Recettes de montages

Chaque recette suppose ce backend :

[[backends]]
name = "disque"
type = "local"
root = "/srv/sftp"

1. Un repertoire par utilisateur

[[roles]]
name = "utilisateurs"

[[roles.mounts]]
backend = "disque"
home_dir = "/{username}"
create_home = true
acl = [{ path = "/", rights = ["read", "write", "list", "delete", "rename"], recursive = true }]

alice voit / = /srv/sftp/alice, cree a sa premiere connexion. Un role a / ne se cumule pas.

2. Un partenaire : depot entrant, releve sortante

Le partenaire depose dans /in sans pouvoir relire, et releve dans /out.

[[roles]]
name = "partenaire-acme"

[[roles.mounts]]
backend = "disque"
home_dir = "/partenaires/acme"
max_file_mb = 500
hidden_stores = { enabled = true, prefix = ".in.", extension = "" }
acl = [
  { path = "/in", rights = ["write", "list"], recursive = true },
  { path = "/out", rights = ["read", "list", "delete"], recursive = true },
]

/in est /srv/sftp/partenaires/acme/in ; un envoi y est publie a la fin du transfert.

Pour que ls / montre in et out, ajoutez une entree non recursive : path = "/", rights = ["list"].

3. Le compte d’exploitation : tous les stockages, en lecture

Un compte qui voit chaque backend a la racine et ne peut rien modifier.

[[backends]]
name = "archives"
type = "s3"
bucket = "archives"
region = "eu-west-3"
prefix = "sftp/"
credentials = { type = "iam_role" }

[[backends]]
name = "acme-amont"
type = "sftp"
host = "sftp.acme.example"
host_key_fingerprint = "SHA256:2hZbXq1b5Xb3vN2mQ6w7l3Fv0tXk4yJ8aUeYp9rS0cE"   # ssh-keygen -lf, verifie hors bande
auth = { type = "password", username = "relais", password = "changez-moi" }

[[roles]]
name = "exploitant"

[[roles.mounts]]
backend = "disque"
mount_path = "/disque"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]

[[roles.mounts]]
backend = "archives"
mount_path = "/archives"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]

[[roles.mounts]]
backend = "acme-amont"
mount_path = "/acme-amont"
home_dir = "/depot"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]

[[users]]
username = "exploitation"
password_hash = "$argon2id$..."   # d'un mot de passe aleatoire, jete : seule la cle sert
authorized_keys = ["ssh-ed25519 AAAA... exploitation@poste"]
authorities = ["exploitant"]

ls / montre acme-amont archives disque ; /archives/2024/x est la cle S3 sftp/2024/x.

Au demarrage, INFO role mounts several backends: ... donne role=exploitant et writable=[] : verifiez-le apres chaque modification du role.

4. Des roles qui se cumulent

[[roles]]
name = "equipe-a"
[[roles.mounts]]
backend = "disque"
mount_path = "/equipe-a"
home_dir = "/equipes/a"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]

[[roles]]
name = "equipe-b"
[[roles.mounts]]
backend = "disque"
mount_path = "/equipe-b"
home_dir = "/equipes/b"
acl = [{ path = "/", rights = ["read", "write", "list"], recursive = true }]

Un jeton dont la claim groups vaut ["equipe-a", "equipe-b"] ouvre une session avec /equipe-a (lecture) et /equipe-b (lecture et ecriture).

Deux roles sur le meme montage unissent leurs ACL : acme-depot (/in) et acme-releve (/out) sur le montage du cas 2 donnent /in et /out.

5. Des montages ranges : /partenaires/<nom>

Avec acme-amont du cas 3 :

[[roles]]
name = "gestion-partenaires"

[[roles.mounts]]
backend = "disque"
mount_path = "/partenaires/acme"
home_dir = "/partenaires/acme"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]   # "/" : la racine du montage

[[roles.mounts]]
backend = "acme-amont"
mount_path = "/partenaires/amont"
home_dir = "/depot"
acl = [{ path = "/", rights = ["read", "list"], recursive = true }]

/ et /partenaires sont synthetiques ; /partenaires/amont est le /depot de l’amont.