nextcloud
/
nextcloud-docker
mirror of https://github.com/nextcloud/docker
1
0
Fork 0
Code Issues Releases Wiki Activity

Add S3 SSE-KMS environment variable support

Browse Source 
Nextcloud server PR nextcloud/server#57623 added sse_kms_enabled and
sse_kms_key_id objectstore arguments for AWS SSE-KMS encryption.
Expose them via OBJECTSTORE_S3_SSE_KMS_ENABLED and
OBJECTSTORE_S3_SSE_KMS_KEY_ID env vars, mirroring the existing SSE-C
support.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Stephen Cuppett <steve@cuppett.com>
pull/2597/head
Stephen Cuppett 3 months ago
parent 6b76ae5f12
commit f2a47efff8
No known key found for this signature in database
GPG Key ID: 47935848A7892F43
11 changed files with 102 additions and 0 deletions
Show Stats Download Patch File Download Diff File

10
.config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
32/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
33/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/apache/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/fpm-alpine/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

10
34/fpm/config/s3.config.php
Unescape View File

@ -45,4 +45,14 @@ if (getenv('OBJECTSTORE_S3_BUCKET')) {
} elseif (getenv('OBJECTSTORE_S3_SSE_C_KEY')) {
$CONFIG['objectstore']['arguments']['sse_c_key'] = getenv('OBJECTSTORE_S3_SSE_C_KEY');
}
$sse_kms_enabled = getenv('OBJECTSTORE_S3_SSE_KMS_ENABLED');
$sse_kms_key_id = getenv('OBJECTSTORE_S3_SSE_KMS_KEY_ID');
// Setting a key id implies enabling SSE-KMS; the flag alone uses the bucket default key.
if ($sse_kms_key_id || ($sse_kms_enabled && strtolower($sse_kms_enabled) !== 'false')) {
$CONFIG['objectstore']['arguments']['sse_kms_enabled'] = true;
if ($sse_kms_key_id) {
$CONFIG['objectstore']['arguments']['sse_kms_key_id'] = $sse_kms_key_id;
}
}
}

2
README.md
Unescape View File

@ -329,6 +329,8 @@ To use an external S3 compatible object store as primary storage, set the follow
- `OBJECTSTORE_S3_OBJECT_PREFIX` (default: `urn:oid:`): Prefix to prepend to the fileid
- `OBJECTSTORE_S3_AUTOCREATE` (default: `true`): Create the container if it does not exist
- `OBJECTSTORE_S3_SSE_C_KEY` (not set by default): Base64 encoded key with a maximum length of 32 bytes for server side encryption (SSE-C)
- `OBJECTSTORE_S3_SSE_KMS_ENABLED` (not set by default): Enable AWS server-side encryption with KMS (SSE-KMS) using the bucket's default KMS key
- `OBJECTSTORE_S3_SSE_KMS_KEY_ID` (not set by default): KMS key ARN/ID to use for SSE-KMS; setting this implies SSE-KMS is enabled. Requires a Nextcloud server version that includes SSE-KMS support (server 34+)
Check the [Nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3) for more information.

Write Preview
Loading…
Cancel
Save