SFTPGo

SFTPGo

Self-hosted, multi-protocol file transfer server (SFTP/FTP/FTPS/WebDAV) with a web admin UI, deployed to the default namespace of the k3s cluster.

Deployment

Item	Value
Namespace	default
Image	drakkan/sftpgo:latest
Storage	PVC sftpgo-data (20Gi, transferred files), PVC sftpgo-config (1Gi, SFTPGo state) — both local-path
Admin credentials	SFTPGO_DEFAULT_ADMIN_USERNAME / SFTPGO_DEFAULT_ADMIN_PASSWORD from Secret sftpgo
Web ingress	sftpgo.prod-k3s.iot-proxmox.net / www.sftpgo.prod-k3s.iot-proxmox.net (Traefik → ClusterIP Service sftpgo, port 8080)
External access	Service sftpgo-external (LoadBalancer, MetalLB) — 192.168.1.37

reloader.stakater.com/auto: "true" is set on the Deployment.

Exposed Ports

Protocol	Container port	Exposed via
Web admin UI	8080	Traefik ingress (ClusterIP sftpgo)
SFTP	2022	sftpgo-external LoadBalancer
FTP (plain / explicit FTPS)	2121	sftpgo-external LoadBalancer
FTPS (implicit)	990	sftpgo-external LoadBalancer
WebDAV	10080	sftpgo-external LoadBalancer
FTP passive data range	50000–50010	sftpgo-external LoadBalancer (11 ports)

FTP/FTPS Configuration

Two FTP bindings are configured via SFTPGO_FTPD__BINDINGS__* environment variables:

• Binding 0 (port 2121): plain FTP with optional explicit FTPS upgrade (TLS_MODE: 0).
• Binding 1 (port 990): implicit FTPS only (TLS_MODE: 2).

Both bindings set FORCE_PASSIVE_IP to the external LoadBalancer address (192.168.1.37), so passive-mode clients get a routable data-connection IP instead of the pod’s internal address. The passive port range is pinned to 50000–50010 to match the fixed port list on the sftpgo-external Service.

FTPS/implicit-FTPS TLS uses the cluster’s existing wildcard certificate: the local-example-com-tls Secret is mounted read-only into the pod as ftpd.crt / ftpd.key and referenced via SFTPGO_FTPD__CERTIFICATE_FILE / SFTPGO_FTPD__CERTIFICATE_KEY_FILE.

WebDAV is enabled on port 10080 via SFTPGO_WEBDAVD__BINDINGS__0__PORT.