nextcloud
/
nextcloud-docker
mirror of https://github.com/nextcloud/docker
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #2597 from cuppett/feat/s3-sse-kms-support

Browse Source 
Add S3 SSE-KMS environment variable support
pull/2598/head
Stephen Cuppett 3 months ago committed by GitHub
parent 6b76ae5f12 f2a47efff8
commit d51ecd02c9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
11 changed files with 102 additions and 0 deletions
Show Stats Download Patch File Download Diff File

10
.config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

2
README.md
Unescape View File

@ -329,6 +329,8 @@ To use an external S3 compatible object store as primary storage, set the follow
- `OBJECTSTORE_S3_OBJECT_PREFIX` (default: `urn:oid:`): Prefix to prepend to the fileid
- `OBJECTSTORE_S3_AUTOCREATE` (default: `true`): Create the container if it does not exist
- `OBJECTSTORE_S3_SSE_C_KEY` (not set by default): Base64 encoded key with a maximum length of 32 bytes for server side encryption (SSE-C)
- `OBJECTSTORE_S3_SSE_KMS_ENABLED` (not set by default): Enable AWS server-side encryption with KMS (SSE-KMS) using the bucket's default KMS key
- `OBJECTSTORE_S3_SSE_KMS_KEY_ID` (not set by default): KMS key ARN/ID to use for SSE-KMS; setting this implies SSE-KMS is enabled. Requires a Nextcloud server version that includes SSE-KMS support (server 34+)
Check the [Nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3) for more information.

Write Preview
Loading…
Cancel
Save