The server accepts configuration as command-line flags, and every flag can
also be set as an environment variable of the same name in uppercase -
-license is LICENSE, -passiveports21 is PASSIVEPORTS21, and so on.
Environment variables are the natural fit for
Docker.
Run ./sfs-server --help for the list your binary supports.
Required
| Flag | Environment | Description |
|---|
-license | LICENSE | Your DocEvent.io license key |
-region | REGION | DocEvent region your configuration lives in: us-east-1, eu-west-1 or ap-southeast-2 |
Ports
| Flag | Environment | Default | Description |
|---|
-port21 | PORT21 | 2021 | FTP + explicit FTPS port |
-port22 | PORT22 | 2022 | SFTP/SCP port - accepts a comma-separated list to listen on several ports |
-port990 | PORT990 | 9990 | Implicit FTPS port |
-passiveports21 | PASSIVEPORTS21 | 2030-2039 | Passive data-port range for FTP/explicit FTPS |
-passiveports990 | PASSIVEPORTS990 | 2040-2049 | Passive data-port range for implicit FTPS |
The two passive ranges belong to two separate FTP servers inside the process -
they must not overlap, or transfers will fail intermittently.
Networking
| Flag | Environment | Default | Description |
|---|
-publicip | PUBLICIP | | The public IP sent to FTP clients for passive connections - required for passive FTP/FTPS to work. Must be an address your clients can route to. |
TLS and SSH identity
| Flag | Environment | Description |
|---|
-tlscert | TLSCERT | TLS certificate file for FTPS (file path or s3 url) |
-tlskey | TLSKEY | TLS certificate key file (file path or s3 url) |
-sshkeyfile | SSHKEYFILE | SSH host private key file, e.g. id_rsa |
-sshkeypassphrase | SSHKEYPASSPHRASE | Passphrase if the key file is encrypted |
Messages and shutdown
| Flag | Environment | Default | Description |
|---|
-welcome | WELCOME | DocEvent.io Simple File Server | FTP welcome message |
-banner | BANNER | DocEvent.io Simple File Server | SSH banner message |
-shutdownwindow | SHUTDOWNWINDOW | 1 | Seconds to let connections finish after a stop signal before forcing shutdown |
-closeportswindow | CLOSEPORTSWINDOW | 1 | Seconds to keep listening ports open while shutting down |
Overload protection
| Flag | Environment | Default | Description |
|---|
-maxconcurrenthandshakes | MAXCONCURRENTHANDSHAKES | 256 | Maximum in-progress pre-login connections per listener; excess connections wait in the kernel backlog |
-handshaketimeout | HANDSHAKETIMEOUT | 60 | Seconds a connection may spend before completing login (0 disables); drops stalled/slowloris connections |
Production mode
| Environment | Default | Description |
|---|
PRODUCTION | 0 | Set to 1 for production mode |
Production mode changes two things:
- Logs are emitted as JSON for your log pipeline - see
Server logging
- The server requires your own SSH key and TLS certificate instead of
generated defaults
Notable options explained
-publicip
Passive FTP works by the server telling the client "connect to me at this
address and port" - the server cannot know its own public address behind NAT,
so you must tell it. If Alice connects to your server at 52.1.1.2, then
-publicip 52.1.1.2 is what makes her passive data connections land on your
server. Without it, passive transfers fail after login. See
Load balancing for what to set when a
load balancer is in front.
