owncloud · mmattel · Jul 13, 2026 · Jul 15, 2026
@@ -60,6 +60,7 @@ The following port ranges are used by services:
 | 9260-9264  | xref:{s-path}/clientlog.adoc[clientlog]
 | 9270-9274  | xref:{s-path}/eventhistory.adoc[eventhistory]
 | 9280-9284  | xref:{s-path}/ocm.adoc[ocm]
+| 9285-9289  | xref:{s-path}/storage-users.adoc[storage-users (vault)] 
 | 9300-9304  | xref:{s-path}/collaboration.adoc[collaboration]
 | 9350-9354  | xref:{s-path}/ocdav.adoc[ocdav]
 |===
@@ -331,6 +331,67 @@ ocis storage-users trash-bin restore [command options] ['spaceID' required] ['it
 
 See the xref:deployment/storage/general-considerations.adoc#resource-optimisation[General Storage Considerations and Settings] documentation for details about configuring the `STORAGE_USERS_OCIS_MAX_CONCURRENCY` environment variable.
 
+== Vault Mode
+
+The `storage-users` service can be special configured to run as additional service providing vault mode.
+
+Vault mode provides dedicated vault storage that is stored separately and can be protected by multi-factor authentication (MFA). Vault resources are isolated from the default user storage and have their own search function, sharing options and workspaces, while public links are explicitly disallow
+
+=== Configuration
+
+Create a `storage-users-vault` service::
++
+--
+The following environment variables must be set in order to define an instance of the `storage-users` service as a vault:
+
+[source,.env]
+----
+STORAGE_USERS_SERVICE_NAME: storage-users-vault
+STORAGE_USERS_GRPC_ADDR: storage-users-vault:9285
+STORAGE_USERS_HTTP_ADDR: storage-users-vault:9286
+STORAGE_USERS_DATA_SERVER_URL: http://storage-users-vault:9286/data
+STORAGE_USERS_DEBUG_ADDR: storage-users-vault:9287
+STORAGE_USERS_OCIS_ROOT: /var/lib/ocis/storage/users-vault
+STORAGE_USERS_EVENTS_CONSUMER_GROUP: vault-dcfs
+----
+
+[IMPORTANT]
+====
+Additionally to the environment variables shown above and for the time being, caching cannot use the shared global environment variable `OCIS_CACHE_STORE_NODES`, as described in the xref:caching[Caching] section. For a vault-instance, you must define for caching either `memory` or `noop`. The affected environment variables to set the cache are:
+
+* `STORAGE_USERS_FILEMETADATA_CACHE_STORE`
+* `STORAGE_USERS_ID_CACHE_STORE`
+====
+--
+
+Configure instance communication::
++
+--
+These environment variables complete the configuration of the service instance. The example values for these environment variables are taken from the xref:depl-examples/ubuntu-compose/ubuntu-compose-prod.adoc[Local Production Setup] deployment example. To allow inter-service communication, they need to match the main configuration of the Infinite Scale instance.
+
+[source,.env]
+----
+OCIS_GATEWAY_GRPC_ADDR: ocis:9142
+OCIS_EVENTS_ENDPOINT: ocis:9233
+STORAGE_USERS_xxx_CACHE_STORE: 'memory'
+MICRO_REGISTRY_ADDRESS: ocis:9233
+----
+--
+
+Complete the configuration::
++
+--
+With the above configuration creating a `storage-users-vault` instance, you can now set the following environment variables. These envvars are only effective if the `storage-users` service is configured vault.
+
+The following environment variables can be used to make further configuration changes:
+
+* `OCIS_ENABLE_VAULT_MODE: true` +
+Enable the vault mode in a OCIS.
+
+* `OCIS_MFA_ENABLED: true` +
+Enable multi-factor authentication (MFA) for the use with vault.
+--
+
 == Caching
 
 // renders dependent on is_cache or is_store

@@ -1,6 +1,6 @@
 = Changed or Added CLI Commands
 :toc: right
-:description: This page contains a list with added, changed or removed CLI commands between Infinite Scale version 7.3.0 and 8.0.0.
+:description: This page contains a list with added, changed or removed CLI commands between Infinite Scale version 8.0.0 and 8.1.0.
 :page-aliases: ROOT:maintenance/b-r/changed-cli.adoc
 
 == Introduction
@@ -13,8 +13,5 @@
 
 See the link for a detailed description of the respective CLI command if available.
 
-* xref:maintenance/commands/commands.adoc#move-stuck-uploads[Move Stuck Uploads] +
-This CLI command has been added to remedy the issue when Infinite Scale metadata may become stuck in some cases of saturated disk usage.
-
-* xref:maintenance/commands/commands.adoc#cleanup-orphaned-grants[Cleanup Orphaned Grants] +
-This CLI command has been added to cleanup orphaned grants when a share has been deleted but the removal process is not completed successfully.
+* xref:maintenance/commands/commands.adoc#verify-and-inspect-blobstore[Verify and Inspect a Blobstore] +
+This CLI command has been added to verify and inspect the configured Blobstore without requiring direct access to the underlying storage system.
@@ -124,3 +124,7 @@ WARNING: Use this command with absolute care. It is not intended to play around
 === Sending Grouped Emails
 
 This command is about sending emails based on events stored in a named group bucket. See the xref:{s-path}/notifications.adoc#sending-grouped-emails[Sending Grouped Emails] section in the _notification_ service for details.
+
+=== Verify and Inspect a Blobstore
+
+This command has been added to verify and inspect the configured Blobstore without requiring direct access to the underlying storage system. Use the following xref:maintenance/commands/verify-and-inspect-blobstore.adoc[CLI command] for this task.
@@ -0,0 +1,40 @@
+= Verify and Inspect a Blobstore
+:toc: right
+
+Verify and inspect the configured Blobstore without requiring direct access to the underlying storage system.
+
+include::partial$/maintenance/ocis-storage-users-cli.adoc[]
+
+== Command Details
+
+The following command can verify and inspect the configured Blobstore.
+
+.Usage:
+
+[source,bash]
+----
+ocis storage-users blobstore -h
+NAME:
+   ocis storage-users blobstore - manage the blobstore
+
+USAGE:
+   ocis storage-users blobstore [command options]
+
+COMMANDS:
+   check    check blobstore connectivity via an upload/download/delete round-trip
+   get      get a blob from the blobstore by ID
+   help, h  Shows a list of commands or help for one command
+
+OPTIONS:
+   --help, -h  show help
+----
+
+.Notes:
+
+* `blobstore check` +
+Performs a full upload/download/delete round-trip using a random payload. The payload size is configurable via `--blob-size` and accepts human-readable values such as `64`, `1KB` or `4MiB` (default: 64 bytes).
+
+* `blobstore get` +
+Downloads a specific blob by its ID to verify it is readable. The blob can be identified either with `--blob-id` and `--space-id`, or by passing the raw blob path from a log line directly via `--path`. Both the s3ng key format (`<spaceID>/<pathified_blobID>`) and the ocis filesystem path format (`…/spaces/<pathified_spaceID>/blobs/<pathified_blobID>`) are accepted. When using the s3ng driver without a known blob size, an automatic retry with the actual size is performed on a size mismatch.
+
+As both commands read the existing service configuration, they always target the same blobstore as the running service. Only the `ocis` and `s3ng` storage drivers are supported.
@@ -0,0 +1,31 @@
+== Command Set Overview
+
+The described command is part of the `ocis storage-users` command set:
+
+[source,bash]
+----
+ocis storage-users -h
+NAME:
+   ocis storage-users - storage-users service commands
+
+USAGE:
+   ocis storage-users [command options]
+
+CATEGORY:
+   services
+
+COMMANDS:
+   uploads    manage unfinished uploads
+   trash-bin  manage trash-bins
+   spaces     manage spaces
+   blobstore  manage the blobstore
+   help, h    Shows a list of commands or help for one command
+   info:
+     health   check health status
+     version  print the version of this binary and the running service instances
+   server:
+     server  start the storage-users service without runtime (unsupervised mode)
+
+OPTIONS:
+   --help, -h  show help
+----