SFTPGo and Traefik

[Nico83500]

Hi,
I would like to know if it's possible to use SFTPGo behind Traefik 2 ?
Thank you !

[drakkan]

Hi,

this question seems related to Traefik and not to SFTPGo.

I tested SFTPGo behind HAProxy and it works fine (both SFTP and FTP). SFTPGo supports proxy protocol v1 and v2 too. For WebDAV and the web interfaces you can use a standard HTTP proxy (tested HAProxy, Apache, NGINX).

So basically it should work. I have no time to test it myself, please try to follow the instructions here. If you want to proxy the FTP service you have to know how the FTP protocol works

[Nico83500]

Thank you, it works behind Traefik :

 - "traefik.enable=true"
 - "traefik.docker.network=my_network"
 - "traefik.http.routers.sftpgo-ui.entrypoints=https"
 - "traefik.http.routers.sftpgo-ui.rule=Host(`sftpgo.domain.tld`)"
 - "traefik.http.routers.sftpgo-ui.middlewares=mymiddlewares@file"
 - "traefik.http.routers.sftpgo-ui.service=sftpgo-ui"
 - "traefik.http.services.sftpgo-ui.loadBalancer.server.port=8080"
 - "traefik.tcp.routers.sftpgo-sftp.entrypoints=sftpgo"
 - "traefik.tcp.routers.sftpgo-sftp.rule=HostSNI(`*`)"
 - "traefik.tcp.routers.sftpgo-sftp.service=sftpgo-sftp"
 - "traefik.tcp.services.sftpgo-sftp.loadBalancer.server.port=2022"

Don't forget to add an entrypoint and the 2022 port to Traefik config.

[kromsam]

• "traefik.tcp.routers.sftpgo-sftp.rule=HostSNI(*)"

How would it be possible to set up the router only on a specific domain, and not this catch-all setting? When I filled in the specific domain, my configuration stopped working.

[drakkan]

• "traefik.tcp.routers.sftpgo-sftp.rule=HostSNI(*)"

How would it be possible to set up the router only on a specific domain, and not this catch-all setting? When I filled in the specific domain, my configuration stopped working.

This is not supported in SSH in general, take a look here

[drakkan]

Thank you for sharing your configuration

[WiFEED]

Thank you ! Now i have access denied on Filezilla :O,

Can you explain step by step, how to create users SFTP ?
i need to create private key ? or i can connect with user:password ?

[drakkan]

You can use both key or password authentication. Please take a look here

[ovizii]

Any tips on how to get sftpgo to see the correct client IP? I know this is most probably related to traefik and not sftpgo but maybe another user has figured it out.
At the moment sftpgo always sees remote address \"10.10.10.1:44944\" which is my internal gateway IP so somehow traefik does not report the correct client IP.

my set is like this: sftp-client => internet => modem => router/gateway => port forward to traefik => sftpgo

I have set:

  - SFTPGO_COMMON_PROXY_PROTOCOL=2

in my docker-compose.yml for sftpgo

[ovizii]

Unfortunately, I made no progress, still stuck with sftpgo not seeing the real external IP :-/

[drakkan]

Hello, we provide commercial support for SFTPGo if you are interested

https://sftpgo.com/#services

but you probably already know and prefer to ask here hoping that someone will help you for free and obviously you are all just private users using SFTPGo at home with Kubernetes and other complex setups 😄

[helmut72]

you are all just private users using SFTPGo at home with Kubernetes and other complex setups

Why not? You know r/selfhosted yourself. 😉 Using Traefik or Container technology at home isn't strange. There is a big community and hobbyists regarding self hosting and running servers at home. For example just look a this channel:
https://www.youtube.com/@christianlempa/videos

You should not always assume business interests. 😉

[drakkan]

In some cases that's true, but it's really hard to believe that anyone is using Kubernetes at home.

Maintaining and evolving open source software it is not free, it requires a lot of time and effort and people should learn to recognize the value of this work. Why can people pay for hardware and/or something like Unraid and use SFTPGo and open source software in general, without giving anything back and also expect free support?

I work on SFTPGo more hours per week than my paid consultancies, the ones that allow me to pay the bills.

Let's look at recent CVEs what do you see? Maybe the xz backdoor?
Do you now understand what can happen if open source software is not maintained or poorly maintained?
Not that proprietary software is better ... just search for the recent CVE for proprietary software similar to SFTPGo.

I don't want something like this to happen to SFTPGo (that it becomes unmaintained or poorly maintained) but honestly I'm really disappointed by the ingratitude of people/companies, they earn money, improve their career or get other types of benefits using SFTPGo and they don't give anything back (you can't imagine the rudeness of some private emails where people claim for support...).

I strongly believe in the Open Source software model, I think it is better than the proprietary model and therefore I will try to keep SFTPGo completely open source. I founded a company around it to provide better support. I invested real money to buy the new UI theme and to pay a specialized UX company to improve the WebAdmin and WebClient and to pay lawyers to clarify the restrictions of AGPLv3, providing a much more open interpretation than other software with the same license.
But honestly I completely lost motivation to help people who were asking for free support and who confuse free with open source.

[blade10101]

I do understand where your coming from. I self host many different things and sftpgo is well made and once I get traefik working with the proxy protocol things will be nearly perfect. Ive ran across software that the dev's just gave up and it turns into a bug fest....

I plan on being a supporter as well due to the tests I did. 20 MB/sec to a S3 backend... so thank you for the work you do and for keeping it opensource

[ovizii]

Hello, we provide commercial support for SFTPGo if you are interested

https://sftpgo.com/#services

but you probably already know and prefer to ask here hoping that someone will help you for free and obviously you are all just private users using SFTPGo at home with Kubernetes and other complex setups

Sorry, my reply got mangled somehow.
I said that I only have 1 user on my sftpgo instance and it's used by my android phone to upload the backups I do on my phone so I'm totally fine as it is. I'd just feel a bit safer if I could use see the real IP, so I can block possible access attempts. 😄
I'm just hoping that somebody who figured out how to see the real IP behind traefik stumbles upon this thread and shares how to achieve it.

[ekovarski]

Ran into an issue with uploading large files via the sftpgo web gui, ended up needing to increase the traefik readTimeout.

Add the following to the command section of docker-compose.yaml for traefik

      - "--entrypoints.web.transport.respondingTimeouts.readTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=600s"  

or modify traefik.yaml.

entryPoints:
  web:
    address: ":80"
    transport:
      respondingTimeouts:
        readTimeout: 600s
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 600s

The default timeout is listed as 60s and technically setting it to 0s should disable it but didn't work for me on v3.4.1 hence I set it to 600s.

If your uploads take longer, then you might need to adjust for your use case scenario.