SFTP

Use an SFTP source for encrypted file transfer with a username and password.

Required values

• a DNS host name reachable from the project worker
• the SSH/SFTP service port
• SFTP secret metadata referencing a Kubernetes Secret with RT_SOURCE_USERNAME and RT_SOURCE_PASSWORD

Password authentication is supported. SSH private-key authentication is not a source credential option.

Connect the server

1. 1

   Create a restricted account

   Limit the account to listing and reading the required backup directories. Do not grant write or delete access.

2. 2

   Create and register the Secret

   Put RT_SOURCE_USERNAME and RT_SOURCE_PASSWORD in a Kubernetes Secret in every selected worker's job namespace. Register SFTP secret metadata using the same object name.

3. 3

   Create the SFTP source

   Open Sources, choose SFTP, enter the host and port, and select the active SFTP secret metadata.

4. 4

   Verify with a manual check

   Add the source to a schedule, use /-separated paths, and run the schedule manually. Confirm both file selection and download.

Schedule paths

SFTP schedule paths start at the server's root directory, not at the account's login directory. Enter the full path to the backup folder as the server shows it. If the account logs in to /home (for example on a Hetzner Storage Box), a backups folder there is home/backups.

This differs from FTP and SMB, where the path starts at the login directory or at the share.

If listing fails, check that the path includes the login directory, then check directory permissions, DNS, and firewall rules from the worker environment.

See Source credentials for rotation guidance and Schedules for file matching.