feat: add support for SFTP volume backend (#249)

* feat: add support for SFTP volume backend

* feat: allow more secure SFTP connection with known hosts

* refactor: make default value for skip host key check to false

* refactor: use os.userInfo when setting uid/gid in mount commands

app/server/modules/backends/backend.ts

@@ -6,6 +6,7 @@ import { makeNfsBackend } from "./nfs/nfs-backend";
 import { makeRcloneBackend } from "./rclone/rclone-backend";
 import { makeSmbBackend } from "./smb/smb-backend";
 import { makeWebdavBackend } from "./webdav/webdav-backend";
+import { makeSftpBackend } from "./sftp/sftp-backend";
 
 type OperationResult = {
 	error?: string;
@@ -37,5 +38,8 @@ export const createVolumeBackend = (volume: Volume): VolumeBackend => {
 		case "rclone": {
 			return makeRcloneBackend(volume.config, path);
 		}
+		case "sftp": {
+			return makeSftpBackend(volume.config, path);
+		}
 	}
 };

app/server/modules/backends/sftp/sftp-backend.ts

@@ -0,0 +1,180 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { $ } from "bun";
+import { OPERATION_TIMEOUT } from "../../../core/constants";
+import { cryptoUtils } from "../../../utils/crypto";
+import { toMessage } from "../../../utils/errors";
+import { logger } from "../../../utils/logger";
+import { getMountForPath } from "../../../utils/mountinfo";
+import { withTimeout } from "../../../utils/timeout";
+import type { VolumeBackend } from "../backend";
+import { executeUnmount } from "../utils/backend-utils";
+import { BACKEND_STATUS, type BackendConfig } from "~/schemas/volumes";
+
+const SSH_KEYS_DIR = "/var/lib/zerobyte/ssh";
+
+const getPrivateKeyPath = (mountPath: string) => {
+	const name = path.basename(mountPath);
+	return path.join(SSH_KEYS_DIR, `${name}.key`);
+};
+
+const getKnownHostsPath = (mountPath: string) => {
+	const name = path.basename(mountPath);
+	return path.join(SSH_KEYS_DIR, `${name}.known_hosts`);
+};
+
+const mount = async (config: BackendConfig, mountPath: string) => {
+	logger.debug(`Mounting SFTP volume ${mountPath}...`);
+
+	if (config.backend !== "sftp") {
+		logger.error("Provided config is not for SFTP backend");
+		return { status: BACKEND_STATUS.error, error: "Provided config is not for SFTP backend" };
+	}
+
+	if (os.platform() !== "linux") {
+		logger.error("SFTP mounting is only supported on Linux hosts.");
+		return { status: BACKEND_STATUS.error, error: "SFTP mounting is only supported on Linux hosts." };
+	}
+
+	const { status } = await checkHealth(mountPath);
+	if (status === "mounted") {
+		return { status: BACKEND_STATUS.mounted };
+	}
+
+	if (status === "error") {
+		logger.debug(`Trying to unmount any existing mounts at ${mountPath} before mounting...`);
+		await unmount(mountPath);
+	}
+
+	const run = async () => {
+		await fs.mkdir(mountPath, { recursive: true });
+		await fs.mkdir(SSH_KEYS_DIR, { recursive: true });
+
+		const { uid, gid } = os.userInfo();
+		const options = [
+			"reconnect",
+			"ServerAliveInterval=15",
+			"ServerAliveCountMax=3",
+			"allow_other",
+			`uid=${uid}`,
+			`gid=${gid}`,
+		];
+
+		if (config.skipHostKeyCheck || !config.knownHosts) {
+			options.push("StrictHostKeyChecking=no", "UserKnownHostsFile=/dev/null");
+		} else if (config.knownHosts) {
+			const knownHostsPath = getKnownHostsPath(mountPath);
+			await fs.writeFile(knownHostsPath, config.knownHosts, { mode: 0o600 });
+			options.push(`UserKnownHostsFile=${knownHostsPath}`, "StrictHostKeyChecking=yes");
+		}
+
+		if (config.readOnly) {
+			options.push("ro");
+		}
+
+		if (config.port) {
+			options.push(`port=${config.port}`);
+		}
+
+		const keyPath = getPrivateKeyPath(mountPath);
+		if (config.privateKey) {
+			const decryptedKey = await cryptoUtils.resolveSecret(config.privateKey);
+			let normalizedKey = decryptedKey.replace(/\r\n/g, "\n");
+			if (!normalizedKey.endsWith("\n")) {
+				normalizedKey += "\n";
+			}
+			await fs.writeFile(keyPath, normalizedKey, { mode: 0o600 });
+			options.push(`IdentityFile=${keyPath}`);
+		}
+
+		const source = `${config.username}@${config.host}:${config.path || ""}`;
+		const args = [source, mountPath, "-o", options.join(",")];
+
+		logger.debug(`Mounting SFTP volume ${mountPath}...`);
+
+		let result: $.ShellOutput;
+		if (config.password) {
+			const password = await cryptoUtils.resolveSecret(config.password);
+			args.push("-o", "password_stdin");
+			logger.info(`Executing sshfs: echo "******" | sshfs ${args.join(" ")}`);
+			result = await $`echo ${password} | sshfs ${args}`.nothrow();
+		} else {
+			logger.info(`Executing sshfs: sshfs ${args.join(" ")}`);
+			result = await $`sshfs ${args}`.nothrow();
+		}
+
+		if (result.exitCode !== 0) {
+			const errorMsg = result.stderr.toString() || result.stdout.toString() || "Unknown error";
+			throw new Error(`Failed to mount SFTP volume: ${errorMsg}`);
+		}
+
+		logger.info(`SFTP volume at ${mountPath} mounted successfully.`);
+		return { status: BACKEND_STATUS.mounted };
+	};
+
+	try {
+		return await withTimeout(run(), OPERATION_TIMEOUT * 2, "SFTP mount");
+	} catch (error) {
+		const errorMsg = toMessage(error);
+		logger.error("Error mounting SFTP volume", { error: errorMsg });
+		return { status: BACKEND_STATUS.error, error: errorMsg };
+	}
+};
+
+const unmount = async (mountPath: string) => {
+	if (os.platform() !== "linux") {
+		logger.error("SFTP unmounting is only supported on Linux hosts.");
+		return { status: BACKEND_STATUS.error, error: "SFTP unmounting is only supported on Linux hosts." };
+	}
+
+	const run = async () => {
+		const mount = await getMountForPath(mountPath);
+		if (!mount || mount.mountPoint !== mountPath) {
+			logger.debug(`Path ${mountPath} is not a mount point. Skipping unmount.`);
+		} else {
+			await executeUnmount(mountPath);
+		}
+
+		const keyPath = getPrivateKeyPath(mountPath);
+		await fs.unlink(keyPath).catch(() => {});
+
+		const knownHostsPath = getKnownHostsPath(mountPath);
+		await fs.unlink(knownHostsPath).catch(() => {});
+
+		await fs.rmdir(mountPath).catch(() => {});
+
+		logger.info(`SFTP volume at ${mountPath} unmounted successfully.`);
+		return { status: BACKEND_STATUS.unmounted };
+	};
+
+	try {
+		return await withTimeout(run(), OPERATION_TIMEOUT, "SFTP unmount");
+	} catch (error) {
+		logger.error("Error unmounting SFTP volume", { mountPath, error: toMessage(error) });
+		return { status: BACKEND_STATUS.error, error: toMessage(error) };
+	}
+};
+
+const checkHealth = async (mountPath: string) => {
+	const mount = await getMountForPath(mountPath);
+
+	if (!mount || mount.mountPoint !== mountPath) {
+		return { status: BACKEND_STATUS.unmounted };
+	}
+
+	if (mount.fstype !== "fuse.sshfs") {
+		return {
+			status: BACKEND_STATUS.error,
+			error: `Invalid filesystem type: ${mount.fstype} (expected fuse.sshfs)`,
+		};
+	}
+
+	return { status: BACKEND_STATUS.mounted };
+};
+
+export const makeSftpBackend = (config: BackendConfig, mountPath: string): VolumeBackend => ({
+	mount: () => mount(config, mountPath),
+	unmount: () => unmount(mountPath),
+	checkHealth: () => checkHealth(mountPath),
+});

app/server/modules/backends/smb/smb-backend.ts

@@ -39,13 +39,14 @@ const mount = async (config: BackendConfig, path: string) => {
 		const password = await cryptoUtils.resolveSecret(config.password);
 
 		const source = `//${config.server}/${config.share}`;
+		const { uid, gid } = os.userInfo();
 		const options = [
 			`user=${config.username}`,
 			`pass=${password}`,
 			`vers=${config.vers}`,
 			`port=${config.port}`,
-			"uid=1000",
-			"gid=1000",
+			`uid=${uid}`,
+			`gid=${gid}`,
 		];
 
 		if (config.domain) {

app/server/modules/backends/webdav/webdav-backend.ts

@@ -43,9 +43,10 @@ const mount = async (config: BackendConfig, path: string) => {
 		const port = config.port !== defaultPort ? `:${config.port}` : "";
 		const source = `${protocol}://${config.server}${port}${config.path}`;
 
+		const { uid, gid } = os.userInfo();
 		const options = config.readOnly
-			? ["uid=1000", "gid=1000", "file_mode=0444", "dir_mode=0555", "ro"]
-			: ["uid=1000", "gid=1000", "file_mode=0664", "dir_mode=0775"];
+			? [`uid=${uid}`, `gid=${gid}`, "file_mode=0444", "dir_mode=0555", "ro"]
+			: [`uid=${uid}`, `gid=${gid}`, "file_mode=0664", "dir_mode=0775"];
 
 		if (config.username && config.password) {
 			const password = await cryptoUtils.resolveSecret(config.password);

app/server/modules/volumes/volume.service.ts

@@ -31,6 +31,12 @@ async function encryptSensitiveFields(config: BackendConfig): Promise<BackendCon
 				...config,
 				password: config.password ? await cryptoUtils.sealSecret(config.password) : undefined,
 			};
+		case "sftp":
+			return {
+				...config,
+				password: config.password ? await cryptoUtils.sealSecret(config.password) : undefined,
+				privateKey: config.privateKey ? await cryptoUtils.sealSecret(config.privateKey) : undefined,
+			};
 		default:
 			return config;
 	}