> For the complete documentation index, see [llms.txt](https://docs.elimity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.elimity.com/gateways-ntfs/step-by-step-deployment-guide.md).

# Step-by-step deployment guide

{% hint style="info" %}
This version of the gateway is currently compatible with Elimity Insights server versions matching `>=3.43.0`.
{% endhint %}

## 1. Ensuring your files are accessible to the gateway

The Elimity Insights gateway for NTFS scans from the container's local filesystem. This means you have to explicitly mount all the files you want to target. Refer to the sections below for additional details.

### Local directories

Let's assume you deploy the gateway on a plain Windows Server VM and want to scan some directories on the local filesystem: `C:\dir1\subdir` and `D:\dir2`. The following Docker Compose specification would be a good starting point:

```yaml
services:
  ntfs-gateway:
    image: europe-west1-docker.pkg.dev/elimity-general/docker/ntfs-gateway:<tag>
    restart: always
    ports:
      - 8080:80
    volumes:
      - .\config:C:\app\config
      - C:\dir1\subdir:C:\target1
      - D:\dir2:C:\target2
```

In this case you would typically configure the built-in connector to target `C:\target1` and `C:\target2`. Note that you can freely choose the destination paths for these mounts.

### SMB shares via host mount

Scanning permissions for SMB shares is very similar to scanning permissions for local directories, we just need one extra preliminary step to mount the shares into the local filesystem. Microsoft provides explicit support for making SMB share mounts available to containers, [the official documentation](https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/persistent-storage#smb-mounts) contains detailed instructions about setting this up. In short: to mount a directory `dir` in share `\\host\share` to local drive `D:`, run the following PowerShell command:

```powershell
PS C:\> New-SmbGlobalMapping D: \\host\share\dir -Persistent $true
```

You can now mount the `D:` drive into the NTFS gateway container using a Docker Compose specification based on the following snippet:

```yaml
services:
  ntfs-gateway:
    image: europe-west1-docker.pkg.dev/elimity-general/docker/ntfs-gateway:<tag>
    restart: always
    ports:
      - 8080:80
    volumes:
      - .\config:C:\app\config
      - D:\:C:\target
```

### SMB shares via container mount

The NTFS gateway also supports mounting SMB shares directly from within the container. In this case you don't need to mount them from the host. Instead use the `connection` configuration option to provide SMB share addresses and credentials to the gateway. After mounting the shares you can use their UNC paths in [the built-in connector's target configuration](/reference-manual/built-in-connectors/ntfs/targets-configuration.md). Refer to [the dedicated section on this page](#id-3.-configuring-the-gateway) for additional information. Note that this approach is especially suitable for serverless deployments on e.g. Azure App Service.

## 2. Configuring the gateway

To configure your gateway, mount a JSON configuration file at `/app/config/config.json` with the properties listed below. Alternatively you can also fill the `NTFS_GATEWAY_CONFIG_JSON` environment variable with the contents of this file. Refer to the following attachment for a starting point:

{% file src="/files/yK6el9cOaJHFBToaz1wc" %}

Edit the following properties in this file to configure the gateway to your needs:

<table data-full-width="true"><thead><tr><th>Property</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td><code>connection</code></td><td><code>option[object]</code></td><td>Configuration object describing which network resources the gateway should connect with before scanning</td></tr><tr><td><code>connection.networkResources</code></td><td><code>list[string]</code></td><td>UNC paths of the network resources to connect with, e.g. <code>"\\\\host\\share\\dir"</code></td></tr><tr><td><code>connection.password</code></td><td><code>string</code></td><td>Password to authenticate network resource connections</td></tr><tr><td><code>connection.userName</code></td><td><code>string</code></td><td>Username to authenticate network resource connections</td></tr><tr><td><code>jwtValidationAudiences</code></td><td><code>option[list[string]]</code></td><td>Audiences for JWT validation, defaults to <code>["gateway"]</code></td></tr><tr><td><code>jwtValidationBaseUrl</code></td><td><code>string</code></td><td>Expected Elimity Insights base URL for JWT validation, e.g. <code>"https://example.elimity.com"</code></td></tr><tr><td><code>jwtValidationGatewayUrl</code></td><td><code>string</code></td><td>Expected gateway URL for JWT validation, e.g. <code>"https://gateway.example.com"</code></td></tr><tr><td><code>jwtValidationIssuer</code></td><td><code>option[string]</code></td><td>Issuer for JWT validation, defaults to <code>"https://auth.elimity.com/"</code></td></tr><tr><td><code>jwtValidationExpr</code></td><td><code>option[string]</code></td><td><a href="https://expr-lang.org/">Expr</a> program implementing JWT custom claim validation, defaults to <code>"claims.base_url == baseURL &#x26;&#x26; claims.gateway_url == gatewayURL &#x26;&#x26; claims.source_id == sourceID"</code></td></tr><tr><td><code>jwtValidationOptional</code></td><td><code>option[boolean]</code></td><td>Flag indicating whether JWT validation is optional, defaults to <code>false</code></td></tr><tr><td><code>jwtValidationSourceId</code></td><td><code>string</code></td><td>Expected source id for JWT validation, e.g. <code>"42"</code></td></tr></tbody></table>

### JWT validation

We highly recommend requiring JWT validation to secure your gateway. Please read our official documentation about the following topics to understand how Elimity Insights authenticates to gateways via OAuth2:

* [Gateway-based imports](https://docs.elimity.com/reference-manual/~/changes/33/advanced-topics/gateway-based-imports#authenticating-with-gateways)
* [OAuth2 endpoint parameters for gateway authentication](https://docs.elimity.com/reference-manual/~/changes/33/advanced-topics/gateway-based-imports)

Our SaaS customers can simply set the `jwtValidationBaseUrl`, `jwtValidationGatewayUrl` and `jwtValidationSourceId` configuration options, which provides the following security guarantees:

* Only requests coming from the configured Elimity Insights tenant are allowed
* Only requests targeting the configured gateway URL are allowed
* Only requests for importing the configured source are allowed

On-premise customers should additionally set the `jwtValidationAudiences`, `jwtValidationIssuer` and `jwtValidationExpr` configuration options. Alternatively you can also set `jwtValidationOptional` to `true` and perform authentication in a proxy instead.

## 3. Deploying the gateway

Having configured the gateway we can now deploy it so the built-in connector can start importing. Since we distribute the gateway as a Docker image, our recommendation for deployment is to use a CaaS solution like Azure App Service. If that's not an option, you can also manually deploy the image on e.g. Windows Server. Refer to [our documentation about gateways and import agents](/technical-guides/gateways-and-import-agents.md) for additional details.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.elimity.com/gateways-ntfs/step-by-step-deployment-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.