omnidrive / sftp

v1.0.0 2026-11-13 08:37 UTC

Requires

• php: >=8.2
• league/flysystem-sftp-v3: ^3.0
• omnisense/omnidrive: ^1.0

Requires (Dev)

• phpunit/phpunit: ^11.0

MIT

• Marco Meyer

• storage
• ssh
• sftp
• phpseclib
• Flysystem
• omnidrive

Published on Packagist.org on 2026-11-13 13:28 UTC

README

A directory of an SFTP server, over SSH, as an omnidrive drive, through league/flysystem-sftp-v3 (phpseclib 3, pure PHP: no ssh2 extension).

composer require omnisense/omnidrive omnidrive/sftp

use Omnidrive\Registry;
use Omnidrive\Sftp\SftpDriveFactory;

$drives = new Registry([new SftpDriveFactory()], [
    'backup' => ['factory' => 'sftp', 'options' => ['host' => 'backup.example.org', 'username' => 'site', 'private_key' => '/run/secrets/id_ed25519', 'root' => '/srv/backup', 'host_fingerprint' => 'SHA256:...']],
]);

Option	Default
host, username	required
password
private_key, passphrase		a path to the key, or the key itself
use_agent	false	the SSH agent's keys
port	22
root	/	the directory behind the drive's paths
host_fingerprint	none	the server's key checked before anything is sent
timeout, max_tries	10 s, 4
permissions, public_url, visibility, directory_visibility, retain_visibility		as every drive

The connection is opened on the first operation. capabilities(): not local, public addresses with public_url, no temporary address.

Verified, and not

• Verified (2026-10-23, omnidrive's harness, PHP 8.4): the contract's tests against OpenSSH's SFTP (atmoz/sftp, a password, a chrooted user); in plain PHP (bare --live); a server that does not answer is a DriveException of the operation asked, nothing connecting when the drive is built.
• Not verified: a private key, the SSH agent, the server's key checked (host_fingerprint).

Usage policy

policy.json (omnisense/contracts' schema, named in composer.json as extra.omnisense.policy; read on 2026-11-10): No third party of the package's: the SFTP server the site names. No limit ([]); a rented server's operator's terms are the site's to add. The key is the server's account. Only the connection is retried, before any request: no write is sent twice. Nothing in the drive counts calls; the family's page has every provider's.

Responsibility

Unofficial; affiliated with none of the servers it reaches, nor with The PHP League or phpseclib. Each server keeps its own terms; whoever runs this package answers for the credentials it holds, the data it stores and the access a public address gives. MIT licence.