// the find
drakkan/sftpgo
Full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob
SFTPGo is a Go file transfer server that speaks SFTP, FTP/S, WebDAV, and HTTP/S, with pluggable storage backends including S3, GCS, and Azure Blob. It ships a full web admin UI, event-driven automation, MFA, and an OIDC integration. Aimed at teams that need to expose cloud object storage to legacy clients or business partners without building their own gateway.
The VFS abstraction is genuinely well-designed — you can mix local disk, encrypted local disk, S3, GCS, Azure Blob, and even another SFTP server as backends per-user or per-virtual-folder, which covers a lot of real migration scenarios. The event system (hooks on upload/download/delete, scheduled tasks, HTTP callbacks) lets you wire file events into downstream workflows without a separate integration layer. The data provider supports SQLite, MySQL, PostgreSQL, and bbolt, so you can match the deployment footprint — SQLite for a single-node home lab, Postgres for a cluster. TOTP MFA and OIDC SSO are included in the OSS edition, not gated behind Enterprise, which is rare for this category.
The AGPL-3.0 license is a real constraint — if you're embedding this in a commercial product you either open-source your whole stack or pay for Enterprise; the README explicitly says consulting your legal team, which is always a warning sign. The enterprise-vs-community split has gotten aggressive: in-memory streaming (no temp files for cloud backends), HA coordination, and anything resembling advanced automation are all Enterprise-only, so the OSS edition has a ceiling you'll hit faster than the feature list implies. The config surface area is enormous — the JSON config file has hundreds of options across protocols, backends, and event rules, and getting it wrong (especially around TLS or passive FTP port ranges) produces errors that are hard to diagnose from logs alone. No built-in audit log export to SIEM; you get JSON logs and Prometheus metrics, but correlating security events across users and protocols requires you to build that pipeline yourself.