Config Commands

sftpwarden config reads and updates configuration. It has two separate scopes:

• sftpwarden config PATH [VALUE] edits the active project’s sftpwarden.yaml.

• sftpwarden config show and sftpwarden config default-provider operate on global CLI settings under ~/.sftpwarden/config.toml.

Changing sftpwarden.yaml records desired state only. Apply deployment-level changes with sftpwarden deploy, sftpwarden kube apply, or sftpwarden helm upgrade.

sftpwarden config

Command group and dynamic project-config editor.

sftpwarden config --help

Group-level options are also accepted by the dynamic path commands.

Group Options

Flag	Value	Default	What it does
--context, -c	TEXT	active context	Selects the project context whose sftpwarden.yaml should be read or edited.
--config	PATH	none	Reads or edits a specific sftpwarden.yaml directly.
--yes, -y	flag	false	Accepts prompts for important config changes, currently including deferred provider schema migration.

sftpwarden config PATH

Reads or updates one dotted path in sftpwarden.yaml. If VALUE is omitted, the command prints the current value. If VALUE is supplied, SFTPWarden parses it with YAML scalar rules, validates the full config model, and writes the file.

sftpwarden config server.port
sftpwarden config server.port 2200
sftpwarden config provider.type csv
sftpwarden config provider.user_schema 2
sftpwarden config auth.allow_password false
sftpwarden config kubernetes.liveness_probe.period_seconds 45

Arguments

Argument	Required	Value	What it means
PATH	Yes	supported dotted path	Config path exposed by the CLI, such as server.port or provider.user_schema.
VALUE	No	YAML scalar text	Replacement value. Omit it to read the current value.

Options

Flag	Value	Default	What it does
--context, -c	TEXT	active context	Selects the project context to edit.
--config	PATH	none	Edits a specific config file directly.
--yes, -y	flag	false	Accepts confirmation when changing provider.user_schema requires a forward migration on next deploy.

Value Parsing

Numbers become integers, true/false become booleans, and null clears nullable fields. Existing string fields remain strings even if the value looks like a number or boolean.

Changing project.name also renames the registered context when the command is operating through the context registry. Changing provider.user_schema validates the requested schema and, when SFTPWarden can see that provider data is older, warns that the next deploy/apply/upgrade will run a forward migration.

Supported Project Paths

The command paths below come from the real PROJECT_CONFIG_PATHS constant and the SFTPWardenConfig model.

Path	Accepted value
version	1
project.name	text
project.description	text
server.host	text, usually an address such as 0.0.0.0
server.port	integer 1 to 65535
server.data_dir	path text used inside the runtime
server.host_keys_dir	path text used inside the runtime
server.state_dir	path text used inside the runtime
server.group	text group name
sync.enabled	boolean
sync.interval_seconds	integer >= 5
sync.apply_on_startup	boolean
sync.disable_missing_users	boolean
sync.delete_missing_user_data	boolean
auth.allow_public_key	boolean
auth.allow_password	boolean
auth.recommended	public_key or password
auth.password_hash_scheme	sha512crypt
isolation.mode	chroot
isolation.upload_dir	safe relative path
isolation.root_owner	text owner name
isolation.root_group	text group name
isolation.root_permissions	octal permission text
isolation.upload_permissions	octal permission text
uid_gid.mode	auto
uid_gid.start	integer >= 1000
uid_gid.end	integer >= 1001 and greater than uid_gid.start
uid_gid.preserve_existing	boolean
provider.type	yaml, csv, sqlite, mysql, postgresql, mariadb, or mongodb
provider.path	provider path text
provider.dsn	text DSN or null
provider.query	text SQL query or null
provider.table	SQL table name text accepted by the config validator
provider.collection	MongoDB collection name text
provider.user_schema	supported user schema version, currently 1 or 2
logging.level	debug, info, warning, or error
logging.format	json or text
healthcheck.interval_seconds	integer >= 1
healthcheck.timeout_seconds	integer >= 1
healthcheck.retries	integer >= 1
healthcheck.start_period_seconds	integer >= 0
docker.image	text image reference
docker.container_name	text container name
docker.restart	text Docker restart policy
docker.compose_file	text Compose file name/path
deploy.target	compose or kubernetes
kubernetes.mode	manifests or helm
kubernetes.namespace	text namespace
kubernetes.release	text release name
kubernetes.kube_context	text kube context or null
kubernetes.service_type	ClusterIP, NodePort, or LoadBalancer
kubernetes.storage_class	text storage class or null
kubernetes.data_storage_size	Kubernetes storage quantity such as 10Gi
kubernetes.startup_probe.period_seconds	integer >= 1
kubernetes.startup_probe.timeout_seconds	integer >= 1
kubernetes.startup_probe.failure_threshold	integer >= 1
kubernetes.readiness_probe.period_seconds	integer >= 1
kubernetes.readiness_probe.timeout_seconds	integer >= 1
kubernetes.readiness_probe.failure_threshold	integer >= 1
kubernetes.liveness_probe.period_seconds	integer >= 1
kubernetes.liveness_probe.timeout_seconds	integer >= 1
kubernetes.liveness_probe.failure_threshold	integer >= 1
kubernetes.replicas	1; values greater than 1 are rejected by the config model
remote.enabled	boolean
remote.storage	local-sync or remote-only
remote.host	text host or null
remote.user	text SSH user or null
remote.port	integer 1 to 65535
remote.remote_root	text remote path or null
remote.remote_config	text remote config path or null
remote.ssh_key	text key path or null
remote.delete_extra_files	boolean
remote.include_env	boolean
watcher.enabled	boolean
watcher.mode	auto, systemd, openrc, runit, supervisord, launchd, windows-task, or docker
watcher.image	text Docker watcher image or null; valid only when watcher mode is Docker

For detailed meaning of each field, see Configuration.

sftpwarden config show

Shows global CLI configuration stored under ~/.sftpwarden/config.toml.

sftpwarden config show
sftpwarden config show --json

Options

Flag	Value	Default	What it does
--json	flag	false	Prints global config data as JSON. Without it, output is YAML-like text.

Effects

Read-only.

sftpwarden config default-provider

Shows or updates the global default provider used by sftpwarden init when --provider is omitted.

sftpwarden config default-provider
sftpwarden config default-provider yaml
sftpwarden config default-provider csv
sftpwarden config default-provider sqlite

Arguments

Argument	Required	Value	What it means
provider	No	yaml, csv, sqlite, mysql, postgresql, mariadb, or mongodb	New global default provider. Omit it to print the current default.

Options

No command-specific options.

Effects

When a provider argument is supplied, writes the global CLI config.