SFTP server¶
The SFTP template (Storage category) deploys an SFTP server (SFTPGo) with its own persistent volume. Use it to receive files from, or make files available to, partners, customers or scripts, from the internal network or from the Internet.
| Field | Role |
|---|---|
| Storage size (Capacity tab) | Volume for uploaded files and the account database, 10Gi by default. |
| Attach an existing volume (Capacity tab) | Reuses the volume of a deleted SFTP server: files and accounts come back. |
| Memory limit, CPU limit (Capacity tab) | 256Mi and 500m by default. |
| Disconnect after inactivity | In minutes, 15 by default (0 = never). |
| Max. simultaneous connections per IP | 20 by default (0 = unlimited). |
| Brute-force protection | Temporarily bans an IP address that accumulates failed logins. Enabled by default. |
| File Browser | Browse uploaded files from the browser, behind the platform login. Enabled by default. |
Once the application is running, the SFTP — Accounts and access button on its card opens the server administration.
SFTP accounts¶
SFTP accounts belong to the server: they are not platform users and have no access to the Control Panel. Platform roles only decide who can manage them:
| Role on the namespace or application | Rights |
|---|---|
| viewer | See accounts, shared folders and connection details. |
| operator | Create, edit, suspend, delete accounts; change their passwords; manage shared folders. |
| admin | Open or close access from the Internet, filter allowed IP addresses. |
Every creation, change or deletion is recorded in the audit logs, with the platform user who made it — never passwords.
An account has:
- a username (2 to 32 characters: lowercase, digits,
.,_,-), which cannot be changed; - an authentication mode:
- SSH key only (default, recommended from the Internet);
- Password only, for clients that cannot use a key;
- SSH key or password;
- SSH key and password, both required at every login;
- its SSH public keys (several allowed, each with a label);
- a home folder, the root of what the account sees;
- the shared folders assigned to it, each read-only or read-write;
- optional restrictions: read-only, quota (size, number of files), expiration date, suspended account.
Deleting an account does not delete its files: they stay on the volume, visible in the File Browser.
Passwords¶
A password generated by the platform is shown only once, right after saving: copy it before closing the message. It is only stored hashed and cannot be read back; if lost, use New password on the account row. A typed password must be at least 12 characters long.
SSH keys¶
The user generates their key pair on their own machine and only sends the public key — the private key must never leave their machine:
ssh-keygen -t ed25519 -C "partner-x"
# send the content of ~/.ssh/id_ed25519.pub
On Windows, ssh-keygen ships with OpenSSH (PowerShell); with PuTTYgen, copy the "Public key for pasting into OpenSSH authorized_keys file" line.
In the account form, paste the key or upload the .pub file, then Add. Accepted types: ssh-ed25519, ecdsa-sha2-nistp256/384/521, ssh-rsa (2048 bits minimum) and sk-* hardware keys. A private key pasted by mistake is refused. The SHA256:… fingerprint shown is the one given by ssh-keygen -lf id_ed25519.pub: the user can check it is their key.
To replace a key without interruption, add the new one, let the user test it, then remove the old one.
Shared folders¶
A shared folder appears under /partage/<name> for every account it is assigned to. Access is set per account: a partner can upload while another account only reads. Deleting a shared folder removes it from every account; its files stay on the volume.
Connection and access from the Internet¶
The Connection tab gives the host, the port, a ready-to-copy sftp command and the server fingerprints. Share these fingerprints with users: their client shows them at the first connection, to check it is really this server.
By default, the server is only reachable from the cluster. Open access from the Internet (admin) assigns it a TCP port on the Gateway, chosen automatically. Allowed IP addresses (one IP or CIDR range per line) restrict the sources; when empty, any address the external firewall lets through is accepted. As for PostgreSQL databases, the external firewall forward to the cluster Load Balancer must be configured by hand.
sftp -P <port> <username>@<host>
sftp -i ~/.ssh/id_ed25519 -P <port> <username>@<host>
Files and File Browser¶
On the volume, files are stored in files/home/<username>/ (home folders) and files/shared/<name>/ (shared folders). The application's File Browser shows everything to whoever has access to the application on the platform; the account database does not appear there.
Deletion¶
Deleting the application closes access from the Internet, releases its port and removes its OpenID client. The volume follows the usual volumes rule.