From b8aed363a0bedb4c94139906af8f092a8b030474 Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Mon, 13 Jul 2026 18:59:55 +0200 Subject: [PATCH 1/2] storage-users-vault --- .../pages/deployment/services/ports-used.adoc | 1 + .../services/s-list/storage-users.adoc | 61 +++++++++++++++++++ 2 files changed, 62 insertions(+) diff --git a/modules/admin/pages/deployment/services/ports-used.adoc b/modules/admin/pages/deployment/services/ports-used.adoc index 37e182b58..f81e6b9b7 100644 --- a/modules/admin/pages/deployment/services/ports-used.adoc +++ b/modules/admin/pages/deployment/services/ports-used.adoc @@ -60,6 +60,7 @@ The following port ranges are used by services: | 9260-9264 | xref:{s-path}/clientlog.adoc[clientlog] | 9270-9274 | xref:{s-path}/eventhistory.adoc[eventhistory] | 9280-9284 | xref:{s-path}/ocm.adoc[ocm] +| 9285-9289 | xref:{s-path}/storage-users.adoc[storage-users (vault)] | 9300-9304 | xref:{s-path}/collaboration.adoc[collaboration] | 9350-9354 | xref:{s-path}/ocdav.adoc[ocdav] |=== diff --git a/modules/admin/pages/deployment/services/s-list/storage-users.adoc b/modules/admin/pages/deployment/services/s-list/storage-users.adoc index a566526e1..e54ecf6b5 100644 --- a/modules/admin/pages/deployment/services/s-list/storage-users.adoc +++ b/modules/admin/pages/deployment/services/s-list/storage-users.adoc @@ -331,6 +331,67 @@ ocis storage-users trash-bin restore [command options] ['spaceID' required] ['it See the xref:deployment/storage/general-considerations.adoc#resource-optimisation[General Storage Considerations and Settings] documentation for details about configuring the `STORAGE_USERS_OCIS_MAX_CONCURRENCY` environment variable. +== Vault Mode + +The `storage-users` service can be special configured to run as additional service providing vault mode. + +Vault mode provides dedicated vault storage that is stored separately and can be protected by multi-factor authentication (MFA). Vault resources are isolated from the default user storage and have their own search function, sharing options and workspaces, while public links are explicitly disallow + +=== Configuration + +Create a `storage-users-vault` service:: ++ +-- +The following environment variables must be set in order to define an instance of the `storage-users` service as a vault: + +[source,.env] +---- +STORAGE_USERS_SERVICE_NAME: storage-users-vault +STORAGE_USERS_GRPC_ADDR: storage-users-vault:9285 +STORAGE_USERS_HTTP_ADDR: storage-users-vault:9286 +STORAGE_USERS_DATA_SERVER_URL: http://storage-users-vault:9286/data +STORAGE_USERS_DEBUG_ADDR: storage-users-vault:9287 +STORAGE_USERS_OCIS_ROOT: /var/lib/ocis/storage/users-vault +STORAGE_USERS_EVENTS_CONSUMER_GROUP: vault-dcfs +---- + +[IMPORTANT] +==== +Additionally to the environment variables shown above and for the time being, caching cannot use the shared global environment variable `OCIS_CACHE_STORE_NODES`, as described in the xref:caching[Caching] section. For a vault-instance, you must define for caching either `memory` or `noop`. The affected environment variables to set the cache are: + +* `STORAGE_USERS_FILEMETADATA_CACHE_STORE` +* `STORAGE_USERS_ID_CACHE_STORE` +==== +-- + +Configure instance communication:: ++ +-- +These environment variables complete the configuration of the service instance. The example values for these environment variables are taken from the xref:depl-examples/ubuntu-compose/ubuntu-compose-prod.adoc[Local Production Setup] deployment example. To allow inter-service communication, they need to match the main configuration of the Infinite Scale instance. + +[source,.env] +---- +OCIS_GATEWAY_GRPC_ADDR: ocis:9142 +OCIS_EVENTS_ENDPOINT: ocis:9233 +STORAGE_USERS_xxx_CACHE_STORE: 'memory' +MICRO_REGISTRY_ADDRESS: ocis:9233 +---- +-- + +Complete the configuration:: ++ +-- +With the above configuration creating a `storage-users-vault` instance, you can now set the following environment variables. These envvars are only effective if the `storage-users` service is configured vault. + +The following environment variables can be used to make further configuration changes: + +* `OCIS_ENABLE_VAULT_MODE: true` + +Enable the vault mode in a OCIS. + +* `OCIS_MFA_ENABLED: true` + +Enable multi-factor authentication (MFA) for the use with vault. +-- + == Caching // renders dependent on is_cache or is_store From 3739de1d43db73c460ce4b82e9c83ccf022e8dbe Mon Sep 17 00:00:00 2001 From: Martin Mattel Date: Wed, 15 Jul 2026 12:18:11 +0200 Subject: [PATCH 2/2] blobstore-cli --- .../maintenance/commands/changed-cli.adoc | 9 ++--- .../pages/maintenance/commands/commands.adoc | 4 ++ .../verify-and-inspect-blobstore.adoc | 40 +++++++++++++++++++ .../maintenance/ocis-storage-users-cli.adoc | 31 ++++++++++++++ 4 files changed, 78 insertions(+), 6 deletions(-) create mode 100644 modules/admin/pages/maintenance/commands/verify-and-inspect-blobstore.adoc create mode 100644 modules/admin/partials/maintenance/ocis-storage-users-cli.adoc diff --git a/modules/admin/pages/maintenance/commands/changed-cli.adoc b/modules/admin/pages/maintenance/commands/changed-cli.adoc index d74ecf1d6..f20fa0634 100644 --- a/modules/admin/pages/maintenance/commands/changed-cli.adoc +++ b/modules/admin/pages/maintenance/commands/changed-cli.adoc @@ -1,6 +1,6 @@ = Changed or Added CLI Commands :toc: right -:description: This page contains a list with added, changed or removed CLI commands between Infinite Scale version 7.3.0 and 8.0.0. +:description: This page contains a list with added, changed or removed CLI commands between Infinite Scale version 8.0.0 and 8.1.0. :page-aliases: ROOT:maintenance/b-r/changed-cli.adoc == Introduction @@ -13,8 +13,5 @@ See the link for a detailed description of the respective CLI command if available. -* xref:maintenance/commands/commands.adoc#move-stuck-uploads[Move Stuck Uploads] + -This CLI command has been added to remedy the issue when Infinite Scale metadata may become stuck in some cases of saturated disk usage. - -* xref:maintenance/commands/commands.adoc#cleanup-orphaned-grants[Cleanup Orphaned Grants] + -This CLI command has been added to cleanup orphaned grants when a share has been deleted but the removal process is not completed successfully. +* xref:maintenance/commands/commands.adoc#verify-and-inspect-blobstore[Verify and Inspect a Blobstore] + +This CLI command has been added to verify and inspect the configured Blobstore without requiring direct access to the underlying storage system. diff --git a/modules/admin/pages/maintenance/commands/commands.adoc b/modules/admin/pages/maintenance/commands/commands.adoc index 9828e3d2d..1ae3141f6 100644 --- a/modules/admin/pages/maintenance/commands/commands.adoc +++ b/modules/admin/pages/maintenance/commands/commands.adoc @@ -124,3 +124,7 @@ WARNING: Use this command with absolute care. It is not intended to play around === Sending Grouped Emails This command is about sending emails based on events stored in a named group bucket. See the xref:{s-path}/notifications.adoc#sending-grouped-emails[Sending Grouped Emails] section in the _notification_ service for details. + +=== Verify and Inspect a Blobstore + +This command has been added to verify and inspect the configured Blobstore without requiring direct access to the underlying storage system. Use the following xref:maintenance/commands/verify-and-inspect-blobstore.adoc[CLI command] for this task. diff --git a/modules/admin/pages/maintenance/commands/verify-and-inspect-blobstore.adoc b/modules/admin/pages/maintenance/commands/verify-and-inspect-blobstore.adoc new file mode 100644 index 000000000..fae3f3c0d --- /dev/null +++ b/modules/admin/pages/maintenance/commands/verify-and-inspect-blobstore.adoc @@ -0,0 +1,40 @@ += Verify and Inspect a Blobstore +:toc: right + +Verify and inspect the configured Blobstore without requiring direct access to the underlying storage system. + +include::partial$/maintenance/ocis-storage-users-cli.adoc[] + +== Command Details + +The following command can verify and inspect the configured Blobstore. + +.Usage: + +[source,bash] +---- +ocis storage-users blobstore -h +NAME: + ocis storage-users blobstore - manage the blobstore + +USAGE: + ocis storage-users blobstore [command options] + +COMMANDS: + check check blobstore connectivity via an upload/download/delete round-trip + get get a blob from the blobstore by ID + help, h Shows a list of commands or help for one command + +OPTIONS: + --help, -h show help +---- + +.Notes: + +* `blobstore check` + +Performs a full upload/download/delete round-trip using a random payload. The payload size is configurable via `--blob-size` and accepts human-readable values such as `64`, `1KB` or `4MiB` (default: 64 bytes). + +* `blobstore get` + +Downloads a specific blob by its ID to verify it is readable. The blob can be identified either with `--blob-id` and `--space-id`, or by passing the raw blob path from a log line directly via `--path`. Both the s3ng key format (`/`) and the ocis filesystem path format (`…/spaces//blobs/`) are accepted. When using the s3ng driver without a known blob size, an automatic retry with the actual size is performed on a size mismatch. + +As both commands read the existing service configuration, they always target the same blobstore as the running service. Only the `ocis` and `s3ng` storage drivers are supported. diff --git a/modules/admin/partials/maintenance/ocis-storage-users-cli.adoc b/modules/admin/partials/maintenance/ocis-storage-users-cli.adoc new file mode 100644 index 000000000..04b4f65d6 --- /dev/null +++ b/modules/admin/partials/maintenance/ocis-storage-users-cli.adoc @@ -0,0 +1,31 @@ +== Command Set Overview + +The described command is part of the `ocis storage-users` command set: + +[source,bash] +---- +ocis storage-users -h +NAME: + ocis storage-users - storage-users service commands + +USAGE: + ocis storage-users [command options] + +CATEGORY: + services + +COMMANDS: + uploads manage unfinished uploads + trash-bin manage trash-bins + spaces manage spaces + blobstore manage the blobstore + help, h Shows a list of commands or help for one command + info: + health check health status + version print the version of this binary and the running service instances + server: + server start the storage-users service without runtime (unsupervised mode) + +OPTIONS: + --help, -h show help +----