Global Options
These are options that apply to the gateway itself independent of any backend type. When available, the shorthand option can be used in place of the long option. Alternatively, the optional environment variable setting is specified in []s. Setting this env var has the same effect as using the command line option. For boolean options set env var value to "true", for example VGW_QUIET=true.
--version, -v list versitygw version (default: false)
The version option will print the current binary version and exit. For example:
$ ./versitygw --version
Version : v0.1
Build : a881893
BuildTime: 2023-05-29_05:16:34AM --port value, -p value gateway listen address <ip>:<port> or :<port> (default: ":7070") [$VGW_PORT]
The port option will specify the listening port for the S3 server. This option can use either the form <ip>:<port> which will listen only on the network interface that matches the IP on the specified port, or :<port> which will listen on all network interfaces on the specified port. The <ip> spec can either be IP dotted notation or a resolvable hostname. The <port> spec can either be a numeric port or the service name typically in /etc/services.
This option will determine the S3 client endpoint to use. For example --port 192.168.0.1:6000 would require the S3 client to configure a server endpoint that would connect to this server endpoint such as http://192.168.0.1:6000.
--access value root user access key [$ROOT_ACCESS_KEY_ID, $ROOT_ACCESS_KEY]
--secret value root user secret access key [$ROOT_SECRET_ACCESS_KEY, $ROOT_SECRET_KEY]
--region value s3 region string (default: "us-east-1") [$VGW_REGION]
The access and secret options will specify the root account credentials. The root account is granted full authorization to all API requests after authentication. This is generally useful for creating user level buckets and assigning ACL grants. The access and secret options can be specified through environment variables (access: ROOT_ACCESS_KEY_ID or ROOT_ACCESS_KEY) (secret: ROOT_SECRET_ACCESS_KEY or ROOT_SECRET_KEY) or with the command line options. The environment variables can help to hide the credentials from process listings. The region is an optional argument, and will default to us-east-1 if not specified.
--cors-allow-origin value default CORS Access-Control-Allow-Origin value (applied when no bucket CORS configuration exists, and for admin APIs) [$VGW_CORS_ALLOW_ORIGIN]
The cors-allow-origin option sets a default CORS (Cross-Origin Resource Sharing) Access-Control-Allow-Origin header value. This is applied when no bucket-specific CORS configuration exists, and is also used for admin API responses. This is useful for allowing web applications from specific domains to access the gateway.
--cert value TLS cert file [$VGW_CERT]
--key value TLS key file [$VGW_KEY]
The cert and key values are optional. When not specified, the server will not use TLS. To enable TLS connections, both cert and key must be provided. The value for these options are the filenames for the respective options. The files must contain PEM encoded data. The certificate file may contain intermediate certificates following the leaf certificate to form a certificate chain.
--admin-port value, --ap value gateway admin server listen address <ip>:<port> or :<port> [$VGW_ADMIN_PORT]
--admin-cert value TLS cert file for admin server [$VGW_ADMIN_CERT]
--admin-cert-key value TLS key file for admin server [$VGW_ADMIN_CERT_KEY]
The admin server endpoint can optionally be set to listen on a different interface or port than the S3 service. This allows for better control of firewall restrictions to the admin endpoint. The certs for this can be different certs than specified for the S3 service. The default when these are not specified is to have the admin server listen on the same endpoint as the S3 service.
--virtual-domain value, --vd value enables the virtual host style bucket addressing with the specified arg as the base domain [$VGW_VIRTUAL_DOMAIN]
The virtual domain option enables the virtual host style bucket addressing. The path style addressing is the default, and remains enabled even when virtual host style is enabled. The virtual domain option specifies the domain name that will be used for the virtual host style addressing. For virtual addressing, access to a bucket is in the request form:
https://<bucket>.<VGW_VIRTUAL_DOMAIN>/
for example: https://mybucket.example.com/ where virtual domain option is set to example.com and all subdomains of the virtual domain should be reserved for buckets. This means that virtual host addressing will generally require a DNS entry for each bucket that needs to be accessed. The default path style request is of the form:
https://<VGW_ENDPOINT>/<bucket>
--quiet, -q silence stdout request logging output (default: false) [$VGW_QUIET]
The quiet option will silence the request info output enabled by default to stdout.
--access-log value enable server access logging to specified file [$LOGFILE, $VGW_ACCESS_LOG]
The access-log value is optional. When defined, the server will write s3 server access log output to the specified file. It is suggested to use absolute paths for the server log file because the server may chdir into the backend root directory and change locations for relative paths. This option can also be set through LOGFILE env var. This option can only be set if log-webhook-url is not set. See LogFile for more details and log format.
--admin-access-log value enable admin server access logging to specified file [$LOGFILE, $VGW_ADMIN_ACCESS_LOG]
The admin-access-log is similar to the access-log option, but is logging access to the versitygw admin API generally used for user management and bucket ownership.
--log-webhook-url value webhook url to send the audit logs [$WEBHOOK]
The log-webhook-url is optional. When defined, the server will send s3 server access log entries to the provided webhook URL formatted as json. This option can also be set through WEBHOOK env var . This option can only be set if access-log is not set. See Webhook for more details and log format.
--health value health check endpoint path. Health endpoint will be configured on GET http method: GET <health>
NOTICE: the path has to be specified with '/'. e.g /health [$VGW_HEALTH]
The health options specifies a health check endpoint often used for load balancers to verify gateway is alive. The health endpoint masks any bucket with this setting. For example, if the health endpoint is set to /health, the gateway will not allow creating or listing contents of a bucket called health. The health endpoint is unauthenticated, and returns a 200 status for GET.
--event-kafka-url value, --eku value kafka server url to send the bucket notifications. [$VGW_EVENT_KAFKA_URL]
--event-kafka-topic value, --ekt value kafka server pub-sub topic to send the bucket notifications to [$VGW_EVENT_KAFKA_TOPIC]
--event-kafka-key value, --ekk value kafka server put-sub topic key to send the bucket notifications to [$VGW_EVENT_KAFKA_KEY]
Bucket events can be sent to a kafka message bus. When event-kafka-url, event-kafka-topic, and optionally event-kafka-key are specified, all configured bucket events will be sent to the kafka service. See Events-Notifications for more details and format.
--event-nats-url value, --enu value nats server url to send the bucket notifications [$VGW_EVENT_NATS_URL]
--event-nats-topic value, --ent value nats server pub-sub topic to send the bucket notifications to [$VGW_EVENT_NATS_TOPIC]
Bucket events can be sent to a NATS messaging service. When event-nats-url and event-nats-topic are specified, all configured bucket events will be sent to the NATS messaging service. See Events-Notifications for more details and format.
--event-rabbitmq-url value, --eru value rabbitmq server url to send the bucket notifications (amqp or amqps scheme) [$VGW_EVENT_RABBITMQ_URL]
--event-rabbitmq-exchange value, --ere value rabbitmq exchange to publish bucket notifications to (blank for default) [$VGW_EVENT_RABBITMQ_EXCHANGE]
--event-rabbitmq-routing-key value, --errk value rabbitmq routing key when publishing bucket notifications (defaults to bucket name when blank) [$VGW_EVENT_RABBITMQ_ROUTING_KEY]
Bucket events can be sent to a RabbitMQ messaging service. When event-rabbitmq-url is specified, all configured bucket events will be sent to the RabbitMQ service. The exchange and routing key are optional parameters that allow for more granular message routing. If the routing key is not specified, it defaults to the bucket name. See Events-Notifications for more details and format.
--event-webhook-url value, --ewu value webhook url to send bucket notifications [$VGW_EVENT_WEBHOOK_URL]
Bucket events can be sent to a webhook URL. When event-webhook-url is specified, all configured bucket events will be sent to the NATS messaging service. See Events-Notifications for more details and format.
--event-filter value, --ef value bucket event notifications filters configuration file path [$VGW_EVENT_FILTER]
Bucket events can be filtered using the notifications filters configuration file to only send configured events to the enabled event service. This is used in conjunction with one of the service event options. See Events-Notifications for more details and format.
--iam-dir value if defined, run internal iam service within this directory [$VGW_IAM_DIR]
The iam-dir option will enable the internal IAM service with accounts stored in a file under the specified directory. This is provided to minimize dependencies on outside services for basic functionality. The local account files are plain text and only protected with file permissions. This IAM service is added for convenience, but is not considered as secure or scalable as a dedicated IAM service. See Multi-Tenant for more details.
--iam-ldap-url value ldap server url to store iam data [$VGW_IAM_LDAP_URL]
--iam-ldap-bind-dn value ldap server binding dn, example: 'cn=admin,dc=example,dc=com' [$VGW_IAM_LDAP_BIND_DN]
--iam-ldap-bind-pass value ldap server user password [$VGW_IAM_LDAP_BIND_PASS]
--iam-ldap-query-base value ldap server destination query, example: 'ou=iam,dc=example,dc=com' [$VGW_IAM_LDAP_QUERY_BASE]
--iam-ldap-object-classes value ldap server object classes used to store the data. provide it as comma separated string, example: 'top,person' [$VGW_IAM_LDAP_OBJECT_CLASSES]
--iam-ldap-access-atr value ldap server user access key id attribute name [$VGW_IAM_LDAP_ACCESS_ATR]
--iam-ldap-secret-atr value ldap server user secret access key attribute name [$VGW_IAM_LDAP_SECRET_ATR]
--iam-ldap-role-atr value ldap server user role attribute name [$VGW_IAM_LDAP_ROLE_ATR]
--iam-ldap-user-id-atr value ldap server user id attribute name [$VGW_IAM_LDAP_USER_ID_ATR]
--iam-ldap-group-id-atr value ldap server user group id attribute name [$VGW_IAM_LDAP_GROUP_ID_ATR]
--iam-ldap-project-id-atr value ldap server user project id attribute name [$VGW_IAM_LDAP_PROJECT_ID_ATR]
--iam-ldap-tls-skip-verify disable TLS certificate verification for LDAP connections (insecure, for self-signed certificates) (default: false) [$VGW_IAM_LDAP_TLS_SKIP_VERIFY]
The ldap options will enable the LDAP IAM service with accounts stored in an external LDAP service. The iam-ldap-access-atr, iam-ldap-secret-atr, and iam-ldap-role-atr define the LDAP attributes that map to access, secret credentials and role respectively. The iam-ldap-tls-skip-verify option disables TLS certificate verification, which is useful for development environments with self-signed certificates but should not be used in production. See Multi-Tenant for more details.
--iam-vault-endpoint-url value vault server url [$VGW_IAM_VAULT_ENDPOINT_URL]
--iam-vault-namespace value vault server namespace [$VGW_IAM_VAULT_NAMESPACE]
--iam-vault-secret-storage-path value vault server secret storage path [$VGW_IAM_VAULT_SECRET_STORAGE_PATH]
--iam-vault-secret-storage-namespace value vault server secret storage namespace [$VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE]
--iam-vault-auth-method value vault server auth method [$VGW_IAM_VAULT_AUTH_METHOD]
--iam-vault-auth-namespace value vault server auth namespace [$VGW_IAM_VAULT_AUTH_NAMESPACE]
--iam-vault-mount-path value vault server mount path [$VGW_IAM_VAULT_MOUNT_PATH]
--iam-vault-root-token value vault server root token [$VGW_IAM_VAULT_ROOT_TOKEN]
--iam-vault-role-id value vault server user role id [$VGW_IAM_VAULT_ROLE_ID]
--iam-vault-role-secret value vault server user role secret [$VGW_IAM_VAULT_ROLE_SECRET]
--iam-vault-server_cert value vault server TLS certificate [$VGW_IAM_VAULT_SERVER_CERT]
--iam-vault-client_cert value vault client TLS certificate [$VGW_IAM_VAULT_CLIENT_CERT]
--iam-vault-client_cert_key value vault client TLS certificate key [$VGW_IAM_VAULT_CLIENT_CERT_KEY]
The Vault IAM options enable the HashiCorp Vault IAM service with accounts stored in a Vault server. This service stores IAM credentials in the kv-v2 engine and supports root token authentication (not recommended for production) and role-based authentication. The gateway uses the access key as the key and stores the JSON serialized account data as the value. This IAM service is intended to be managed through the versitygw admin commands similar to the internal IAM service. See IAM-Vault for more details and configuration examples.
--s3-iam-access value s3 IAM access key [$VGW_S3_IAM_ACCESS_KEY]
--s3-iam-secret value s3 IAM secret key [$VGW_S3_IAM_SECRET_KEY]
--s3-iam-region value s3 IAM region (default: "us-east-1") [$VGW_S3_IAM_REGION]
--s3-iam-bucket value s3 IAM bucket [$VGW_S3_IAM_BUCKET]
--s3-iam-endpoint value s3 IAM endpoint [$VGW_S3_IAM_ENDPOINT]
--s3-iam-noverify s3 IAM disable ssl verification (default: false) [$VGW_S3_IAM_NO_VERIFY]
--s3-iam-debug s3 IAM debug output (default: false) [$VGW_S3_IAM_DEBUG]
The S3 IAM service is similar to the internal IAM service, but instead stores the account information JSON encoded in an S3 object. This should use a bucket that is not accessible to general users when using s3 backend to prevent access to account credentials. This IAM service is added for convenience, but is not considered as secure or scalable as a dedicated IAM service. See Multi-Tenant for more details.
--ipa-host value FreeIPA server url e.g. https://ipa.example.test [$VGW_IPA_HOST]
--ipa-vault-name value A name of the user vault containing their secret [$VGW_IPA_VAULT_NAME]
--ipa-user value Username used to connect to FreeIPA. Needs permissions to read user vault contents [$VGW_IPA_USER]
--ipa-password value Password of the user used to connect to FreeIPA. [$VGW_IPA_PASSWORD]
--ipa-insecure Verify TLS certificate of FreeIPA server. Default is 'true'. (default: false) [$VGW_IPA_INSECURE]
--ipa-debug FreeIPA IAM debug output (default: false) [$VGW_IPA_DEBUG]
The ipa options will enable the FreeIPA IAM service. This service does not allow user management through versitygw admin commands, and instead requires accounts be directly managed in the FreeIPA server. See Multi-Tenant for more details.
--iam-cache-disable disable local iam cache (default: false) [$VGW_IAM_CACHE_DISABLE]
--iam-cache-ttl value local iam cache entry ttl (seconds) (default: 120) [$VGW_IAM_CACHE_TTL]
--iam-cache-prune value local iam cache cleanup interval (seconds) (default: 3600) [$VGW_IAM_CACHE_PRUNE]
--iam-debug enable IAM debug output (default: false) [$VGW_IAM_DEBUG]
The IAM cache is intended to ease the load on the IAM service and increase the Gateway performance by caching accounts and credentials for the TTL time interval. Disabling this will cause a request to the configured IAM service for each incoming request to retrieve the corresponding account credentials. The cache is enabled by default. The TTL specifies how long to cache credentials, and the prune value determines the interval for expired entries to be removed from the cache. Increasing the TTL may lessen the load on the IAM service backend, but may have out of date account info until the next interval. Increasing the prune value may reduce memory use at the cost of added CPU to check cache expirations. See Multi-Tenant for more details.
--readonly allow only read operations across all the gateway (default: false) [$VGW_READ_ONLY]
The read only option disables all write actions through the gateway. This will only allow S3 API calls that do not change any data in the backend storage system. All API calls that attempt to create, upload, or delete objects through the gateway will get AccessDenied (HTTP Forbidden/403).
--disable-strict-bucket-names allow relaxed bucket naming (disables strict validation checks) (default: false) [$VGW_DISABLE_STRICT_BUCKET_NAMES]
The disable-strict-bucket-names option allows for more relaxed bucket naming conventions. By default, the gateway enforces strict bucket naming rules following AWS S3 standards (e.g., lowercase letters, numbers, hyphens, 3-63 characters). When this option is enabled, these strict validation checks are disabled to allow for more flexible bucket names that may not conform to AWS standards but are needed for compatibility with certain backends or legacy systems.
--metrics-service-name value, --msn value service name tag for metrics, hostname if blank [$VGW_METRICS_SERVICE_NAME]
Optional when enabling a metrics endpoint, setting the metrics-service-name will override the default hostname for service name metrics tag. By default all metrics are tagged with "service"=$HOSTNAME. See Metrics for more details.
--metrics-statsd-servers value, --mss value StatsD server urls comma separated. e.g. 'statsd1.example.com:8125,statsd2.example.com:8125' [$VGW_METRICS_STATSD_SERVERS]
Setting metrics-statsd-servers enables sending StatsD metrics to the provided endpoints. The StatsD metrics are sent using InfluxDB flavor StatsD tags. The value for this option is a comma separated list of all endpoints that metrics should be sent to. See Metrics for more details.
--metrics-dogstatsd-servers value, --mds value DogStatsD server urls comma separated. e.g. '127.0.0.1:8125,dogstats.example.com:8125' [$VGW_METRICS_DOGSTATS_SERVERS]
Setting metrics-dogstatsd-servers enables sending DataDog DogStatsD StatsD metrics to the provided endpoints. The value for this option is a comma separated list of all endpoints that metrics should be sent to. The typical value for this would be the local DataDog agent listening on 127.0.0.1:8125. See Metrics for more details.
--debug enable debug output (default: false) [$VGW_DEBUG]
The debug option will print debug output such as request signing information.
--pprof value enable pprof debug on specified port [$VGW_PPROF]
The pprof option enables the pprof HTTP server for profiling the gateway while the process is running. See Profiling for more information.
--keep-alive enable keep-alive connections (for finnicky clients) (default: false) [$VGW_KEEP_ALIVE]
The keep-alive option enables HTTP keep-alive connections. By default, the gateway disables keep-alive to ensure compatibility with a wide range of S3 clients. However, some clients may benefit from keep-alive being enabled. Use this option if you experience connection issues with specific S3 clients.
--help, -h show help
The help option prints the command usage and exits.
