> ## Documentation Index
> Fetch the complete documentation index at: https://snapr.seshuk.im/llms.txt
> Use this file to discover all available pages before exploring further.

# SFTP

> Upload archives to an SFTP server over SSH using password or private-key authentication.

`type: sftp` uploads archives to an SFTP server using password or SSH key authentication. snapr uses the Go SSH library — no external binaries required.

## Example

Password authentication:

```yaml snapr.yaml theme={null}
storages:
  - type: sftp
    name: offsite
    host: backup.example.com
    port: 22
    username: backup
    password: env:SFTP_PASSWORD
    path: /uploads
    strictHostKey: true
    knownHosts: /etc/snapr/known_hosts
```

SSH key authentication:

```yaml snapr.yaml theme={null}
storages:
  - type: sftp
    name: offsite-key
    host: backup.example.com
    username: backup
    privateKey: /etc/snapr/keys/sftp_id_ed25519
    passphrase: env:SFTP_PASSPHRASE
    path: /snapr
    strictHostKey: true
    knownHosts: /etc/snapr/known_hosts
```

## Options

| Option           | Type   | Required | Default              | Description                                                                                                           |
| ---------------- | ------ | -------- | -------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `type`           | `sftp` | Yes      | —                    |                                                                                                                       |
| `name`           | string | Yes      | —                    | Identifier; unique within the job.                                                                                    |
| `host`           | string | Yes      | —                    |                                                                                                                       |
| `port`           | int    | No       | `22`                 |                                                                                                                       |
| `username`       | string | No       | OS user              | Defaults to the OS user running snapr.                                                                                |
| `password`       | string | No       | —                    | Use `env:`. Can be combined with `privateKey` — both auth methods are offered.                                        |
| `privateKey`     | string | No       | —                    | **Path** to a PEM private key file on the snapr host. `~` is expanded.                                                |
| `passphrase`     | string | No       | —                    | Passphrase for the private key. Use `env:`.                                                                           |
| `knownHosts`     | string | No       | `~/.ssh/known_hosts` | Path to a `known_hosts` file. `~` is expanded.                                                                        |
| `strictHostKey`  | bool   | No       | `true`               | Host-key verification. Set to `false` to disable — **insecure**, accepts any key.                                     |
| `path`           | string | No       | `.`                  | Remote directory; created if missing.                                                                                 |
| `includeJobName` | bool   | No       | `true`               | Append the job name under `path`; see [Storages](/configuration/storages/overview#skipping-the-per-job-subdirectory). |

## Retention and notes

* Retention deletes the oldest files in the job's remote directory once more than `retention.last` backup sets exist; see [Storages → Retention](/configuration/storages/overview#retention).
* The private key file must be readable by the snapr process. In Docker, mount it into the container.
* For production, pre-populate `knownHosts` with the server's host key (`ssh-keyscan -H <host> >> known_hosts`) and leave `strictHostKey` at the default.

<Warning>
  With `strictHostKey: false`, snapr logs a warning but accepts any host key. Use it only for ad-hoc testing.
</Warning>

## Related

* [Storages overview](/configuration/storages/overview)
* [Docker deployment](/deployment/docker)