SFTPGo

Last reviewed Aug 26, 2026 · 868 words

SFTPGo is not a Dropbox replacement, whatever the listing's "alternative to" line says: there is no sync client, and nothing on your laptop will quietly mirror a folder. What it is, is the best self-hosted answer to "I need to give people and systems a place to put files over a standard protocol", with SFTP, FTP/FTPS, WebDAV and HTTPS served from one Go binary that idles at the listed 128 MB, per-user quotas and permissions, and the option to keep those files on local disk, S3, Azure Blob, Google Cloud Storage or another SFTP server. If your problem is clients that sync, Syncthing or Nextcloud; if your problem is a scanner, a backup job, a client's accountant and a vendor's nightly CSV drop all needing an endpoint, this.

One binary, four protocols, and a web client you did not expect

Out of the box SFTPGo listens for SFTP on port 2022 (deliberately not 22, so it never fights the host's SSH) and serves an admin UI and a REST API on 8080. FTP and WebDAV are off until you enable them in the config, and turning FTP on without TLS is a choice I would not make in 2026. The part people miss is the web client on the same 8080 port: users can log in with a browser, upload, download, share a file by link with an expiry, and manage their own public keys and TOTP, which means the "I just need to send you a file" case does not need a protocol at all. Roughly 12,500 stars and an AGPL licence, with a single primary maintainer and a commercial support arm, which for infrastructure software is a reassuring rather than worrying arrangement.

Users are the unit of everything

Each user has a home directory, a set of permissions per path (list, download, upload, delete, rename and more), a quota in bytes or files, bandwidth limits, allowed protocols, allowed source IPs, an expiry date, and a choice of password, public key or both. Virtual folders let several users share a subtree without sharing a home. Groups apply a template of all that to a set of users, so a vendor onboarding is "create user, add to vendors group". Everything is also available through the REST API, so the accountant's account can be created by a script and expired by a cron job. This is the "configuration can be complex" con from the listing: the model is richer than a chroot and takes an hour to internalise. It pays back the first time you need "upload-only, no listing, deleted after 30 days" for a drop box.

Storage backends: put the disk where you want it

A user's home can be a local directory, a bucket in S3 or any S3-compatible store, Azure Blob, GCS, an encrypted local directory (SFTPGo encrypts at rest with a per-user passphrase), or a path on another SFTP server. The practical patterns: local disk for the LAN scanner and the backup targets, S3 for anything a client uploads so it is off your hardware and versioned by the bucket, and the encrypted backend for the one folder that must not be readable if the drive walks. Mixing backends per user on the same server is fine; that is the feature.

Compose and first login

services:
  sftpgo:
    image: drakkan/sftpgo:latest
    restart: unless-stopped
    ports:
      - "2022:2022"
      - "8080:8080"
    volumes:
      - ./data:/srv/sftpgo
      - ./config:/var/lib/sftpgo

Open http://host:8080/web/admin, create the first admin, then create a user with a home under /srv/sftpgo. Users connect with sftp -P 2022 alice@host. Put the admin UI behind your reverse proxy with TLS and do not publish 8080 raw. SFTP is encrypted by definition and can face the internet on 2022 if a vendor needs it, but keep it on the tailnet when you can; the remote access category covers that pattern.

Hardening that takes 10 minutes

Enable the built-in Defender, which bans an IP after a configurable number of failed logins, and require TOTP for the admin UI. Set a password expiry for human users and keys for machines. Turn on the event manager and add an action that posts a webhook on upload, which is how a vendor drop becomes an automatic import: n8n receives the notification and moves the file on. Finally, back up /var/lib/sftpgo (the provider database and config) alongside the data, because users, keys and quotas live there, not in the home directories.

What I'd do

One SFTPGo container per site, port 2022 open to the tailnet or, if a vendor needs it, the internet with Defender on; admin UI behind the reverse proxy with TOTP; local disk for internal users and an S3 bucket for external ones; groups for every recurring role; a webhook on upload feeding whatever automation consumes the files. Then stop thinking about it. For personal file sync, install Syncthing and leave SFTPGo to do the job it was built for, which is being the server every other tool already knows how to talk to.