[Infra][MinIO] Optional: replace sftp stack with MinIO SFTP mode (epic #413) #532

New Issue

2026-07-13T00:40:43Z

spikerj commented

2026-07-13 00:40:43 +00:00

Parent epic: #413. Optional / opportunistic.

Replace the standalone sftp stack (atmoz/sftp, binds /mnt/fusionio/sftp) with MinIO's built-in SFTP mode (minio server --sftp="address=:8022" ...) so SFTP drops land directly in a bucket and the stack + bind disappear. Check consumers of /mnt/fusionio/sftp first — if nothing automated reads it, this may be retire-rather-than-migrate.

Parent epic: #413. **Optional / opportunistic.** Replace the standalone `sftp` stack (`atmoz/sftp`, binds `/mnt/fusionio/sftp`) with MinIO's built-in SFTP mode (`minio server --sftp="address=:8022" ...`) so SFTP drops land directly in a bucket and the stack + bind disappear. Check consumers of `/mnt/fusionio/sftp` first — if nothing automated reads it, this may be retire-rather-than-migrate.

spikerj referenced this issue

2026-07-13 00:41:02 +00:00

[Infra][Architecture] Provider-agnostic object storage (MinIO -> S3/Azure Blob) to replace GlusterFS/host-path model #413

spikerj commented

2026-07-14 03:00:30 +00:00

Consumer audit done (repo-side) — recommendation: retire, don't migrate.

Findings:

Zero code consumers: not one reference to sftp (path, host, or port) anywhere in spikersoft-backend — no service reads /mnt/fusionio/sftp.
No infra consumers: no other stack mounts or references the path.
The stack itself (sftp/docker-swarm.yml) is 13 lines: atmoz/sftp with hardcoded foo:pass credentials on published port 2222, SERVER-pinned to the fusionio bind. As-is it's less a service than an open password on the LAN — retiring it is also a security win (and one less fusionio dependency for #529's cutover accounting).

One human check before pulling the plug (needs host access): ls -la /mnt/fusionio/sftp on SERVER — if there's anything recent in there, someone/something outside the repos uses it (a person's upload drop?). Empty or ancient ⇒ docker stack rm sftp + delete sftp/ from the repo.

If you DO want to keep an SFTP ingress: our pinned MinIO (RELEASE.2025-09-07) supports native SFTP — add --sftp="address=:8022" to the server command and drops land straight in a bucket under the caller's MinIO identity (no shared foo:pass, no bind, no extra stack). Happy to author that as a GATED PR — but only worth bundling into a MinIO redeploy window, and only if the answer to the usage check isn't "nobody".

— macbook-claude-session

Consumer audit done (repo-side) — **recommendation: retire, don't migrate.** **Findings:** - **Zero code consumers**: not one reference to sftp (path, host, or port) anywhere in spikersoft-backend — no service reads `/mnt/fusionio/sftp`. - **No infra consumers**: no other stack mounts or references the path. - The stack itself (`sftp/docker-swarm.yml`) is 13 lines: `atmoz/sftp` with **hardcoded `foo:pass` credentials** on published port 2222, SERVER-pinned to the fusionio bind. As-is it's less a service than an open password on the LAN — retiring it is also a security win (and one less fusionio dependency for #529's cutover accounting). **One human check before pulling the plug** (needs host access): `ls -la /mnt/fusionio/sftp` on SERVER — if there's anything recent in there, someone/something outside the repos uses it (a person's upload drop?). Empty or ancient ⇒ `docker stack rm sftp` + delete `sftp/` from the repo. **If you DO want to keep an SFTP ingress**: our pinned MinIO (`RELEASE.2025-09-07`) supports native SFTP — add `--sftp="address=:8022"` to the server command and drops land straight in a bucket under the caller's MinIO identity (no shared foo:pass, no bind, no extra stack). Happy to author that as a GATED PR — but only worth bundling into a MinIO redeploy window, and only if the answer to the usage check isn't "nobody". — macbook-claude-session

spikerj commented

2026-07-18 18:01:19 +00:00

Epic #413 accuracy pass (2026-07-18) — still OPEN, decision pending; state unchanged.

Re-verified: sftp/docker-swarm.yml is still on infra master, unchanged — atmoz/sftp with hardcoded foo:pass, published port 2222, /mnt/fusionio/sftp bind, SERVER pin. The 2026-07-14 audit stands (zero code or infra consumers).

The only thing between this ticket and resolution is the human check: ls -la /mnt/fusionio/sftp on SERVER. If empty/ancient → docker stack rm sftp + delete sftp/ from the repo (also removes a hardcoded-credential exposure and one more fusionio dependency from the epic's accounting). @spikerj — one command whenever convenient.

**Epic #413 accuracy pass (2026-07-18) — still OPEN, decision pending; state unchanged.** Re-verified: `sftp/docker-swarm.yml` is still on infra master, unchanged — `atmoz/sftp` with hardcoded `foo:pass`, published port 2222, `/mnt/fusionio/sftp` bind, SERVER pin. The 2026-07-14 audit stands (zero code or infra consumers). The only thing between this ticket and resolution is the human check: **`ls -la /mnt/fusionio/sftp` on SERVER**. If empty/ancient → `docker stack rm sftp` + delete `sftp/` from the repo (also removes a hardcoded-credential exposure and one more fusionio dependency from the epic's accounting). @spikerj — one command whenever convenient.

spikerj referenced this issue

2026-07-18 18:02:04 +00:00

[Infra][Architecture] Provider-agnostic object storage (MinIO -> S3/Azure Blob) to replace GlusterFS/host-path model #413

spikerj referenced this issue

2026-07-29 17:14:14 +00:00

[Infra][Architecture] Provider-agnostic object storage (MinIO -> S3/Azure Blob) to replace GlusterFS/host-path model #413

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#532