Nginx Proxy | Swag and SSH/SFTP + FTP + WebDav

[jacobwi]

Hi everyone,

Does anyone have Nginx proxy conf example working? Mind sharing?

I tried streaming SSH/SFTP to example.com:22 but didn't get anywhere.

Much appreciated

[drakkan]

Hello,

SFTPGo supports PROXY protocol for SFTP/FTP, for WebDav/HTTP you can use a standard HTTP proxy header.
Check both the SFTPGo and NGINX documentation to configure them appropriately.
I no longer provide free step-by-step support, sorry. Please check the support policy. Thank you

[jacobwi]

Understandable. I just donated and became a backer.

Thank you :)

[drakkan]

Thank you for supporting the project. Much appreciated.

Try something like this for SFTP

stream {
    upstream sftpgo_backend {
        server <sftpgo ip1:port>;
        server <sftpgo ip2:port>;
    }

    server {
        listen              2222;

        proxy_pass          sftpgo_backend;
        proxy_protocol      on;
    }
}

for webdav you can use this:

            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header Host $host;
            client_max_body_size 0;
            proxy_http_version 1.1;
            proxy_pass http://127.0.0.1:10080;

You have to enable the proxy protocol in the SFTPGo configuration. Take a look at the docs. Expand "Configuration file -> Common" to read about the available options (proxy_skipped is only available in the current development version). For WebDAV expand the "WebDAV Server" section and set proxy_allowed, client_ip_proxy_header, client_ip_header_depth.

If something doesn't work, please post your configuration and explain the problem you are having. As a project sponsor, you can also reach me at the dedicated support email address, support at sftpgo.com. Thanks

[jacobwi]

Didn't work. I sent email yesterday

[drakkan]

Didn't work. I sent email yesterday

Hello, I replied, please check your spam folder

[drakkan]

Didn't work. I sent email yesterday

Hi, were you able to solve the issue with the information shared privately?

[jacobwi]

Hello Nicola, I had to disable the Cloudflare proxy to get it to work by following your instructions. Thank you so much!

…

On Thu, Apr 13, 2023 at 12:47 PM Nicola Murino ***@***.***> wrote: Didn't work. I sent email yesterday Hi, were you able to solve the issue with the information shared privately? — Reply to this email directly, view it on GitHub <#1257 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEVBLWZZGO33TUCTA3CM3YLXBAU3TANCNFSM6AAAAAAWXCP7F4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Jacob William 603-892-7597 https://jacobwi.io

[drakkan]

Hello Nicola, I had to disable the Cloudflare proxy to get it to work by following your instructions. Thank you so much!
…
On Thu, Apr 13, 2023 at 12:47 PM Nicola Murino @.> wrote: Didn't work. I sent email yesterday Hi, were you able to solve the issue with the information shared privately? — Reply to this email directly, view it on GitHub <#1257 (reply in thread)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AEVBLWZZGO33TUCTA3CM3YLXBAU3TANCNFSM6AAAAAAWXCP7F4 . You are receiving this because you authored the thread.Message ID: @.>
-- Jacob William 603-892-7597 https://jacobwi.io

Glad it worked. If you have proxy protocol enabled maybe is something like this

[burjuyz]

I'm using the swag proxy server to provide HTTPS access to my SFTPGo application. In the SFTPGo logs, I notice that the real client IP address is not being passed correctly and instead, the IP address of the swag proxy server (e.g., 172.20.0.11) is being displayed. However, in the NGINX logs of the swag proxy server, the real client IP address is displayed correctly.

Steps to Reproduce:

Start SFTPGo and swag in Docker containers.
Connect to SFTPGo through the swag proxy server using a browser or other client.
Review the SFTPGo logs and notice that the real client IP address is incorrectly displayed.
Expected Behavior:
I expect the real client IP address to be passed to SFTPGo through the swag proxy server and displayed correctly in its logs.

Current Behavior:
Instead of the real client IP address, the IP address of the swag proxy server is displayed in the SFTPGo logs.

SFTPGo Version: 2.6.0

swag Version: 2.10.0-ls303

NGINX Version: 1.24.0

Additional Information:

environment:
  - SFTPGO_PROVIDER=sqlite
  - SFTPGO_COMMON__PROXY_PROTOCOL=2
  - SFTPGO_HTTPD_BINDINGS__0__CLIENT_IP_PROXY_HEADER=X-Real-IP
  - SFTPGO_COMMON__PROXY_ALLOWED=172.20.0.11 (swag IP)
  - SFTPGO_HTTPD_BINDINGS__0__PROXY_ALLOWED=172.20.0.11  (swag IP)
  - SFTPGO_COMMON__DEFENDER__SAFELIST=172.20.0.11  (swag IP)

[derekmahar]

What is your SWAG Nginx reverse proxy configuration for SFTPGo?

[derekmahar]

According to Accepting the PROXY Protocol, in order for NGINX to pass the real IP address to the upstream server behind the reverse proxy, SWAG must configure NGINX to accept the PROXY Protocol. Unfortunately, NGINX 1.24.0 in SWAG 2.10.0-ls302 does not appear to configure the PROXY Protocol:

# main server block
server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;

The listen directive is missing parameter proxy_protocol.

[burjuyz]

Do you suggest to change this section?

# main server block
server {
    listen 443 ssl http2 default_server;  to **ssl proxy_protocol;**

If i change to

        listen 443 ssl http2 proxy_protocol;
        listen [::]:443 ssl http2 proxy_protocol;

Sftp doesnt work
*7 broken header: "����������)�V" while reading PROXY protocol, client: 192.168.10.1, server: 0.0.0.0:443

[derekmahar]

I think you'll have to change more directives than just listen. The article explains the details. In order to make this change, though, you would likely have to build a custom SWAG Docker image or convince the SWAG maintainers to add this behaviour. I haven't enabled PROXY Protocol in my server since I don't need this behaviour.

[derekmahar]

Correction: you won't have to create a custom SWAG Docker image since the SWAG container exposes all NGINX configuration to the host file system. You will have to customise more of the NGINX configuration, though, by following the instructions in the article.

[burjuyz]

sftpgo.subdomain.txt
Please check in attachment

[jenny787]

i like your conf file here, thank you. but for webdav, you are using the /dav prefix. how do i set sftpgo to use this? i don't think mine is set that way. I'm setting up sftpgo using docker, I think I need an environment variable for the prefix, can you show me how to set it? Thanks.