cluster + tls_insecure: false + tls_root_ca_certificate: "" + enable_tls: false + username: "" + password: "" +reva_gateway: eu.opencloud.api.gateway +grpc_client_tls: null +grpc: + addr: 127.0.0.1:9268 + tls: null + protocol: tcp +http: + disabled: false + addr: 127.0.0.1:9266 + root: /graph + cors: + allow_origins: + - '*' + allow_methods: + - GET + - POST + - PUT + - PATCH + - DELETE + allow_headers: + - Authorization + - Origin + - Content-Type + - Accept + - X-Requested-With + - X-Request-Id + - Ocs-Apirequest + allow_credentials: true + tls: + enabled: false + cert: "" + key: "" +storage: + root_directory: /var/lib/opencloud/auth-guest +token_manager: + jwt_secret: "" +jwt: + secret: "" + cookie_name: __Host-oc_guest_session + ttl: 24h0m0s +service_account: + service_account_id: "" + service_account_secret: "" +num_consumers: 1 diff --git a/docs/_static/env-vars/auth-guest_configvars.md b/docs/_static/env-vars/auth-guest_configvars.md new file mode 100644 index 000000000..ebd944d46 --- /dev/null +++ b/docs/_static/env-vars/auth-guest_configvars.md @@ -0,0 +1,38 @@ +## Environment variables for the **auth-guest** service + +| Name | Introduction Version | Type | Description | Default Value | +|---|---|---|---|:---| +|`OC_LOG_LEVEL`
`AUTH_GUEST_LOG_LEVEL`| next |string|`The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'.`|`"error"`| +|`AUTH_GUEST_DEBUG_ADDR`| next |string|`Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed.`|`"127.0.0.1:9267"`| +|`AUTH_GUEST_DEBUG_TOKEN`| next |string|`Token to secure the metrics endpoint.`|`""`| +|`AUTH_GUEST_DEBUG_PPROF`| next |bool|`Enables pprof, which can be used for profiling.`|`"false"`| +|`AUTH_GUEST_DEBUG_ZPAGES`| next |bool|`Enables zpages, which can be used for collecting and viewing in-memory traces.`|`"false"`| +|`AUTH_GUEST_EVENTS_DISABLED`| next |bool|`Disables listening for events. Set this to true if the service should only handle HTTP requests.`|`"false"`| +|`OC_EVENTS_ENDPOINT`| next |string|`The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture.`|`"127.0.0.1:9233"`| +|`OC_EVENTS_CLUSTER`| next |string|`The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system.`|`"opencloud-cluster"`| +|`OC_INSECURE`
`OC_EVENTS_TLS_INSECURE`| next |bool|`Whether to verify the server TLS certificates.`|`"false"`| +|`OC_EVENTS_TLS_ROOT_CA_CERTIFICATE`| next |string|`The root CA certificate used to validate the server's TLS certificate. If provided AUTH_GUEST_EVENTS_TLS_INSECURE will be seen as false.`|`""`| +|`OC_EVENTS_ENABLE_TLS`| next |bool|`Enable TLS for the connection to the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`"false"`| +|`OC_EVENTS_AUTH_USERNAME`| next |string|`The username to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`""`| +|`OC_EVENTS_AUTH_PASSWORD`| next |string|`The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`""`| +|`OC_REVA_GATEWAY`| next |string|`CS3 gateway used to look up user metadata`|`"eu.opencloud.api.gateway"`| +|`AUTH_GUEST_GRPC_ADDR`| next |string|`The bind address of the GRPC service.`|`"127.0.0.1:9268"`| +|`OC_GRPC_PROTOCOL`
`AUTH_GUEST_GRPC_PROTOCOL`| next |string|`The transport protocol of the GRPC service.`|`"tcp"`| +|`AUTH_GUEST_HTTP_DISABLED`| next |bool|`Disables the HTTP service. Set this to true if the service should only handle events.`|`"false"`| +|`AUTH_GUEST_HTTP_ADDR`| next |string|`The bind address of the HTTP service.`|`"127.0.0.1:9266"`| +|`AUTH_GUEST_HTTP_ROOT`| next |string|`Subdirectory that serves as the root for this HTTP service.`|`"/graph"`| +|`OC_CORS_ALLOW_ORIGINS`
`AUTH_GUEST_CORS_ALLOW_ORIGINS`| next |[]string|`A list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin. See the Environment Variable Types description for more details.`|`"[*]"`| +|`OC_CORS_ALLOW_METHODS`
`AUTH_GUEST_CORS_ALLOW_METHODS`| next |[]string|`A list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method. See the Environment Variable Types description for more details.`|`"[GET POST PUT PATCH DELETE]"`| +|`OC_CORS_ALLOW_HEADERS`
`AUTH_GUEST_CORS_ALLOW_HEADERS`| next |[]string|`A list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. See the Environment Variable Types description for more details.`|`"[Authorization Origin Content-Type Accept X-Requested-With X-Request-Id Ocs-Apirequest]"`| +|`OC_CORS_ALLOW_CREDENTIALS`
`AUTH_GUEST_CORS_ALLOW_CREDENTIALS`| next |bool|`Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials.`|`"true"`| +|`OC_HTTP_TLS_ENABLED`| 1.0.0 |bool|`Activates TLS for the http based services using the server certifcate and key configured via OC_HTTP_TLS_CERTIFICATE and OC_HTTP_TLS_KEY. If OC_HTTP_TLS_CERTIFICATE is not set a temporary server certificate is generated - to be used with PROXY_INSECURE_BACKEND=true.`|`"false"`| +|`OC_HTTP_TLS_CERTIFICATE`| 1.0.0 |string|`Path/File name of the TLS server certificate (in PEM format) for the http services.`|`""`| +|`OC_HTTP_TLS_KEY`| 1.0.0 |string|`Path/File name for the TLS certificate key (in PEM format) for the server certificate to use for the http services.`|`""`| +|`AUTH_GUEST_TOKENS_STORAGE_ROOT`| next |string|`The directory where the guest share tokens are stored. If not defined, the root directory derives from $OC_BASE_DATA_PATH/auth-guest.`|`"/var/lib/opencloud/auth-guest"`| +|`OC_JWT_SECRET`
`AUTH_GUEST_JWT_SECRET`| next |string|`The secret to mint and validate jwt tokens.`|`""`| +|`AUTH_GUEST_SESSION_JWT_SECRET`| next |string|`The secret used to sign and validate guest session tokens. It must differ from OC_JWT_SECRET.`|`""`| +|`AUTH_GUEST_JWT_COOKIE_NAME`| next |string|`The name of the session cookie set when a guest token is redeemed.`|`"__Host-oc_guest_session"`| +|`AUTH_GUEST_JWT_TTL`| next |Duration|`The lifetime of a redeemed guest session token.`|`"24h0m0s"`| +|`OC_SERVICE_ACCOUNT_ID`
`AUTH_GUEST_SERVICE_ACCOUNT_ID`| next |string|`The ID of the service account the service should use. See the 'auth-service' service description for more details.`|`""`| +|`OC_SERVICE_ACCOUNT_SECRET`
`AUTH_GUEST_SERVICE_ACCOUNT_SECRET`| next |string|`The service account secret.`|`""`| +|`AUTH_GUEST_NUM_CONSUMERS`| next |int|`The amount of concurrent event consumers to start. Event consumers are used for processing events. Multiple consumers increase parallelisation, but will also increase CPU and memory demands.`|`"1"`| diff --git a/docs/_static/env-vars/auth-guest_deprecation.md b/docs/_static/env-vars/auth-guest_deprecation.md new file mode 100644 index 000000000..e69de29bb diff --git a/docs/_static/env-vars/auth-guest_readme.md b/docs/_static/env-vars/auth-guest_readme.md new file mode 100755 index 000000000..5d2b0e6ce --- /dev/null +++ b/docs/_static/env-vars/auth-guest_readme.md @@ -0,0 +1,114 @@ + + +## Abstract + + +The `auth-guest` service gives guest users access to a share without a full +OpenCloud account. When a share is created for a user of type +`USER_TYPE_GUEST`, the service issues a one-time guest link token; redeeming +that token exchanges it for a signed session cookie that authenticates the +guest. + +It is disabled by default. Set `OC_ENABLE_GUEST_LINKS=true` to enable the guest +links feature and start the service. + + +## Table of Contents + +* [Overview](#overview) +* [Guest links flow](#guest-links-flow) +* [Token lifecycle](#token-lifecycle) +* [Configuration](#configuration) + +## Overview + +- **Consumes** the share lifecycle events `ShareCreated`, `ShareRemoved` and + `ShareExpired`. +- **Publishes** the `GuestTokenCreated` event carrying the guest link token, + so the link can be delivered to the guest. +- Exposes an unauthenticated endpoint that redeems the token and sets a + session cookie. +- Stores only hashes of the token and deletes the stored record when the share + is removed or expires. + +## Guest links flow + +The following sequence diagram describes the guest links flow: + +```mermaid +sequenceDiagram + autonumber + actor User as Guest user + participant Web as Web client + participant Redeem as Redeem endpoint + participant Proxy as OpenCloud proxy + participant Graph as Graph / sharedWithMe + participant DAV as WebDAV + participant Reva as Reva + + User->>Web: Open guest link with valid token + Web->>+Redeem: Redeem Token + Note right of Redeem: Validate Token + Redeem->>+Reva: Get Share + Reva->>-Redeem: Share + Note right of Redeem: Validate Share, Mark Token used + Redeem->>-Web: Set Cookie, return shareid + Note right of Web: HTTP only cookie with signed JWT (JWT lifetime 24h) + Web->>+Proxy: "/graph/me/drives/sharedWithMe" + Proxy->>+Reva: validate token extracted from JWT + Note right of Reva: Sign Reva Token for Guest User + Reva->>-Proxy: Authenticated + Proxy->>+Graph: "/graph/me/drives/sharedWithMe" + Note right of Proxy: Using Reva Token + Graph->>+Reva: Requests to ShareProvider + Reva->>-Graph: Shares + Graph->>-Proxy: driveItems (all shares for the Guest User) + Proxy->>-Web: driveItems + Note right of Web: Extracts driveItem for the specific share + Web->>+Proxy: PROPFIND (resource id extracted from driveItem) + Note right of Web: Using Cookie + Proxy->>+Reva: validate token extracted from JWT + Note right of Reva: Sign Reva Token for Guest User + Reva->>-Proxy: Authenticated + Proxy->>+DAV: PROPFIND + Note right of Proxy: Using Reva Token + DAV->>+Reva: Requests to StorageProvider + Reva->>-DAV: StorageProvider Responses + DAV->>-Proxy: PROPFIND Response + Proxy->>-Web: PROPFIND Response +``` + +## Token lifecycle + +1. **Issue** — on the consumed `ShareCreated` event, where the grantee is a + guest, the service generates a random secret and stores a record keyed by + the hash of the share id. It then publishes the `GuestTokenCreated` event + with the token. +2. **Redeem** — the guest posts the token to + `POST /graph/v1beta1/extensions/org.libregraph/guestLinks/redeem`. + The service validates the token and the share, marks the token as used + and returns a signed JWT session token in a cookie plus the share's + `permissionId` in the response body. Tokens are single-use. +3. **Cleanup** — on the consumed `ShareRemoved` or `ShareExpired` event, the + stored record is deleted. + +## Configuration + +The service is configured via `AUTH_GUEST_*` environment variables or a +`auth-guest.yaml` file. + +To run only the HTTP part, set `AUTH_GUEST_EVENTS_DISABLED=true`. To run only +the event consumer, set `AUTH_GUEST_HTTP_DISABLED=true`. + +Relevant options: + +- `AUTH_GUEST_SESSION_JWT_SECRET` — secret used to sign guest session tokens. + It must differ from `OC_JWT_SECRET`. +- `AUTH_GUEST_JWT_COOKIE_NAME`, `AUTH_GUEST_JWT_TTL` — session cookie name and + lifetime. +- `AUTH_GUEST_TOKENS_STORAGE_ROOT` — where guest link token records are stored. +- `AUTH_GUEST_SERVICE_ACCOUNT_ID`, `AUTH_GUEST_SERVICE_ACCOUNT_SECRET` — service + account used to query the gateway for share metadata. +- `AUTH_GUEST_NUM_CONSUMERS` — number of concurrent event consumers. +- `OC_REVA_GATEWAY` — CS3 gateway used to look up shares. + diff --git a/docs/_static/env-vars/collaboration.yaml b/docs/_static/env-vars/collaboration.yaml index 2af0d7320..5ff96e45c 100644 --- a/docs/_static/env-vars/collaboration.yaml +++ b/docs/_static/env-vars/collaboration.yaml @@ -12,9 +12,11 @@ app: disable: false duration: 12h licensecheckenable: false + product_edition: "" font: asset_path: /var/lib/opencloud/collaboration/fonts preview_text: OpenCloud + base_url: "" store: store: nats-js-kv nodes: @@ -45,6 +47,8 @@ wopi: proxy_url: "" proxy_secret: "" short_tokens: false + enable_mobile: false + disabled_extensions: [] cs3api: gateway: name: eu.opencloud.api.gateway diff --git a/docs/_static/env-vars/collaboration_configvars.md b/docs/_static/env-vars/collaboration_configvars.md index 77d75a4c5..74671b85d 100644 --- a/docs/_static/env-vars/collaboration_configvars.md +++ b/docs/_static/env-vars/collaboration_configvars.md @@ -12,8 +12,10 @@ |`COLLABORATION_APP_PROOF_DISABLE`| 1.0.0 |bool|`Disable the proof keys verification`|`"false"`| |`COLLABORATION_APP_PROOF_DURATION`| 1.0.0 |string|`Duration for the proof keys to be cached in memory, using time.ParseDuration format. If the duration can't be parsed, we'll use the default 12h as duration`|`"12h"`| |`COLLABORATION_APP_LICENSE_CHECK_ENABLE`| 1.0.0 |bool|`Enable license checking to edit files. Needs to be enabled when using Microsoft365 with the business flow.`|`"false"`| +|`COLLABORATION_APP_PRODUCT_EDITION`| 8.1.0 |string|`The edition of the WebOffice app, it decides which features the app offers. Only used for EuroOffice, where 'ce', 'de' and 'ee' are supported and an empty value is the same as 'ce'.`|`""`| |`COLLABORATION_FONT_ASSET_PATH`| 7.3.0 |string|`Serve fonts from a path on the filesystem instead of the builtin assets. If not defined, the root directory derives from $OC_BASE_DATA_PATH/collaboration/fonts`|`"/var/lib/opencloud/collaboration/fonts"`| |`COLLABORATION_FONT_PREVIEW_TEXT`| 7.3.0 |string|`The text that will be displayed in the font preview.`|`"OpenCloud"`| +|`COLLABORATION_FONT_BASE_URL`| 7.3.0 |string|`The base URL under which the font files are served. It must match the URL configured in the remote_font_config of the office suite. If not set, it defaults to $OC_URL/collaboration/fonts`|`""`| |`OC_PERSISTENT_STORE`
`COLLABORATION_STORE`| 1.0.0 |string|`The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details.`|`"nats-js-kv"`| |`OC_PERSISTENT_STORE_NODES`
`COLLABORATION_STORE_NODES`| 1.0.0 |[]string|`A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details.`|`"[127.0.0.1:9233]"`| |`COLLABORATION_STORE_DATABASE`| 1.0.0 |string|`The database name the configured store should use.`|`"collaboration"`| @@ -37,6 +39,8 @@ |`COLLABORATION_WOPI_PROXY_URL`| 1.0.0 |string|`The URL to the OpenCloud WOPI proxy. Optional. To use this feature, you need an office365 proxy subscription. If you become part of the Microsoft CSP program (\https://learn.microsoft.com/en-us/partner-center/enroll/csp-overview), you can use WebOffice without a proxy.`|`""`| |`COLLABORATION_WOPI_PROXY_SECRET`| 1.0.0 |string|`Optional, the secret to authenticate against the OpenCloud WOPI proxy. This secret can be obtained from OpenCloud via the office365 proxy subscription.`|`""`| |`COLLABORATION_WOPI_SHORTTOKENS`| 1.0.0 |bool|`Use short access tokens for WOPI access. This is useful for office packages, like Microsoft Office Online, which have URL length restrictions. If enabled, a persistent store must be configured.`|`"false"`| +|`COLLABORATION_WOPI_ENABLE_MOBILE`| 8.1.0 |bool|`Enable the mobile web view of the office web frontend. This feature applies to EuroOffice, where the product edition decides whether it covers editing as well.`|`"false"`| +|`COLLABORATION_WOPI_DISABLED_EXTENSIONS`| 8.1.0 |[]string|`A comma separated list of file extensions the office web frontend must not offer, for example 'docx,xlsx'. Extensions are matched case-insensitively, with or without the leading dot.`|`"[]"`| |`OC_REVA_GATEWAY`| 1.0.0 |string|`CS3 gateway used to look up user metadata.`|`"eu.opencloud.api.gateway"`| |`COLLABORATION_CS3API_DATAGATEWAY_INSECURE`| 1.0.0 |bool|`Connect to the CS3API data gateway insecurely.`|`"false"`| |`COLLABORATION_CS3API_APP_REGISTRATION_INTERVAL`| 4.0.0 |Duration|`The interval at which the app provider registers itself.`|`"30s"`| diff --git a/docs/_static/env-vars/collaboration_readme.md b/docs/_static/env-vars/collaboration_readme.md index 79e769690..dd61069f3 100755 --- a/docs/_static/env-vars/collaboration_readme.md +++ b/docs/_static/env-vars/collaboration_readme.md @@ -42,6 +42,9 @@ There are a few variables that you need to set: The product name of the connected WebOffice app, which can be one of the following:\ `Collabora`, `OnlyOffice`, `Microsoft365` or `MicrosoftOfficeOnline`. This is used to internally control the behavior according to the different features of the used products. +* `COLLABORATION_APP_PRODUCT_EDITION`:\ + The edition of the connected WebOffice app, it decides which features the app offers. Only used for EuroOffice, which supports `ce` (community edition), `de` (developer edition) and `ee` (enterprise edition). An empty value is the same as `ce`. + * `COLLABORATION_APP_ADDR`:\ The URL of the collaborative editing app (onlyoffice, collabora, etc).\ For example: `https://office.example.com`. @@ -56,6 +59,14 @@ There are a few variables that you need to set: * `COLLABORATION_WOPI_SHORTTOKENS`:\ Needs to be set if the office application like `Microsoft Office Online` complains about the URL is too long (which contains the access token) and refuses to work. If enabled, a store must be configured. +* `COLLABORATION_WOPI_ENABLE_MOBILE`:\ + Enables the mobile web view of the office web frontend. Only applies to EuroOffice. `ce` offers the mobile view for reading only, `de` and `ee` also for editing, so set `COLLABORATION_APP_PRODUCT_EDITION` accordingly. + +* `COLLABORATION_WOPI_DISABLED_EXTENSIONS`:\ + A comma separated list of file extensions the app must not offer, even though the document server announces them.\ + The webUI offers no editor of this app for them and opening such a file with it fails.\ + For example: `COLLABORATION_WOPI_DISABLED_EXTENSIONS=docx,xlsx,pptx`. + The application can be customized further by changing the `COLLABORATION_APP_*` options to better describe the application. ## Storing diff --git a/docs/_static/env-vars/frontend_configvars.md b/docs/_static/env-vars/frontend_configvars.md index 8489ce280..c5b0f68cf 100644 --- a/docs/_static/env-vars/frontend_configvars.md +++ b/docs/_static/env-vars/frontend_configvars.md @@ -1,5 +1,5 @@ -2026-09-17-06-05-59 +2026-10-07-00-08-40 ## Deprecation Notice diff --git a/docs/_static/env-vars/frontend_readme.md b/docs/_static/env-vars/frontend_readme.md index ab639c1ba..dcd949e8c 100755 --- a/docs/_static/env-vars/frontend_readme.md +++ b/docs/_static/env-vars/frontend_readme.md @@ -18,7 +18,6 @@ The frontend service translates various OpenCloud related HTTP APIs to CS3 reque * [Scalability](#scalability) * [Define Read-Only Attributes](#define-readonly-attributes) * [Caching](#caching) - * [Auto-Accept Shares](#autoaccept-shares) * [Passwords](#passwords) * [The Password Policy](#the-password-policy) * [The Password Policy Capability](#the-password-policy-capability) @@ -86,10 +85,6 @@ Store specific notes: - When using `nats-js-kv` it is recommended to set `OC_CACHE_STORE_NODES` to the same value as `OC_EVENTS_ENDPOINT`. That way the cache uses the same nats instance as the event bus. - When using the `nats-js-kv` store, it is possible to set `OC_CACHE_DISABLE_PERSISTENCE` to instruct nats to not persist cache data on disc. -### Auto-Accept Shares - -When setting the `SHARING_AUTO_ACCEPT_SHARES` to `true` (sharing service), all incoming shares will be accepted automatically. Users can overwrite this setting individually in their profile. The deprecated `FRONTEND_AUTO_ACCEPT_SHARES` is still supported for backwards compatibility. - ## Passwords ### The Password Policy diff --git a/docs/_static/env-vars/gateway.yaml b/docs/_static/env-vars/gateway.yaml index 0dcea85e4..f48ec982f 100644 --- a/docs/_static/env-vars/gateway.yaml +++ b/docs/_static/env-vars/gateway.yaml @@ -55,6 +55,7 @@ auth_basic_endpoint: eu.opencloud.api.auth-basic auth_bearer_endpoint: "" auth_machine_endpoint: eu.opencloud.api.auth-machine auth_service_endpoint: eu.opencloud.api.auth-service +auth_guestlinks_endpoint: eu.opencloud.api.auth-guest storage_public_link_endpoint: eu.opencloud.api.storage-publiclink storage_users_endpoint: eu.opencloud.api.storage-users storage_shares_endpoint: eu.opencloud.api.storage-shares diff --git a/docs/_static/env-vars/gateway_configvars.md b/docs/_static/env-vars/gateway_configvars.md index 6f379f079..37c95db0e 100644 --- a/docs/_static/env-vars/gateway_configvars.md +++ b/docs/_static/env-vars/gateway_configvars.md @@ -47,6 +47,7 @@ |`GATEWAY_AUTH_BEARER_ENDPOINT`| 1.0.0 |string|`The endpoint of the auth-bearer service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`""`| |`GATEWAY_AUTH_MACHINE_ENDPOINT`| 1.0.0 |string|`The endpoint of the auth-machine service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.auth-machine"`| |`GATEWAY_AUTH_SERVICE_ENDPOINT`| 1.0.0 |string|`The endpoint of the auth-service service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.auth-service"`| +|`GATEWAY_AUTH_GUESTLINKS_ENDPOINT`| next |string|`The endpoint of the auth-guestlinks service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.auth-guest"`| |`GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT`| 1.0.0 |string|`The endpoint of the storage-publiclink service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.storage-publiclink"`| |`GATEWAY_STORAGE_USERS_ENDPOINT`| 1.0.0 |string|`The endpoint of the storage-users service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.storage-users"`| |`GATEWAY_STORAGE_SHARES_ENDPOINT`| 1.0.0 |string|`The endpoint of the storage-shares service. Can take a service name or a gRPC URI with the dns, kubernetes or unix protocol.`|`"eu.opencloud.api.storage-shares"`| diff --git a/docs/_static/env-vars/global_configvars.md b/docs/_static/env-vars/global_configvars.md index 06143989f..3e57973e8 100644 --- a/docs/_static/env-vars/global_configvars.md +++ b/docs/_static/env-vars/global_configvars.md @@ -2,36 +2,36 @@ | Name | Introduction Version | Type | Description | Default Value | |---|---|---|---|---| -| `FRONTEND_AUTO_ACCEPT_SHARES` | 8.0.0 | bool | Defines if shares should be auto accepted by default. Users can change this setting individually in their profile. | "true" | -| `FRONTEND_MAX_CONCURRENCY` | 8.0.0 | int | Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used. | "1" | +| `FRONTEND_AUTO_ACCEPT_SHARES` | 1.0.0 | bool | Defines if shares should be auto accepted by default. Users can change this setting individually in their profile. | "false" | +| `FRONTEND_MAX_CONCURRENCY` | 1.0.0 | int | Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used. | "0" | | `IDM_CREATE_DEMO_USERS` | 1.0.0 | bool | Flag to enable or disable the creation of the demo users. | "false" | | `OC_ADMIN_USER_ID` | 1.0.0 | string | ID of the user that should receive admin privileges. Consider that the UUID can be encoded in some LDAP deployment configurations like in .ldif files. These need to be decoded beforehand. | "" | | `OC_ASYNC_UPLOADS` | 1.0.0 | bool | Enable asynchronous file uploads. | "true" | -| `OC_CACHE_AUTH_PASSWORD` | 1.0.0 | string | Password for the configured store. Only applies when store type 'nats-js-kv' is configured. | "" | -| `OC_CACHE_AUTH_USERNAME` | 1.0.0 | string | Username for the configured store. Only applies when store type 'nats-js-kv' is configured. | "" | -| `OC_CACHE_DATABASE` | 1.0.0 | string | The database name the configured store should use. | "storage-system" | -| `OC_CACHE_DISABLE_PERSISTENCE` | 1.0.0 | bool | Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false. | "false" | +| `OC_CACHE_AUTH_PASSWORD` | 1.0.0 | string | The password to use for authentication. Only applies when using the 'nats-js-kv' store type. | "" | +| `OC_CACHE_AUTH_USERNAME` | 1.0.0 | string | The username to use for authentication. Only applies when using the 'nats-js-kv' store type. | "" | +| `OC_CACHE_DATABASE` | 1.0.0 | string | The database name the configured store should use. | "cache-stat" | +| `OC_CACHE_DISABLE_PERSISTENCE` | 1.0.0 | bool | Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false. | "false" | | `OC_CACHE_ENABLE_TLS` | 7.3.0 | bool | Enable TLS for the connection to file metadata cache. | "false" | | `OC_CACHE_STORE` | 1.0.0 | string | The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details. | "memory" | | `OC_CACHE_STORE_NODES` | 1.0.0 | []string | A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details. | "[127.0.0.1:9233]" | | `OC_CACHE_TLS_INSECURE` | 7.3.0 | bool | Whether to verify the server TLS certificates. | "false" | -| `OC_CACHE_TLS_ROOT_CA_CERTIFICATE` | 7.3.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_SYSTEM_CACHE_TLS_INSECURE will be seen as false. | "" | -| `OC_CACHE_TTL` | 1.0.0 | Duration | Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details. | "24h0m0s" | -| `OC_CORS_ALLOW_CREDENTIALS` | 1.0.0 | bool | Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials. | "true" | -| `OC_CORS_ALLOW_HEADERS` | 1.0.0 | []string | A list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. See the Environment Variable Types description for more details. | "[Authorization Origin Content-Type Accept X-Requested-With X-Request-Id Ocs-Apirequest]" | -| `OC_CORS_ALLOW_METHODS` | 1.0.0 | []string | A list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method. See the Environment Variable Types description for more details. | "[GET]" | -| `OC_CORS_ALLOW_ORIGINS` | 1.0.0 | []string | A list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin. See the Environment Variable Types description for more details. | "[*]" | +| `OC_CACHE_TLS_ROOT_CA_CERTIFICATE` | 7.3.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided FRONTEND_OCS_STAT_CACHE_TLS_INSECURE will be seen as false. | "" | +| `OC_CACHE_TTL` | 1.0.0 | Duration | Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details. | "5m0s" | +| `OC_CORS_ALLOW_CREDENTIALS` | 1.0.0 | bool | Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials. | "false" | +| `OC_CORS_ALLOW_HEADERS` | 1.0.0 | []string | A list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. See the Environment Variable Types description for more details. | "[]" | +| `OC_CORS_ALLOW_METHODS` | 1.0.0 | []string | A list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method. See the Environment Variable Types description for more details. | "[]" | +| `OC_CORS_ALLOW_ORIGINS` | 1.0.0 | []string | A list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin. See the Environment Variable Types description for more details. | "[https://localhost:9200]" | | `OC_DECOMPOSEDFS_PROPAGATOR` | 1.0.0 | string | The propagator used for decomposedfs. At the moment, only 'sync' is fully supported, 'async' is available as an experimental option. | "sync" | -| `OC_DEFAULT_LANGUAGE` | 1.0.0 | string | The default language used by services and the WebUI. If not defined, English will be used as default. See the documentation for more details. | "" | +| `OC_DEFAULT_LANGUAGE` | 1.0.0 | string | The default language used by services and the WebUI. If not defined, English will be used as default. See the documentation for more details. | "en" | | `OC_DISABLE_VERSIONING` | 1.0.0 | bool | Disables versioning of files. When set to true, new uploads with the same filename will overwrite existing files instead of creating a new version. | "false" | -| `OC_ENABLE_OCM` | 1.0.0 | bool | Include OCM sharees when listing users. | "false" | +| `OC_ENABLE_OCM` | 1.0.0 | bool | Changing this value is NOT supported. Enables support for incoming federated sharing for clients. The backend behaviour is not changed. | "false" | | `OC_EVENTS_AUTH_PASSWORD` | 1.0.0 | string | The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services. | "" | | `OC_EVENTS_AUTH_USERNAME` | 1.0.0 | string | The username to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services. | "" | | `OC_EVENTS_CLUSTER` | 1.0.0 | string | The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system. | "opencloud-cluster" | | `OC_EVENTS_ENABLE_TLS` | 1.0.0 | bool | Enable TLS for the connection to the events broker. The events broker is the OpenCloud service which receives and delivers events between the services. | "false" | | `OC_EVENTS_ENDPOINT` | 1.0.0 | string | The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. | "127.0.0.1:9233" | -| `OC_EVENTS_TLS_INSECURE` | 1.0.0 | bool | Whether to verify the server TLS certificates. | "false" | -| `OC_EVENTS_TLS_ROOT_CA_CERTIFICATE` | 1.0.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_EVENTS_TLS_INSECURE will be seen as false. | "" | +| `OC_EVENTS_TLS_INSECURE` | 1.0.0 | bool | Whether the server should skip the client certificate verification during the TLS handshake. | "false" | +| `OC_EVENTS_TLS_ROOT_CA_CERTIFICATE` | 1.0.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided POLICIES_EVENTS_TLS_INSECURE will be seen as false. | "" | | `OC_GATEWAY_GRPC_ADDR` | 1.0.0 | string | The bind address of the GRPC service. | "127.0.0.1:9142" | | `OC_GRPC_CLIENT_TLS_CACERT` | 1.0.0 | string | Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services. | "" | | `OC_GRPC_CLIENT_TLS_MODE` | 1.0.0 | string | TLS mode for grpc connection to the go-micro based grpc services. Possible values are 'off', 'insecure' and 'on'. 'off': disables transport security for the clients. 'insecure' allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). 'on' enables transport security, including server certificate verification. | "" | @@ -39,10 +39,10 @@ | `OC_HTTP_TLS_CERTIFICATE` | 1.0.0 | string | Path/File name of the TLS server certificate (in PEM format) for the http services. | "" | | `OC_HTTP_TLS_ENABLED` | 1.0.0 | bool | Activates TLS for the http based services using the server certifcate and key configured via OC_HTTP_TLS_CERTIFICATE and OC_HTTP_TLS_KEY. If OC_HTTP_TLS_CERTIFICATE is not set a temporary server certificate is generated - to be used with PROXY_INSECURE_BACKEND=true. | "false" | | `OC_HTTP_TLS_KEY` | 1.0.0 | string | Path/File name for the TLS certificate key (in PEM format) for the server certificate to use for the http services. | "" | -| `OC_INSECURE` | 1.0.0 | bool | Whether to verify the server TLS certificates. | "false" | +| `OC_INSECURE` | 1.0.0 | bool | Whether the server should skip the client certificate verification during the TLS handshake. | "false" | | `OC_JWT_SECRET` | 1.0.0 | string | The secret to mint and validate jwt tokens. | "" | | `OC_KEYCLOAK_BASE_PATH` | 1.0.0 | string | The URL to access keycloak. | "" | -| `OC_KEYCLOAK_CLIENT_ID` | 1.0.0 | string | The client id to authenticate with keycloak. | "" | +| `OC_KEYCLOAK_CLIENT_ID` | 1.0.0 | string | The client ID to authenticate with keycloak. | "" | | `OC_KEYCLOAK_CLIENT_REALM` | 1.0.0 | string | The realm the client is defined in. | "" | | `OC_KEYCLOAK_CLIENT_SECRET` | 1.0.0 | string | The client secret to use in authentication. | "" | | `OC_KEYCLOAK_INSECURE_SKIP_VERIFY` | 1.0.0 | bool | Disable TLS certificate validation for Keycloak connections. Do not set this in production environments. | "false" | @@ -57,33 +57,33 @@ | `OC_LDAP_GROUP_OBJECTCLASS` | 1.0.0 | string | The object class to use for groups in the default group search filter ('groupOfNames'). | "groupOfNames" | | `OC_LDAP_GROUP_SCHEMA_DISPLAYNAME` | 1.0.0 | string | LDAP Attribute to use for the displayname of groups (often the same as groupname attribute). | "cn" | | `OC_LDAP_GROUP_SCHEMA_GROUPNAME` | 1.0.0 | string | LDAP Attribute to use for the name of groups. | "cn" | -| `OC_LDAP_GROUP_SCHEMA_ID` | 1.0.0 | string | LDAP Attribute to use as the unique id for groups. This should be a stable globally unique ID like a UUID. | "openCloudUUID" | -| `OC_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING` | 1.0.0 | bool | Set this to true if the defined 'id' attribute for groups is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the group ID's. | "false" | +| `OC_LDAP_GROUP_SCHEMA_ID` | 1.0.0 | string | LDAP Attribute to use as the unique id for groups. This should be a stable globally unique id (e.g. a UUID). | "openCloudUUID" | +| `OC_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING` | 1.0.0 | bool | Set this to true if the defined 'id' attribute for groups is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the group IDs. | "false" | | `OC_LDAP_GROUP_SCHEMA_MAIL` | 1.0.0 | string | LDAP Attribute to use for the email address of groups (can be empty). | "mail" | | `OC_LDAP_GROUP_SCHEMA_MEMBER` | 1.0.0 | string | LDAP Attribute that is used for group members. | "member" | -| `OC_LDAP_GROUP_SCOPE` | 1.0.0 | string | LDAP search scope to use when looking up groups. Supported scopes are 'base', 'one' and 'sub'. | "sub" | +| `OC_LDAP_GROUP_SCOPE` | 1.0.0 | string | LDAP search scope to use when looking up groups. Supported values are 'base', 'one' and 'sub'. | "sub" | | `OC_LDAP_INSECURE` | 1.0.0 | bool | Disable TLS certificate validation for the LDAP connections. Do not set this in production environments. | "false" | | `OC_LDAP_LOOKUP_CACHE_TTL` | 7.5.0 | Duration | The time to live for the in-memory cache of LDAP lookups. This cache is used to reduce the number of LDAP queries for user and group lookups. | "10s" | | `OC_LDAP_SERVER_WRITE_ENABLED` | 1.0.0 | bool | Allow creating, modifying and deleting LDAP users via the GRAPH API. This can only be set to 'true' when keeping default settings for the LDAP user and group attribute types (the 'OC_LDAP_USER_SCHEMA_* and 'OC_LDAP_GROUP_SCHEMA_* variables). | "true" | | `OC_LDAP_URI` | 1.0.0 | string | URI of the LDAP Server to connect to. Supported URI schemes are 'ldaps://' and 'ldap://' | "ldap://localhost:9236" | | `OC_LDAP_USER_BASE_DN` | 1.0.0 | string | Search base DN for looking up LDAP users. | "ou=users,o=libregraph-idm" | -| `OC_LDAP_USER_ENABLED_ATTRIBUTE` | 1.0.0 | string | LDAP Attribute to use as a flag telling if the user is enabled or disabled. | "openCloudUserEnabled" | +| `OC_LDAP_USER_ENABLED_ATTRIBUTE` | 1.0.0 | string | LDAP attribute to use as a flag telling if the user is enabled or disabled. | "openCloudUserEnabled" | | `OC_LDAP_USER_FILTER` | 1.0.0 | string | LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'. | "" | | `OC_LDAP_USER_OBJECTCLASS` | 1.0.0 | string | The object class to use for users in the default user search filter ('inetOrgPerson'). | "inetOrgPerson" | | `OC_LDAP_USER_SCHEMA_DISPLAYNAME` | 1.0.0 | string | LDAP Attribute to use for the displayname of users. | "displayname" | -| `OC_LDAP_USER_SCHEMA_ID` | 1.0.0 | string | LDAP Attribute to use as the unique id for users. This should be a stable globally unique id like a UUID. | "openCloudUUID" | -| `OC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING` | 1.0.0 | bool | Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the user ID's. | "false" | +| `OC_LDAP_USER_SCHEMA_ID` | 1.0.0 | string | LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID. | "openCloudUUID" | +| `OC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING` | 1.0.0 | bool | Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the user IDs. | "false" | | `OC_LDAP_USER_SCHEMA_MAIL` | 1.0.0 | string | LDAP Attribute to use for the email address of users. | "mail" | | `OC_LDAP_USER_SCHEMA_TENANT_ID` | 4.0.0 | string | LDAP Attribute to use for the tenant ID of users. This is used to identify the tenant of a user in a multi-tenant environment. | "" | | `OC_LDAP_USER_SCHEMA_USERNAME` | 1.0.0 | string | LDAP Attribute to use for username of users. | "uid" | | `OC_LDAP_USER_SCHEMA_USER_TYPE` | 1.0.0 | string | LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'openCloudUserType'. | "openCloudUserType" | -| `OC_LDAP_USER_SCOPE` | 1.0.0 | string | LDAP search scope to use when looking up users. Supported scopes are 'base', 'one' and 'sub'. | "sub" | +| `OC_LDAP_USER_SCOPE` | 1.0.0 | string | LDAP search scope to use when looking up users. Supported values are 'base', 'one' and 'sub'. | "sub" | | `OC_LOG_LEVEL` | 1.0.0 | string | The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'. | "error" | -| `OC_MACHINE_AUTH_API_KEY` | 1.0.0 | string | Machine auth API key used to validate internal requests necessary for the access to resources from other services. | "" | -| `OC_MAX_CONCURRENCY` | 8.0.0 | int | Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used. | "1" | +| `OC_MACHINE_AUTH_API_KEY` | 1.0.0 | string | The machine auth API key used to validate internal requests necessary to access resources from other services. | "" | +| `OC_MAX_CONCURRENCY` | 1.0.0 | int | Maximum number of concurrent go-routines. Higher values can potentially get work done faster but will also cause more load on the system. Values of 0 or below will be ignored and the default value will be used. | "0" | | `OC_OIDC_CLIENT_ID` | 1.0.0 | string | The OIDC client ID which OpenCloud Web uses. This client needs to be set up in your IDP. Note that this setting has no effect when using the builtin IDP. | "web" | | `OC_OIDC_CLIENT_SCOPES` | 6.0.0 | []string | The OIDC client scopes the Android app should request. | "[openid profile email offline_access]" | -| `OC_OIDC_ISSUER` | 1.0.0 | string | The identity provider value to set in the group IDs of the CS3 group objects for groups returned by this group provider. | "https://localhost:9200" | +| `OC_OIDC_ISSUER` | 1.0.0 | string | URL of the OIDC issuer. It defaults to URL of the builtin IDP. | "https://localhost:9200" | | `OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST` | 1.0.0 | string | Path to the 'banned passwords list' file. This only impacts public link password validation. See the documentation for more details. | "" | | `OC_PASSWORD_POLICY_DISABLED` | 1.0.0 | bool | Disable the password policy. Defaults to false if not set. | "false" | | `OC_PASSWORD_POLICY_MIN_CHARACTERS` | 1.0.0 | int | Define the minimum password length. Defaults to 8 if not set. | "8" | @@ -92,31 +92,31 @@ | `OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS` | 1.0.0 | int | Define the minimum number of characters from the special characters list to be present. Defaults to 1 if not set. | "1" | | `OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS` | 1.0.0 | int | Define the minimum number of lowercase letters. Defaults to 1 if not set. | "1" | | `OC_PERSISTENT_STORE` | 1.0.0 | string | The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details. | "nats-js-kv" | -| `OC_PERSISTENT_STORE_AUTH_PASSWORD` | 1.0.0 | string | The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured. | "" | -| `OC_PERSISTENT_STORE_AUTH_USERNAME` | 1.0.0 | string | The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured. | "" | -| `OC_PERSISTENT_STORE_ENABLE_TLS` | 7.3.0 | bool | Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured. | "false" | -| `OC_PERSISTENT_STORE_NODES` | 1.0.0 | []string | A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details. | "[127.0.0.1:9233]" | -| `OC_PERSISTENT_STORE_TLS_INSECURE` | 7.3.0 | bool | Whether to verify the server TLS certificates. | "false" | -| `OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE` | 7.3.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_STORE_TLS_INSECURE will be seen as false. | "" | -| `OC_PERSISTENT_STORE_TTL` | 1.0.0 | Duration | Time to live for notifications in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details. | "336h0m0s" | +| `OC_PERSISTENT_STORE_AUTH_PASSWORD` | 7.4.0 | string | The password to authenticate with the store. | "" | +| `OC_PERSISTENT_STORE_AUTH_USERNAME` | 7.4.0 | string | The username to authenticate with the store. | "" | +| `OC_PERSISTENT_STORE_ENABLE_TLS` | 7.4.0 | bool | Enable TLS for the connection to the store. | "false" | +| `OC_PERSISTENT_STORE_NODES` | 7.4.0 | []string | A list of nodes to access the NATS JetStream store. See the Environment Variable Types description for more details. | "[127.0.0.1:9233]" | +| `OC_PERSISTENT_STORE_TLS_INSECURE` | 7.4.0 | bool | Whether to verify the server TLS certificates. | "false" | +| `OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE` | 7.4.0 | string | The root CA certificate used to validate the server's TLS certificate. If provided WEB_STORE_TLS_INSECURE will be seen as false. | "" | +| `OC_PERSISTENT_STORE_TTL` | 1.0.0 | Duration | Time to live for events in the store. See the Environment Variable Types description for more details. | "0s" | | `OC_REVA_GATEWAY` | 1.0.0 | string | The CS3 gateway endpoint. | "eu.opencloud.api.gateway" | | `OC_SERVICE_ACCOUNT_ID` | 1.0.0 | string | The ID of the service account the service should use. See the 'auth-service' service description for more details. | "" | | `OC_SERVICE_ACCOUNT_SECRET` | 1.0.0 | string | The service account secret. | "" | | `OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD` | 1.0.0 | bool | Set this to true if you want to enforce passwords on all public shares. | "true" | -| `OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD` | 1.0.0 | bool | Set this to true if you want to enforce passwords on Uploader, Editor or Contributor shares. If not using the global OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD, you must define the FRONTEND_OCS_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD (deprecated) in the frontend service. | "false" | +| `OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD` | 1.0.0 | bool | Set this to true if you want to enforce passwords for writable shares. Only effective if the setting for 'passwords on all public shares' is set to false. | "false" | | `OC_SHOW_USER_EMAIL_IN_RESULTS` | 1.0.0 | bool | Include user email addresses in responses. If absent or set to false emails will be omitted from results. Please note that admin users can always see all email addresses. | "false" | -| `OC_SPACES_MAX_QUOTA` | 1.0.0 | uint64 | Set a global max quota for spaces in bytes. A value of 0 equals unlimited. If not using the global OC_SPACES_MAX_QUOTA, you must define the FRONTEND_MAX_QUOTA in the frontend service. | "0" | -| `OC_SYSTEM_USER_API_KEY` | 1.0.0 | string | API key for the STORAGE-SYSTEM system user. | "" | -| `OC_SYSTEM_USER_ID` | 1.0.0 | string | ID of the OpenCloud storage-system system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format. | "" | +| `OC_SPACES_MAX_QUOTA` | 1.0.0 | uint64 | Set the global max quota value in bytes. A value of 0 equals unlimited. The value is provided via capabilities. | "0" | +| `OC_SYSTEM_USER_API_KEY` | 4.0.0 | string | API key for the STORAGE-SYSTEM system user. | "" | +| `OC_SYSTEM_USER_ID` | 4.0.0 | string | ID of the OpenCloud STORAGE-SYSTEM system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format. | "" | | `OC_SYSTEM_USER_IDP` | 4.0.0 | string | IDP of the OpenCloud STORAGE-SYSTEM system user. | "internal" | -| `OC_TRANSFER_SECRET` | 7.5.0 | string | The storage transfer secret. | "" | +| `OC_TRANSFER_SECRET` | 1.0.0 | string | Transfer secret for signing file up- and download requests. | "" | | `OC_TRANSLATION_PATH` | 1.0.0 | string | (optional) Set this to a path with custom translations to overwrite the builtin translations. Note that file and folder naming rules apply, see the documentation for more details. | "" | -| `OC_URL` | 1.0.0 | string | The identity provider value to set in the group IDs of the CS3 group objects for groups returned by this group provider. | "https://localhost:9200" | +| `OC_URL` | 1.0.0 | string | Base URL to load themes from. Will be prepended to the theme path. | "https://localhost:9200" | | `OC_WOPI_DISABLE_CHAT` | 1.0.0 | bool | Disable chat in the office web frontend. This feature applies to OnlyOffice and Microsoft. | "false" | | `SEARCH_EVENTS_ACK_WAIT` | 4.0.0 | Duration | The time to wait for an ack before the message is redelivered. This is used to ensure that messages are not lost if the consumer crashes. | "1m0s" | | `SEARCH_EVENTS_MAX_ACK_PENDING` | 4.0.0 | int | The maximum number of unacknowledged messages. This is used to limit the number of messages that can be in flight at the same time. | "1000" | -| `STORAGE_GATEWAY_GRPC_ADDR` | 1.0.0 | string | GRPC address of the STORAGE-SYSTEM service. | "eu.opencloud.api.storage-system" | -| `STORAGE_GRPC_ADDR` | 1.0.0 | string | GRPC address of the STORAGE-SYSTEM service. | "eu.opencloud.api.storage-system" | +| `STORAGE_GATEWAY_GRPC_ADDR` | 4.0.0 | string | GRPC address of the STORAGE-SYSTEM service. | "eu.opencloud.api.storage-system" | +| `STORAGE_GRPC_ADDR` | 4.0.0 | string | GRPC address of the STORAGE-SYSTEM service. | "eu.opencloud.api.storage-system" | | `STORAGE_USERS_ASYNC_PROPAGATOR_PROPAGATION_DELAY` | 1.0.0 | Duration | The delay between a change made to a tree and the propagation start on treesize and treetime. Multiple propagations are computed to a single one. See the Environment Variable Types description for more details. | "0s" | | `STORAGE_USERS_PERMISSION_ENDPOINT` | 1.0.0 | string | Endpoint of the permissions service. The endpoints can differ for 'decomposed' and 'decomposeds3'. | "eu.opencloud.api.settings" | | `WEB_OIDC_CLIENT_ID` | 1.0.0 | string | The OIDC client ID which OpenCloud Web uses. This client needs to be set up in your IDP. Note that this setting has no effect when using the builtin IDP. | "web" | diff --git a/docs/_static/env-vars/proxy.yaml b/docs/_static/env-vars/proxy.yaml index b6d4605af..b796feea6 100644 --- a/docs/_static/env-vars/proxy.yaml +++ b/docs/_static/env-vars/proxy.yaml @@ -150,6 +150,10 @@ policies: - endpoint: /graph/v1.0/invitations service: eu.opencloud.web.invitations skip_x_access_token: false + - endpoint: /graph/v1beta1/extensions/org.libregraph/guestLinks + service: eu.opencloud.web.auth-guest + unprotected: true + skip_x_access_token: false - endpoint: /graph/ service: eu.opencloud.web.graph skip_x_access_token: false @@ -163,12 +167,8 @@ policies: service: eu.opencloud.web.collaboration unprotected: true skip_x_access_token: true - - endpoint: /collaboration/fonts/manage - service: eu.opencloud.web.collaboration - skip_x_access_token: false - endpoint: /collaboration service: eu.opencloud.web.collaboration - unprotected: true skip_x_access_token: false additional_policies: [] oidc: @@ -264,3 +264,5 @@ events: enable_tls: false username: "" password: "" +guest_link_auth: + cookie_name: __Host-oc_guest_session diff --git a/docs/_static/env-vars/proxy_configvars.md b/docs/_static/env-vars/proxy_configvars.md index e85e315b4..e789648a3 100644 --- a/docs/_static/env-vars/proxy_configvars.md +++ b/docs/_static/env-vars/proxy_configvars.md @@ -23,7 +23,7 @@ |`OC_REVA_GATEWAY`| 1.0.0 |string|`The CS3 gateway endpoint.`|`"eu.opencloud.api.gateway"`| |`OC_GRPC_CLIENT_TLS_MODE`| 1.0.0 |string|`TLS mode for grpc connection to the go-micro based grpc services. Possible values are 'off', 'insecure' and 'on'. 'off': disables transport security for the clients. 'insecure' allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). 'on' enables transport security, including server certificate verification.`|`""`| |`OC_GRPC_CLIENT_TLS_CACERT`| 1.0.0 |string|`Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services.`|`""`| -|`PROXY_OIDC_AUDIENCES`| next |[]string|`Optional comma-separated list of allowed audiences for OIDC access tokens. Empty disables audience validation for compatibility. Configuring audiences is recommended for production and requires PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt. Tokens must contain at least one exactly matching, case-sensitive audience in their aud claim.`|`"[]"`| +|`PROXY_OIDC_AUDIENCES`| 8.1.0 |[]string|`Optional comma-separated list of allowed audiences for OIDC access tokens. Empty disables audience validation for compatibility. Configuring audiences is recommended for production and requires PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt. Tokens must contain at least one exactly matching, case-sensitive audience in their aud claim.`|`"[]"`| |`OC_URL`
`OC_OIDC_ISSUER`
`PROXY_OIDC_ISSUER`| 1.0.0 |string|`URL of the OIDC issuer. It defaults to URL of the builtin IDP.`|`"https://localhost:9200"`| |`OC_INSECURE`
`PROXY_OIDC_INSECURE`| 1.0.0 |bool|`Disable TLS certificate validation for connections to the IDP. Note that this is not recommended for production environments.`|`"false"`| |`PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD`| 1.0.0 |string|`Sets how OIDC access tokens should be verified. Possible values are 'none' and 'jwt'. When using 'none', no special validation apart from using it for accessing the IDP's userinfo endpoint will be done. When using 'jwt', it tries to parse the access token as a jwt token and verifies the signature using the keys published on the IDP's 'jwks_uri'.`|`"jwt"`| @@ -85,3 +85,4 @@ |`OC_EVENTS_ENABLE_TLS`
`PROXY_EVENTS_ENABLE_TLS`| 1.0.0 |bool|`Enable TLS for the connection to the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`"false"`| |`OC_EVENTS_AUTH_USERNAME`
`PROXY_EVENTS_AUTH_USERNAME`| 1.0.0 |string|`The username to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`""`| |`OC_EVENTS_AUTH_PASSWORD`
`PROXY_EVENTS_AUTH_PASSWORD`| 1.0.0 |string|`The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services.`|`""`| +|`PROXY_GUEST_LINK_COOKIE_NAME`| next |string|`The name of the guest-session cookie. Defaults to __Host-opencloud-guest.`|`"__Host-oc_guest_session"`| diff --git a/docs/_static/env-vars/proxy_readme.md b/docs/_static/env-vars/proxy_readme.md index d62884158..9b576500a 100755 --- a/docs/_static/env-vars/proxy_readme.md +++ b/docs/_static/env-vars/proxy_readme.md @@ -397,12 +397,17 @@ In this mode, the proxy service only exposes its own metrics. The metrics of the ### Available Metrics The following metrics are exposed by the proxy service: -| Metric Name | Description | Labels | -|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------| -| `opencloud_proxy_requests_total` | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests. | `method`: HTTP method of the request | -| `opencloud_proxy_errors_total` | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests which have failed. That counts all response codes >= 500 | `method`: HTTP method of the request | -| `opencloud_proxy_duration_seconds` | [Histogram](https://prometheus.io/docs/tutorials/understanding_metric_types/#histogram) of the time (in seconds) each request took. A histogram metric uses buckets to count the number of events that fall into each bucket. | `method`: HTTP method of the request | -| `opencloud_proxy_build_info{version}` | A metric with a constant `1` value labeled by version, exposing the version of the OpenCloud proxy service. | `version`: Build version of the proxy | +| Name | Labels | Description | +| ---- | ------ | ----------- | +| `opencloud_proxy_requests_total` | • `method`: HTTP method of the request | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests | +| `opencloud_proxy_errors_total` | • `method`: HTTP method of the request | [Counter](https://prometheus.io/docs/tutorials/understanding_metric_types/#counter) metric which reports the total number of HTTP requests which have failed. That counts all response codes >= 500. | +| `opencloud_proxy_duration_seconds` | • `method`: HTTP method of the request | [Histogram](https://prometheus.io/docs/tutorials/understanding_metric_types/#histogram) of the time (in seconds) each request took. A histogram metric uses buckets to count the number of events that fall into each bucket | +| `opencloud_proxy_concurrent_service_requests` | • `service`: identifier of the service the request is proxied to | Counts the number of in-flight requests that are being processed at a given time | +| `opencloud_proxy_routing_failure_count` | | Counts the number of inbound requests that cannot be proxied due to a failure of determining how to route it | +| `opencloud_proxy_duration_seconds` | • `service`: identifier of the service the request is proxied to | Classic histogram that measures the duration of proxied HTTP requests, per service | +| `opencloud_proxy_request_total` | • `method`: the HTTP method
• `result`: one of `success` (<=299), `client-error` (<= 499), `server-error` (>= 500), depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Counts the number of proxied requests | +| `opencloud_proxy_request_duration_seconds_bucket` | • `method`: the HTTP method
• `result`: one of `success`, `client-error`, `server-error`, depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Native histogram that measures the duration of proxied HTTP requests, per service | +| `opencloud_proxy_build_info` | • `version`: build version of the proxy | A gauge with a constant value of `1` | ### Prometheus Configuration The following is an example prometheus configuration for the single process mode. It assumes that the proxy debug address is configured to bind on all interfaces `PROXY_DEBUG_ADDR=0.0.0.0:9205` and that the proxy is available via the `opencloud` service name (typically in docker-compose). The prometheus service detects the `/metrics` endpoint automatically and scrapes it every 15 seconds. @@ -416,3 +421,17 @@ scrape_configs: - targets: ["opencloud:9205"] ``` +In order to process native histograms, use this configuration instead: + +```yaml +global: + scrape_interval: 15s + scrape_native_histograms: true + scrape_protocols: ['PrometheusProto', 'OpenMetricsText1.0.0'] +scrape_configs: + - job_name: opencloud_proxy + static_configs: + - targets: ["opencloud:9205"] +``` + + diff --git a/docs/_static/env-vars/sharing_readme.md b/docs/_static/env-vars/sharing_readme.md index d9409b5f6..c498e2341 100755 --- a/docs/_static/env-vars/sharing_readme.md +++ b/docs/_static/env-vars/sharing_readme.md @@ -12,6 +12,7 @@ The `sharing` service provides the CS3 Sharing API for OpenCloud. It manages use * [Integration](#integration) * [Share Types](#share-types) * [Configuration](#configuration) + * [Auto-Accept Shares](#autoaccept-shares) * [Scalability](#scalability) ## Overview @@ -47,7 +48,12 @@ Share behavior can be configured via environment variables: - Auto-acceptance of shares - Share permissions and restrictions -See the `frontend` service README for more details on share-related configuration options. +### Auto-Accept Shares + +When setting the `SHARING_AUTO_ACCEPT_SHARES` to `true` (sharing service), all +incoming shares will be accepted automatically. Users can overwrite this +setting individually in their profile. The deprecated +`FRONTEND_AUTO_ACCEPT_SHARES` is still supported for backwards compatibility. ## Scalability diff --git a/docs/_static/env-vars/storage-users_configvars.md b/docs/_static/env-vars/storage-users_configvars.md index af7205bba..98e332121 100644 --- a/docs/_static/env-vars/storage-users_configvars.md +++ b/docs/_static/env-vars/storage-users_configvars.md @@ -1,5 +1,5 @@ -2026-09-17-06-05-59 +2026-10-07-00-08-40 ## Deprecation Notice diff --git a/docs/_static/env-vars/storage-users_readme.md b/docs/_static/env-vars/storage-users_readme.md index 767ef7558..8b576a7cf 100755 --- a/docs/_static/env-vars/storage-users_readme.md +++ b/docs/_static/env-vars/storage-users_readme.md @@ -13,6 +13,8 @@ Purpose and description to be added * [Manage Unfinished Uploads](#manage-unfinished-uploads) * [Sessions command](#sessions-command) * [Command Examples](#command-examples) + * [Delete Stale Nodes command](#delete-stale-nodes-command) + * [Command Examples](#command-examples) * [Manage Trash-Bin Items](#manage-trashbin-items) * [Purge Expired](#purge-expired) * [List and Restore Trash-Bins Items](#list-and-restore-trashbins-items) @@ -71,7 +73,8 @@ opencloud storage-users uploads ```plaintext COMMANDS: - sessions Print a list of upload sessions + delete-stale-nodes Delete (or revert) all nodes in processing state that are not referenced by any upload session + sessions Print a list of upload sessions ``` #### Sessions command @@ -156,6 +159,50 @@ opencloud storage-users uploads sessions --expired=true --clean opencloud storage-users uploads sessions --processing=false --has-virus=false --resume ``` + +#### Delete Stale Nodes command + +This command allows to remove (or revert) nodes that are stale, meaning they are in postprocessing but their upload session is gone. +It will check all nodes that are in postprocessing and find those without an upload session. Then it will delete the node if there are no other versions. If there are other versions, it will instead revert the node to the previous version. +The command reads the decomposed storage directly, so it only finds nodes when the msgpack metadata backend (`.mpk` files) is used. The stale nodes are cleaned up by `DeleteRevision` events, which are consumed by the running `storage-users` service: it needs to be up for the cleanup to actually happen. + +```bash + opencloud storage-users uploads delete-stale-nodes +``` +```plaintext +Delete (or revert) all nodes in processing state that are not referenced by any upload session + +Usage: + opencloud storage-users uploads delete-stale-nodes [flags] + +Flags: + --dry-run Only show what would be deleted without actually deleting (default true) + -h, --help help for delete-stale-nodes + --spaceid string Space ID to check for processing nodes (omit to check all spaces) + --verbose Enable verbose logging +``` + +#### Command Examples + +Dry run to see what would be deleted (recommended first step) + +```bash +opencloud storage-users uploads delete-stale-nodes +``` + +Set `--dry-run=false` to actually delete the stale nodes + +```bash +opencloud storage-users uploads delete-stale-nodes --dry-run=false +``` + +Use `--verbose` to get more information about what is happening + +```bash +opencloud storage-users uploads delete-stale-nodes --dry-run=false --verbose +``` + + ### Manage Trash-Bin Items This command set provides commands to get an overview of trash-bin items, restore items and purge old items of `personal` spaces and `project` spaces (spaces that have been created manually). `trash-bin` commands require a `spaceID` as parameter. diff --git a/docs/_static/env-vars/web_configvars.md b/docs/_static/env-vars/web_configvars.md index 8742fa362..d233e871e 100644 --- a/docs/_static/env-vars/web_configvars.md +++ b/docs/_static/env-vars/web_configvars.md @@ -1,5 +1,5 @@ -2026-09-17-06-05-59 +2026-10-07-00-08-40 ## Deprecation Notice From 36b4138ea2f553fef86475b2b0a25dfa07ba2243 Mon Sep 17 00:00:00 2001 From: Anja Barz Date: Wed, 7 Oct 2026 09:15:41 +0200 Subject: [PATCH 2/2] fix formatting issues --- docs/_static/env-vars/proxy_readme.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/docs/_static/env-vars/proxy_readme.md b/docs/_static/env-vars/proxy_readme.md index 9b576500a..94376e6b9 100755 --- a/docs/_static/env-vars/proxy_readme.md +++ b/docs/_static/env-vars/proxy_readme.md @@ -405,8 +405,8 @@ The following metrics are exposed by the proxy service: | `opencloud_proxy_concurrent_service_requests` | • `service`: identifier of the service the request is proxied to | Counts the number of in-flight requests that are being processed at a given time | | `opencloud_proxy_routing_failure_count` | | Counts the number of inbound requests that cannot be proxied due to a failure of determining how to route it | | `opencloud_proxy_duration_seconds` | • `service`: identifier of the service the request is proxied to | Classic histogram that measures the duration of proxied HTTP requests, per service | -| `opencloud_proxy_request_total` | • `method`: the HTTP method
• `result`: one of `success` (<=299), `client-error` (<= 499), `server-error` (>= 500), depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Counts the number of proxied requests | -| `opencloud_proxy_request_duration_seconds_bucket` | • `method`: the HTTP method
• `result`: one of `success`, `client-error`, `server-error`, depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Native histogram that measures the duration of proxied HTTP requests, per service | +| `opencloud_proxy_request_total` | • `method`: the HTTP method
• `result`: one of `success` (<=299), `client-error` (<= 499), `server-error` (>= 500), depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Counts the number of proxied requests | +| `opencloud_proxy_request_duration_seconds_bucket` | • `method`: the HTTP method
• `result`: one of `success`, `client-error`, `server-error`, depending on the status code in the response of the proxied HTTP request
• `services`: identifier of the service the request is proxied to | Native histogram that measures the duration of proxied HTTP requests, per service | | `opencloud_proxy_build_info` | • `version`: build version of the proxy | A gauge with a constant value of `1` | ### Prometheus Configuration @@ -433,5 +433,3 @@ scrape_configs: static_configs: - targets: ["opencloud:9205"] ``` - -