Storage-Publiclink Service Configuration

Introduction

The Infinite Scale Storage-Publiclink service

Default Values

  • Storage-Publiclink listens on port 9175 by default.

Brute Force Protection

Brute force protection prevents access to public links if incorrect passwords are entered. Its implementation is very similar to that of a rate limiter, but it takes into account only incorrect password attempts.

This feature:

  • Is enabled by default with the standard settings.
    To disable the feature, set the relevant configuration values to 0.

  • If enabled, brute force protection uses a configurable store, see section Storing. No additional configuration is required if the global configuration (OCIS_) is used alongside the other default store settings.

By default, you’re allowed a maximum of 5 failed attempts in 1 hour:

  • STORAGE_PUBLICLINK_BRUTEFORCE_TIMEGAP=1h

  • STORAGE_PUBLICLINK_BRUTEFORCE_MAXATTEMPTS=5

You can adjust these values as you wish to define the failure rate threshold.

  • If a public link is blocked by brute force protection, it will be blocked for all users, regardless of whether an attempt has been successful in the meantime.

  • If the failure rate threshold is exceeded, the public link will be blocked until such rate goes below the threshold.

    • This means that it will remain blocked for an undefined time: a couple of seconds in the best case, or up to the setting of STORAGE_PUBLICLINK_BRUTEFORCE_TIMEGAP in the worst case.

    • After blocking, each new unsuccessful attempt retriggers the timer.

Storing

The storage-publiclink service can use a configured store via the global OCIS_PERSISTENT_STORE environment variable.

Note that for each global environment variable, an independent service-based one might be available additionally. For precedences see Environment Variable Notes. Check the configuration section below. Supported stores are:

Store Type Description

memory

Basic in-memory store. Will not survive a restart.
Usually the default for caches. See the store environment variable for which one is used.

nats-js-kv

Stores data using key-value-store feature of NATS JetStream.
Usually the default for stores, see the store environment variable for which one is used.

redis-sentinel

Stores data in a configured Redis Sentinel cluster.

noop

Stores nothing. Useful for testing. Not recommended in production environments.
The storage-publiclink service can only be scaled if not using the memory store and the stores are configured identically over all instances!
If you have used one of the deprecated stores of a former version, you should reconfigure to use one of the supported ones as the deprecated stores will be removed in a later version.
Store specific notes

  • When using redis-sentinel:
    The Redis master to use is configured via e.g. OCIS_PERSISTENT_STORE_NODES in the form of <sentinel-host>:<sentinel-port>/<redis-master> like 10.10.0.200:26379/mymaster.

  • When using nats-js-kv:

    • It is recommended to set OCIS_PERSISTENT_STORE_NODES to the same value as OCIS_EVENTS_ENDPOINT. That way the cache uses the same nats instance as the event bus. See the Event Bus Configuration for more details.

    • Authentication can be added, if configured, via OCIS_CACHE_AUTH_USERNAME and OCIS_CACHE_AUTH_PASSWORD.

    • It is possible to set OCIS_CACHE_DISABLE_PERSISTENCE to instruct nats to not persist cache data on disc.

Note that the storage-publiclink service does not use the event bus, but other services like the userlog service do.

Configuration

Environment Variables

The storage-publiclink service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.

404: Not Found

  • 8.2.0

404: Not Found

YAML Example

  • 8.2.0

404: Not Found