SFTPGo sustainability

[drakkan]

Unfortunately SFTPGo is not financially viable yet which means its sustainability model is failing.
SFTPGo users have increased a lot but only a few of you support the project with sponsorships/donations.

With few exceptions, companies/people generally start sponsoring for a few dollars a month ask a lot of questions/features and once they have their answers/features they stop sponsoring. Not to mention the people who don't sponsor at all and who contact me privately if I close as invalid their issues whose answer is in the documentation or big companies using SFTPGo without returning anything back.

SFTPGo offerings on Azure and AWS are by far the cheapest of similar products, and SFTPGo has more features than many commercial products there, yet subscriptions are low.

I can't keep investing all this time in SFTPGo under these conditions. If each of you donated a small amount there would be no sustainability problems but unfortunately this is not the case.

I'm sorry but I'm considering switching to an open core model or something similar where not all features are available in the free version.

I'm posting this in hopes that something will change, but honestly I'm skeptical now. I lost about 10 sponsors, for no reason, this month alone.

[maxiride]

I lost about 10 sponsors, for no reason, this month alone.

It might be due to the new Github sponsorship policies, in case you were unaware they no longer accept PayPal as a payment method and a lot of other projects lost sponsors due to this change. It's also very plausible that many don't know (or ignored the warning emails) and are even unaware that their subscriptions were terminated.

[drakkan]

I lost about 10 sponsors, for no reason, this month alone.

It might be due to the new Github sponsorship policies, in case you were unaware they no longer accept PayPal as a payment method and a lot of other projects lost sponsors due to this change. It's also very plausible that many don't know (or ignored the warning emails) and are even unaware that their subscriptions were terminated.

Maybe this can be true for some sponsors. For some of them I have no contacts other than github username and obviously I can't mention them here or in another post. I tried to contact the other ones but no reply so far

[zbutt-badal]

@drakkan email me zbutt@badal.io ... lets connect there.

[Art3mK]

I just started to evaluate sftpgo, but feature wise it looks very powerful. I'll poke around in my place to see if I can arrange sponsorship for this.

[PlenipotentSS]

I am getting leverage for a company to use SFTPGo for our applications. I will work on a budget addition to try to get some more support.

[jorgelaranjo]

[drakkan]

For those interested, please use the offer from "SFTPGo Authors", the other one is deprecated and will not be updated anymore. Thank you

[drakkan]

Hello,

as a last attempt to keep SFTPGo completely open source I have added some support plans which can be purchased from the SFTPGo website. Thank you

[maxiride]

Glad to hear you worked something out! When the agreed sponsorship period we paid in advance ends, do you prefer we switch over to the subscription plan?

Best,
Federico D'Eredità — INDI

[drakkan]

Glad to hear you worked something out! When the agreed sponsorship period we paid in advance ends, do you prefer we switch over to the subscription plan?

Best, Federico D'Eredità — INDI

as you prefer. I can generate a payment link that matches our current deal (annual payments instead of monthly and the same amount). Thanks for supporting SFTPGo!

[dwoods]

I've just created a subscription to the AWS marketplace "container edition".

I've added a service account to run the app with the recommeded IAM permissions.

Usage Instructions: Run the container using an IAM role with the following permissions:
AWSMarketplaceMeteringRegisterUsage, required for AWS marketplace integration.
SecretsManagerReadWrite, required to store and retrieve the initial installation code.

Is there a specific container registry I need to use for this version and have it register with AWS, or just the standard one (ghcr.io/drakkan/sftpgo)?

Thanks

• Darryl

[drakkan]

I've just created a subscription to the AWS marketplace "container edition".

I've added a service account to run the app with the recommeded IAM permissions.

Usage Instructions: Run the container using an IAM role with the following permissions:
AWSMarketplaceMeteringRegisterUsage, required for AWS marketplace integration.
SecretsManagerReadWrite, required to store and retrieve the initial installation code.

Is there a specific container registry I need to use for this version and have it register with AWS, or just the standard one (ghcr.io/drakkan/sftpgo)?

Thanks

• Darryl

Hello,

thank you for subscribing to container offer, you have to run the images on Amazon ECS or EKS to use the offer.

Below the usage istructions there are the credentials and the links to the Amazon ECR registry to pull the images

the latest version are

709825985650.dkr.ecr.us-east-1.amazonaws.com/sftpgo-authors/sftpgo:v2.5.1
709825985650.dkr.ecr.us-east-1.amazonaws.com/sftpgo-authors/sftpgo:v2.5.1-distroless

distroless images have just been removed from the public repository and will remain available only on ECR (or a private registry for project sponsors who don't want to use AWS services).
If you have never used ECS or EKS it might be a bit tricky to get started with these services

[dwoods]

Thanks for the quick response @drakkan, I guess I didn't go far enough and didnt click the "Launch software" to get to that screen.

I am using EKS and have a lot of services running already, but haven't needed to pull images from ECR yet, just from public and our private registries.

Now I just need to setup something to automatically renew the registry credentials in a pull secret automatically as it looks like they expire after 12 hours...

Would it be acceptable to pull the image locally and push to our own private container registry that we are already have the cluster setup to pull from?

I'm haven't looked into how AWS Marketplace container products work, so not sure if it's a requirement that they're pulled directly from ECR from a metering perspective.

Thanks again

[drakkan]

Thanks for the quick response @drakkan, I guess I didn't go far enough and didnt click the "Launch software" to get to that screen.

I am using EKS and have a lot of services running already, but haven't needed to pull images from ECR yet, just from public and our private registries.

Now I just need to setup something to automatically renew the registry credentials in a pull secret automatically as it looks like they expire after 12 hours...

Would it be acceptable to pull the image locally and push to our own private container registry that we are already have the cluster setup to pull from?

It should work, as an AWS subscriber you can contact us by writing to support at sftpgo.com, please write there for follow up questions, this is a bit off topic here. Thank you!

I'm haven't looked into how AWS Marketplace container products work, so not sure if it's a requirement that they're pulled directly from ECR from a metering perspective.

Thanks again

[nandanrao]

Hi SFTPGo Team,

With the current attacks on closed-source file sharing systems this year, I definitely want to make sure there is a strong open-source solution. We have started using SFTP Go and have so far been happy with the product and we're happy to donate to keep this going.

I do believe that there is opportunity now, given these attacks, to rally around a community project. I suspect this will get more popular, so I guess I'm just chiming in to say "don't lose faith" and I think now is the time.

[drakkan]

Hi SFTPGo Team,

With the current attacks on closed-source file sharing systems this year, I definitely want to make sure there is a strong open-source solution. We have started using SFTP Go and have so far been happy with the product and we're happy to donate to keep this going.

I do believe that there is opportunity now, given these attacks, to rally around a community project. I suspect this will get more popular, so I guess I'm just chiming in to say "don't lose faith" and I think now is the time.

Thanks for the nice words and for your sponsorship. If you have any problems/questions about SFTPGo please contact us at the dedicated support email address.

I'm tired of pinning these posts, it seems like I'm begging. If people don't realize the importance of supporting a community project like this they deserve sql injections vulnerabilities or to get ignored if they want a free software and also free support

[nandanrao]

For what it's worth, this thread is what spurred me to sponsor. It's not like we wouldn't have, but I didn't feel any urgency until I read this. So while I know it feels like begging, and you shouldn't have to beg, folks like me are a bit dense and don't think to act until something hits us over the head. So maybe it's not bad to hit people over the head with this sort of thing?

[drakkan]

I'll take into consideration what you wrote, but I don't like to ask, it's not easy for me to publish posts like this. The main README should already explain why it is important to sponsor the project.
Luckily I don't make my living with SFTPGo, I have another completely unrelated job.
But I can't continue to spend all the time it takes to maintain and evolve SFTPGo for free.
Many people here will just ask and never give something back. It is hard for me not reply to an issue/discussion but i'm starting to ignore people just like they ignore the sponsor section of the README. Sooner or later everyone is going to need support for something and some (big) companies that have contacted me in the past, got the features they needed for free and then ignored my emails won't get any support even if they want to pay.

Let me know if you want your company logo in the sponsor section. Thank you!

[lstyles]

Same as @nandanrao I also was prompted by this thread to find a way to ensure that we're not freeloading as by default I'd just pull the released package into a custom packer build and call it a day without giving it a second thought. Not because I don't want to pay, but because SFTP implementation is just one task on my ever growing list of things to do.

I would second the suggestion to keep the thread open as you deserve to be rewarded for your work, but more importantly, it's in our common interest to ensure first and foremost, longevity of the software but also your ability to develop its feature set further and address any potential security vulnerabilities.

Thanks for all your hard work.

[drakkan]

@nandanrao @lstyles thank you.
I hope more people can understand why it is important to support the project and that if they don't return anything they will find themselves using an unmaintained project in the future and their only option will be to pay for a similar proprietary product

[flibustenet]

Maybe it's not the best place to ask as we are mostly devs here and contribute by code directly or indirectly more than by money ? Do sponsors looks at github issues ?
I mean, do you need help for code or answering issues ?

[drakkan]

Maybe it's not the best place to ask as we are mostly devs here and contribute by code directly or indirectly more than by money ? Do sponsors looks at github issues ? I mean, do you need help for code or answering issues ?

New code contributions increase the maintainance workload without improving motivation or sustainability. Reviewing and iterating or pushing back on PRs is work! Often more than writing the code itself.
See for example the latest contribution (#1332): I completed it myself to avoid additional iterations. The contributor (@mistadave) got the feature his business needs (for free) and will probably disappear (until the next time he needs something). If there are any bugs or questions about this feature in the future I will have to handle them. This doesn't help at all.

I have no other place to ask, I hope people using SFTPGo ask their company to support the project. Do you have better ideas?

[pdrive]

i use sftpgo to share stuff with friends/remote backup etc. not much tbh. i'd like to enable more security/check logs/etc but i just dont know how. i cant event enable webdav https lol i think it's because i dont have a valid certificate not sure. doesnt really matter i guess. i use it over tailscale.

anyway
this is my opinion and i barely have any understanding about the issue. havind said that:
i dont think big companies should be able to use your software for free. maybe something like free up to 50 users.

hopefully i can donate in the future and then i'd feel "ready" for making suggestions hehe

[fapeliberty]

Hello, Nicola, please keep this issue pinned, without it, i wouldn't have push my company to select and pay for your product

[despiegk]

we are willing to sponsor too, have written you an email, hope you saw it

[drakkan]

we are willing to sponsor too, have written you an email, hope you saw it

I replied on October 15th, I will forward the response to you again, try checking your spam folder too. Thank you

[Nerdmaster]

My institution won't sponsor you, but I did just set up a personal $5/month sponsorship. It's ... pretty paltry, but I hope it encourages others to support you :-/

[drakkan]

My institution won't sponsor you, but I did just set up a personal $5/month sponsorship. It's ... pretty paltry, but I hope it encourages others to support you :-/

Thanks, appreciated

[asrenzo]

Hello,

My company may or not sponsor you for your work. It already does for some other open source projects.
But classifying my first "bug" report as a "support request" without any explanation won't help me to talk to my boss in order to support.
Because before supporting anything, they want to see why they should.
At the moment I'm stuck with the only feature that is really important for me (SFTP -> S3 compliant storage) that is not working.
I must be doing something wrong.
But it's already 2 days of full retries and reinstall without any progress.
For now I have no clue to say to anyone at company that rclone should be replaced with sftpgo.

Regards,

[asrenzo]

Just sponsored with my personal account because I agree support requests must be a real time consumer.

Regards,