# ADR 0009 — SFTP only (no FTP)

**Status:** Accepted

## Context
Customers need file access to their web root. Legacy FTP is plaintext
(credentials and data in the clear). FTPS adds TLS but is firewall-hostile
(dynamic data ports). SFTP runs over SSH on a single port.

## Decision
Provide **SFTP only**, with each customer **chrooted to their own ZFS dataset**
(web root). No FTP, no FTPS. A web-based file manager (e.g. Filebrowser) may be
added later alongside the customer panel for non-technical users.

## Consequences
- ✅ Encrypted transport; single well-known port; firewall-friendly.
- ✅ Chroot enforces the same per-customer boundary as containers and datasets.
- ❌ Some legacy customer tooling only speaks FTP — those users migrate to SFTP
  clients (documented in onboarding).
- ⚠️ SFTP access is a path into the web root; keys/passwords are per-customer and
  rotatable, and the chroot prevents traversal to other customers or the host.