feat: add FTP, SFTP and more backup destinations via rclone

[promisingcoder]

Summary

Extends the backup destination system to support FTP, SFTP, and other rclone-supported providers beyond just S3.

Fixes #416

/claim #416

Changes

• Added new destination types to the schema
• Extended rclone configuration for multiple providers
• Added UI for configuring new destinations
• Updated backup/restore utilities
• Existing S3 backups unchanged

Greptile Summary

This PR extends Dokploy's backup destination system to support FTP, SFTP, and potentially other rclone-backed providers beyond S3. The core change adds a destinationType discriminator to the destination schema, introduces getFtpCredentials/getSftpCredentials helpers that mirror the existing getS3Credentials pattern, replaces all getS3Credentials call-sites with a new getDestinationCredentials dispatcher, and wires up the new destination types through the UI, router, and all backup/restore utilities.

Key concerns:

• Critical security vulnerability — command injection via FTP/SFTP password: Both getFtpCredentials and getSftpCredentials (and the identical inline code in testConnection) embed the raw password into a single-quoted shell subcommand: --ftp-pass="$(rclone obscure '${ftpPassword}')". A password containing a single quote ' breaks the shell quoting boundary and could allow arbitrary command execution on the server. This affects every FTP/SFTP backup, restore, and connection-test code path. The fix is to pre-compute the obscured password in a separate execAsync call before building the rclone flags string, so no raw user input ever appears inside a shell-interpolated command.
• Inconsistent needsShell guard in restore operations: Backup operations conditionally pass { shell: '/bin/bash' } to execAsync for FTP/SFTP, but all restore files (postgres.ts, mysql.ts, mariadb.ts, mongo.ts, compose.ts) call execAsync without this guard. In practice /bin/sh supports $(), but aligning the restore paths with the backup paths avoids confusion and potential issues on minimal systems.
• Unused variable in handle-destinations.tsx: defaultPort (line 309) is computed but never referenced.

Confidence Score: 1/5

• Not safe to merge — a command injection vulnerability allows arbitrary shell execution on the host when FTP/SFTP passwords contain single quotes.
• The FTP/SFTP password is interpolated directly inside a single-quoted shell subcommand ($(rclone obscure '${ftpPassword}')). This is present in getFtpCredentials, getSftpCredentials, and the testConnection router — covering every backup, restore, and connection-test code path for FTP/SFTP destinations. Any user-supplied password containing a single quote breaks shell quoting and can inject arbitrary commands running as the dokploy service account.
• packages/server/src/utils/backups/utils.ts (lines 83–96) and apps/dokploy/server/api/routers/destination.ts (lines 54–75) require immediate attention for the command injection fix.

Comments Outside Diff (1)

1. packages/server/src/utils/restore/postgres.ts, line 41-45 (link)

   Missing shell option for FTP/SFTP restore

   For backup operations the code conditionally passes { shell: '/bin/bash' } when the destination is FTP or SFTP (so that $(rclone obscure ...) subshell expansion works). This needsShell guard is absent here and in the other restore files (mariadb.ts, mysql.ts, mongo.ts, compose.ts).

   While Node.js's default /bin/sh does support POSIX $() syntax, the inconsistency is a maintenance hazard and may break on minimal systems where /bin/sh is dash or busybox and the command pipeline uses features that differ from bash.

   const destinationType = destination.destinationType || "s3";
   const needsShell = destinationType === "ftp" || destinationType === "sftp";
   
   if (serverId) {
     await execAsyncRemote(serverId, command);
   } else {
     await execAsync(command, needsShell ? { shell: "/bin/bash" } : undefined);
   }

   Apply the same pattern in all other restore files.

_{Last reviewed commit: "feat: add FTP and SF..."}

Greptile also left 3 inline comments on this PR.

_{(5/5) You can turn off certain types of comments like style here!}

[greptile-apps]

Shell command injection via FTP/SFTP password

The ftpPassword is interpolated directly into a shell command using single-quote quoting:

--ftp-pass="$(rclone obscure '${ftpPassword}')"

If the password contains a single quote ('), the quoting breaks, producing malformed shell syntax — or worse, arbitrary command injection. For example, a password like '; cat /etc/passwd; echo ' would be interpreted by the shell as three separate statements.

The same issue exists in getSftpCredentials on line 96.

The safe approach is to pre-compute the obscured password in a separate step before building the command string:

export const getFtpCredentials = async (destination: Destination) => {
  const { ftpHost, ftpPort, ftpUser, ftpPassword } = destination;
  // Pre-obscure the password so it is never shell-interpolated raw
  const { stdout } = await execAsync(`rclone obscure ${JSON.stringify(ftpPassword)}`);
  const obscuredPass = stdout.trim();
  return [
    `--ftp-host="${ftpHost}"`,
    `--ftp-port="${ftpPort || 21}"`,
    `--ftp-user="${ftpUser}"`,
    `--ftp-pass="${obscuredPass}"`,
  ];
};

Alternatively, consider writing an rclone config file instead of passing credentials as CLI flags.

[greptile-apps]

Same command injection on testConnection

The same raw password interpolation pattern appears in testConnection for both FTP (line 59) and SFTP (line 73):

`--ftp-pass="$(rclone obscure '${ftpPassword}')"`,
`--sftp-pass="$(rclone obscure '${ftpPassword}')"`,

A password containing a single quote breaks the shell quoting. The fix described in utils.ts (pre-compute the obscured password) should be applied here as well.

[greptile-apps]

Unused defaultPort variable

defaultPort is computed but never referenced — the FTP and SFTP payload objects below both hard-code their fallback ports directly (|| 21 and || 22).

Suggested change

	const defaultPort = type === "sftp" ? 22 : 21;
	const ftpPayload =
	const ftpPayload =