[Bug]: SFTPGO_DATA_PROVIDER__PASSWORD_FILE not working/will not read file

[micjgam]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration issue.
• This issue is not already reported on Github (I've searched it).

Bug description

I've setup a compose file (below) with the intent on setting the db password in secrests. When starting the container, I am getting an db startup error that 'user@ip' is '(password: NO)'. I doesn't seem like the file is being read at all. The docker container is on a Synology NAS (via Container Manager) and permissions for folders/files belongs to me as an admin.

I have tried several different approaches and nothing has worked except to contain the passwork in a settings.env file. However, I do not want to do this and instead get secrets to work.

Approaches: 1. change uid:gid to root, 2. checked file for hidden characters (leading/trailing spaces, newline, etc.), 3. amend service level secrets for uid, gid, and mode (in case file permissions in the container were clashing).

I know the _FILE append to SFTPGO_DATA_PROVIDER__PASSWORD was added only a few months ago, and I wonder if this a bug.

Steps to reproduce

1. set SFTPGO_DATA_PROVIDER__PASSWORD_FILE=/run/secrets/
2. set service level secrets to -
3. set top level secrets to file: /path/to/file.txt

Expected behavior

password is read and accepted in database

SFTPGo version

latest

Data provider

MySQL

Installation method

Community Docker image

Configuration

services:
sftpgo:
image: drakkan/sftpgo:latest
container_name: sftpgo
restart: unless-stopped
user: :
networks:
userdef_bridge:
ipv4_address:
environment:
- TZ=America/New_York
- SFTPGO_DATA_PROVIDER__DRIVER=mysql
- SFTPGO_DATA_PROVIDER__NAME=sftpgo
- SFTPGO_DATA_PROVIDER__HOST=mariadb
- SFTPGO_DATA_PROVIDER__PORT=3306
- SFTPGO_DATA_PROVIDER__USERNAME=sftpgo
- SFTPGO_DATA_PROVIDER__PASSWORD_FILE=/run/secrets/SFTPGO_PWD
- SFTPGO_COMMON__DEFENDER__BAN_TIME=60
- SFTPGO_COMMON__DEFENDER__BAN_TIME_INCREMENT=100
- SFTPGO_COMMON__DEFENDER__THRESHOLD=3
- SFTPGO_COMMON__DEFENDER__SCORE_LIMIT_EXCEEDED=2
- SFTPGO_COMMON__DEFENDER__OBSERVATION_TIME=15
volumes:
- ./config:/var/lib/sftpgo
- /volume1/sftp-go/client:/srv/sftpgo/client_files
secrets:
- SFTPGO_PWD

networks:
userdef_bridge:
external: true

secrets:
SFTPGO_PWD:
file: /volume1/docker/sftpgo/.secrets/sftpgo_pwd.txt

Relevant log output

{"level":"error","time":"2026-06-10T18:52:51.516","sender":"service","message":"error initializing data provider: Error 1045 (28000): Access denied for user 'sftpgo'@'<ip>' (using password: NO)"}

What are you using SFTPGo for?

Professional user, 1 person business

Additional info

No response

[micjgam]

A found workaround to this is to manually load the file for reading:

entrypoint: /bin/sh
command: >
  -c 'export SFTPGO_DATA_PROVIDER__PASSWORD="$$(cat /run/secrets/SFTPGO_PWD)";
      exec sftpgo serve'    

While this is great, I would still like to know why the _FILE handle does not seem to be working. Specifically, it is not reading the file for load.

[drakkan]

This feature has been added, but it's currently available only in the development version.

I checked the documentation, and it appears to be documented correctly:

https://docs.sftpgo.com/2.7/config-file/
https://docs.sftpgo.com/devel/config-file/

The option is present in the development documentation but not in the 2.7 documentation. If you'd like to use it now, you can run the edge Docker image.

[micjgam]

Thanks for your quick response. I did see the docs file, but until now, did not realize that I could select different versions at the top. Makes perfect sense...

Any idea when this feature will make the stable release?