Documentation
¶
Overview ¶
Package arksftp implements ark.Backend over an SFTP connection.
One Backend owns one SSH connection and one SFTP client. Requests are multiplexed over that single connection; there is no pool. The Repository concurrency bound (ark.WithConcurrency, runtime.NumCPU times two by default) caps how many requests are in flight, so the caller sizes the load on that one connection.
Secrets never live in Config or in a URI. The password comes from ARK_SFTP_PASSWORD and a key passphrase from ARK_SFTP_KEY_PASSPHRASE; see EnvPassword and EnvKeyPassphrase.
Index ¶
- Constants
- type Backend
- func (b *Backend) Close() error
- func (b *Backend) Delete(ctx context.Context, h ark.Handle) error
- func (b *Backend) Exists(ctx context.Context, h ark.Handle) (bool, error)
- func (b *Backend) Get(ctx context.Context, h ark.Handle) (io.ReadCloser, error)
- func (b *Backend) List(ctx context.Context, t ark.HandleType, fn func(ark.BlobInfo) error) error
- func (b *Backend) Put(ctx context.Context, h ark.Handle, r io.Reader) error
- func (b *Backend) Stat(ctx context.Context, h ark.Handle) (ark.BlobInfo, error)
- func (b *Backend) Sync(ctx context.Context) error
- type Config
Constants ¶
const ( // EnvPassword holds the SSH password, used when neither the agent nor an // identity file authenticates. EnvPassword = "ARK_SFTP_PASSWORD" //nolint:gosec // env var name, not a credential // EnvKeyPassphrase unlocks an encrypted IdentityFile. EnvKeyPassphrase = "ARK_SFTP_KEY_PASSPHRASE" //nolint:gosec // env var name, not a credential )
Secrets are read from the environment, never from Config or a URI.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend struct {
// contains filtered or unexported fields
}
Backend implements ark.Backend backed by an SFTP server. All methods are safe for concurrent use via the underlying SSH/SFTP multiplexing.
func New ¶
New connects to the SFTP server described by cfg and returns a ready Backend. The caller closes it with Backend.Close.
func (*Backend) Delete ¶
Delete removes the object identified by h. Removing a non-existent object is not an error.
func (*Backend) Get ¶
Get returns a ReadCloser for the object stored under h. Callers must close the returned reader.
func (*Backend) List ¶
List walks the namespace of t and calls fn for every object it holds. An absent namespace is empty, not an error.
func (*Backend) Put ¶
Put writes r to a temporary name in the target directory and renames it into place with posix-rename, so a reader never sees a partial object. It is idempotent: an existing object is replaced.
type Config ¶
type Config struct {
// Host is the remote hostname, IP address, or an ssh_config Host alias
// whose HostName replaces it.
Host string
// Port is the SSH port. Falls back to ssh_config, then to 22.
Port int
// User is the SSH username. Falls back to ssh_config, then to the
// current OS user.
User string
// Path is the repository root directory on the remote server.
Path string
// IdentityFile is the path to a PEM-encoded private key file.
// Falls back to ssh_config, then to ~/.ssh/id_rsa, id_ecdsa and
// id_ed25519.
IdentityFile string
// KnownHostsFile is the known_hosts file used to verify the host key.
// Defaults to ~/.ssh/known_hosts.
KnownHostsFile string
// InsecureIgnoreHostKey skips host key verification. It exposes the
// connection to man-in-the-middle attacks and is meant for tests and
// throwaway environments only.
InsecureIgnoreHostKey bool
// Timeout bounds the TCP and SSH handshake. Defaults to 30s when zero.
Timeout time.Duration
}
Config describes how to reach an SFTP server. Zero values fall back to the documented defaults. It holds no secrets.
Source Files