thorntech/sftpgateway-backend repository overview

# Generate security credentials
SECURITY_CLIENT_ID=$(openssl rand -hex 16)
SECURITY_CLIENT_SECRET=$(openssl rand -hex 32)
SECURITY_JWT_SECRET=$(uuidgen 2>/dev/null \
  || cat /proc/sys/kernel/random/uuid 2>/dev/null \
  || openssl rand -hex 16)

# Generate a self-signed TLS certificate (valid for 1 year)
openssl req -x509 -newkey rsa:2048 -keyout tls.key -out tls.crt \
  -days 365 -nodes -subj "/CN=localhost" 2>/dev/null

# Save everything to .env (Docker Compose reads this automatically)
{
  echo "SECURITY_CLIENT_ID=${SECURITY_CLIENT_ID}"
  echo "SECURITY_CLIENT_SECRET=${SECURITY_CLIENT_SECRET}"
  echo "SECURITY_JWT_SECRET=${SECURITY_JWT_SECRET}"
  printf 'WEBSITE_BUNDLE_CRT="%s"\n' "$(cat tls.crt)"
  printf 'WEBSITE_KEY="%s"\n' "$(cat tls.key)"
} > .env

rm -f tls.crt tls.key
echo "Credentials saved to .env"

services:

  db:
    container_name: sftpgw_container_db
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: sftpgw
      POSTGRES_USER: sftpgw
      POSTGRES_PASSWORD: sftpgw
      PGDATA: /var/lib/postgresql/data/pgdata
      POSTGRES_INITDB_ARGS: "--data-checksums"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U sftpgw -d sftpgw"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - sftpgw-network

  init-permissions:
    image: thorntech/sftpgateway-backend:3.8.3
    user: root
    entrypoint: ["/bin/sh", "-c"]
    command: ["chown -R sftpgw:sftpgw /mnt/sftpgw_1"]
    volumes:
      - mount:/mnt/sftpgw_1

  backend:
    container_name: backend
    image: thorntech/sftpgateway-backend:3.8.3
    depends_on:
      db:
        condition: service_healthy
      init-permissions:
        condition: service_completed_successfully
    environment:
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/sftpgw
      SPRING_DATASOURCE_USERNAME: sftpgw
      SPRING_DATASOURCE_PASSWORD: sftpgw
      SECURITY_CLIENT_ID: ${SECURITY_CLIENT_ID}
      SECURITY_CLIENT_SECRET: ${SECURITY_CLIENT_SECRET}
      SECURITY_JWT_SECRET: ${SECURITY_JWT_SECRET}
      SERVER_PORT: 8080
      FEATURES_FIRST_CONNECTION_CLOUD_PROVIDER: lfs
      FEATURES_FIRST_CONNECTION_BASE_PREFIX: /mnt/sftpgw_1
      AWS_REGION: ${AWS_REGION:-us-east-1}
      HOME: /home/sftpgw
    volumes:
      - sftpgw_home:/home/sftpgw
      - mount:/mnt/sftpgw_1
    ports:
      - "8080:8080"
      - "2244:22"
    user: "sftpgw"
    working_dir: /opt/sftpgw
    restart: unless-stopped
    networks:
      - sftpgw-network

  ui:
    container_name: sftpgw-ui
    image: thorntech/sftpgateway-admin-ui:3.8.3
    environment:
      BACKEND_URL: http://backend:8080/
      SECURITY_CLIENT_ID: ${SECURITY_CLIENT_ID}
      SECURITY_CLIENT_SECRET: ${SECURITY_CLIENT_SECRET}
      CLOUD_PROVIDER: lfs
      WEBSITE_BUNDLE_CRT: ${WEBSITE_BUNDLE_CRT}
      WEBSITE_KEY: ${WEBSITE_KEY}
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    networks:
      - sftpgw-network

volumes:
  postgres_data:
    driver: local
  sftpgw_home:
    driver: local
  mount:
    driver: local

networks:
  sftpgw-network:
    driver: bridge

docker compose up -d

# View attestations with Docker Scout
docker scout attestation list thorntech/sftpgateway-backend:latest

# Inspect SBOM and provenance with buildx
docker buildx imagetools inspect thorntech/sftpgateway-backend:latest --format '{{json .SBOM}}'
docker buildx imagetools inspect thorntech/sftpgateway-backend:latest --format '{{json .Provenance}}'