SFTPGo with SWAG

[nothing2obvi]

Hello, I am trying to get SFTPGo to work with SWAG. Please let me know if this is the wrong place to ask for help. I am not an expert at networking at all. I don’t have a static IP but use cloudflare-ddns with SWAG and I want to make the SFTP server available remotely. I disabled the Cloudflare proxy for the sftpgo subdomain. I am able to access the SFTPGo web UI via sftpgo.mydomain.com/web but can’t access the actual SFTP server using port 443, 9443, or 2022. I am able to access the server on my LAN via port 2022 without issues.

This is what I have so far:

## Version 2023/05/31
# REMOVE THIS LINE BEFORE SUBMITTING: The structure of the file (all of the existing lines) should be kept as close as possible to this template.
# REMOVE THIS LINE BEFORE SUBMITTING: Look through this file for <tags> and replace them. Review other sample files to see how things are done.
# REMOVE THIS LINE BEFORE SUBMITTING: The comment lines at the top of the file (below this line) should explain any prerequisites for using the proxy such as DNS or app settings.
# make sure that your sftpgo container is named sftpgo
# make sure that your dns has a cname set for sftpgo

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name sftpgo.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app sftpgo;
        set $upstream_port 2022;
        set $upstream_proto https;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
        #proxy_pass http://10.0.0.94:2022;

        # REMOVE THIS LINE BEFORE SUBMITTING: Additional proxy settings such as headers go below this line, leave the blank line above.
    }

    # REMOVE THIS LINE BEFORE SUBMITTING: Some proxies require one or more additional location blocks for things like API or RPC endpoints.
    # REMOVE THIS LINE BEFORE SUBMITTING: If the proxy you are making a sample for does not require an additional location block please remove the commented out section below.
    location ~ (/sftpgo)?/web {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app sftpgo;
        set $upstream_port 9443;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    
    #     # REMOVE THIS LINE BEFORE SUBMITTING: Additional proxy settings such as headers go below this line, leave the blank line above.
    }
}

The only changes I made in the sftpgo.json file are as follows:

"httpd": {
    "bindings": [
      {
        "port": 9443,
        "address": "",
        "enable_web_admin": true,
        "enable_web_client": true,
        "enable_rest_api": true,
        "enabled_login_methods": 0,
        "enable_https": true,

Any help would be greatly appreciated. Thank you.

[drakkan]

Hello,

I recently saw a similar support request on Reddit (selfhosted) and the response is accurate. However this request is related to SWAG, not SFTPGo, you need to understand the difference between an HTTP and a TCP reverse proxy and howto configure them in SWAG

[nothing2obvi]

Thank you for your response. That was indeed me on Reddit. I'm quite the noob when it comes to NGINX and the documentation I've looked at regarding this particular subject is confusing to me. So I guess I'll just have to use SFTPGo locally for now. Thanks anyway.

[drakkan]

Thank you for your response. That was indeed me on Reddit. I'm quite the noob when it comes to NGINX and the documentation I've looked at regarding this particular subject is confusing to me. So I guess I'll just have to use SFTPGo locally for now. Thanks anyway.

Please check these docs

https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/
https://nginx.org/en/docs/stream/ngx_stream_core_module.html#stream

SSH/SFTP is not http/https