SFTP & SSH file access

Access your CapyArk storage using any SFTP client or mount it as a local filesystem with sshfs. No proprietary client required.

Connection details

Find these in the portal under Connect:

Tailscale required. Your storage node is only accessible on your Tailscale network — it has no public IP. Make sure Tailscale is running on the device you’re connecting from.

Adding SSH public keys

Avoid typing your password every time by adding an SSH public key:

1. Go to Settings → SSH Keys in the portal
2. Paste your public key (~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub)
3. Click Save

The key is deployed to your container within a few seconds. Test it:

ssh storage-baas_xxxxx

You should authenticate without a password prompt.

Command-line SFTP

sftp storage-baas_xxxxx

Useful SFTP commands:

sftp> ls                     # list remote files
sftp> lls                    # list local files
sftp> put localfile.tar      # upload file
sftp> get remotefile.tar     # download file
sftp> put -r /local/dir/ .   # upload directory recursively
sftp> get -r backups/ /tmp/  # download directory
sftp> mkdir archive          # create remote directory
sftp> exit

Mount with sshfs

sshfs mounts your CapyArk storage as a local filesystem — you can browse it in your file manager and copy files normally.

Install sshfs:

# Debian / Ubuntu
sudo apt install sshfs

# macOS (via Homebrew — requires macFUSE)
brew install macfuse sshfs

Mount:

mkdir -p ~/capyark
sshfs storage-baas_xxxxx:/backup ~/capyark -o reconnect,ServerAliveInterval=15

Your storage is now accessible at ~/capyark. Any file manager will see it.

Unmount:

fusermount -u ~/capyark      # Linux
umount ~/capyark             # macOS

Auto-mount on login (Linux, /etc/fstab):

storage-baas_xxxxx:/backup /mnt/capyark fuse.sshfs noauto,x-systemd.automount,_netdev,reconnect,identityfile=/home/youruser/.ssh/id_ed25519,allow_other,default_permissions 0 0

GUI clients

FileZilla

1. Open Site Manager (Ctrl+S)
2. Click New Site
3. Set Protocol: SFTP – SSH File Transfer Protocol
4. Host: storage-baas_xxxxx, Port: 22
5. Logon Type: Normal, Username: baas_xxxxx, Password: your account password
6. Click Connect

Cyberduck (macOS / Windows)

1. Click Open Connection
2. Select SFTP (SSH File Transfer Protocol)
3. Server: storage-baas_xxxxx, Port: 22
4. Username: baas_xxxxx
5. Password: your account password
6. Click Connect

WinSCP (Windows)

1. New Session → File Protocol: SFTP
2. Host name: storage-baas_xxxxx, Port: 22
3. Username: baas_xxxxx, Password: your account password
4. Save and Login

Browsing snapshots

CapyArk automatically creates daily and weekly ZFS snapshots of your dataset. From the portal’s Backups tab you can mount any snapshot as a read-only clone and browse its contents over SFTP — the clone appears as a separate path on your storage node while it’s mounted.

To mount a snapshot clone:

1. In the portal, go to Backups
2. Click the ⋯ menu next to any snapshot → Mount as read-only clone
3. A new path appears (e.g. /snapshots/daily-2026-01-15) — connect via SFTP to browse it
4. Unmount when done to free space

What’s in /backup/

When you first connect, your storage is an empty ZFS dataset. There’s no enforced structure — create whatever directory layout makes sense for your use case:

/backup/
  home/          ← workstation home directory backups
  databases/     ← PostgreSQL dumps
  media/         ← photos, videos
  configs/       ← system configs and dotfiles

Troubleshooting

ssh: Could not resolve hostname storage-baas_xxxxx Tailscale isn’t running or the storage node is offline. Run tailscale status and check the Connect tab in the portal.

Received disconnect from ... : Too many authentication failures Your SSH agent may be offering too many keys. Add -o IdentitiesOnly=yes -i ~/.ssh/your_key to the sftp/sshfs command.

Connection closed by remote host You connected successfully but tried to run a shell command. The SSH server only permits SFTP and specific commands (rsync, zfs). Shell PTY access is intentionally blocked.