anchu/ftp
Adds an FTP filesystem driver to Laravel so you can use the familiar Storage disk API to upload, download, list, and delete files on remote FTP servers. Configure a disk with your host and credentials and work with remote files like local ones.
Architecture fit. anchu/ftp is a thin Laravel service provider that registers an FTP/SFTP filesystem driver on top of Flysystem. It is not an application-layer abstraction — it produces a Storage-compatible disk, meaning the integration surface is the standard Laravel Filesystem contract. That is architecturally benign: it sits at the edge, adds no middleware, no persistence, no queue or event coupling, and can be swapped for a native disk without touching call sites if we keep Storage::disk('...') as the only access pattern. The real fit question is necessity: Laravel's native filesystem driver has supported FTP for years, and SFTP is available natively in current versions (via league/flysystem-sftp-v3). The package's original value was convenience on older Laravel releases, which no longer differentiates it.
Integration feasibility. Low technical effort, high governance friction. Composer install is trivial; the risk is dependency resolution. The last release (2020-11-07) predates Laravel 8 GA and the Flysystem 3.x migration that Laravel 9 adopted, so the package likely pins Flysystem 1.x/2.x adapters. On a modern Laravel baseline that either fails composer update outright or forces a downgrade of league/flysystem — a non-starter, since our cloud/S3 disks share that dependency. Verify by inspecting the composer.json constraints and running a dry-run resolution against our actual lockfile before any design work proceeds.
Technical risk.
Key questions.
Storage::disk('ftp') configured natively, with zero new dependencies?Stack fit. Poor as a new dependency, adequate as a pattern. The correct integration is a configuration and adapter exercise, not a package adoption: define an ftp (or sftp) disk in config/filesystems.php, inject credentials from our secrets manager rather than .env literals, and route all access through an internal FileTransfer interface with put/pull/list/delete semantics. If SFTP is required, add league/flysystem-sftp-v3 — actively maintained, the same underlying library Laravel uses. This preserves 100% of the package's functional value with none of its maintenance exposure.
Migration path. Assume anchu/ftp is already referenced somewhere (legacy service, inherited codebase). Sequence: (1) inventory call sites via static analysis for Storage::disk( and any direct League\Flysystem usage; (2) introduce the internal FileTransfer interface and wrap existing calls so the disk name is a single configuration point; (3) swap the backing disk to native ftp/sftp; (4) remove the package and its transitive Flysystem pin; (5) confirm framework upgrade no longer blocked. Steps 3–5 are reversible and each is independently shippable.
Compatibility. Confirm the target Laravel version's Filesystem API surface — Flysystem 3 removed getAdapter(), changed exception types, and altered readStream semantics, so any code reaching past the Storage facade will break. Audit for adapter-level calls before committing to the swap.
Sequencing. Week 1: dependency-resolution spike plus a written FTP-vs-SFTP decision from the endpoint owner. Week 2: interface extraction and contract tests against a disposable FTP/SFTP container (including passive-mode and large-file cases). Week 3: swap backing disk behind a feature flag, run shadow transfers, then delete the package. Do not begin with the package removal — the interface extraction is the load-bearing step.
Maintenance. Adopting the package imports an unmaintained dependency into a maintained platform. Every Laravel major upgrade becomes a manual patch exercise on a package nobody owns — or, more likely, a fork. Forking is viable (the provider is small) but converts an OSS cost into a permanent internal ownership cost with no upstream to rebase against. Native disks carry zero incremental maintenance and inherit framework security patches automatically.
Support. No active maintainer means no CVE response path, no bug triage, and no answers on driver edge cases. Our on-call would own FTP failure diagnosis with no upstream escalation — a real gap for anything on a revenue path.
Scaling. FTP is connection-oriented and effectively stateful per transfer. Under load we hit per-server connection caps and passive-mode port-range limits, and there is no native multipart or concurrent-chunk semantics — throughput scales by adding worker processes, which fights the connection ceiling. This is not a platform for high-volume or low-latency transfers; it is appropriate for scheduled batch exchange with a partner endpoint. Sizing must be based on concurrent transfers × file size against the remote server's limits, not our own CPU.
Failure modes. Expect: handshake and authentication timeouts; passive-mode failures behind NAT/firewall (the classic silent-stall); partial writes leaving truncated remote files with no atomic rename guarantee; TLS certificate validation failures on self-signed partner endpoints; permission-denied on directory creation; and disk-full conditions surfacing as opaque adapter exceptions. Mitigations: explicit connect/transfer timeouts, write-to-temp-then-rename, checksum or size verification post-transfer, bounded retries with backoff, and structured logging that captures command, host, and response code. Every transfer should be idempotent and observable — silent partial success is the dominant operational risk here.
Ramp-up. Developer ramp-up is low: the Storage facade is familiar and the API is four methods. Operational ramp-up is moderate: engineers must understand passive vs active mode, firewall port ranges, and TLS modes to debug failures, which is uncommon knowledge on a typical Laravel team. Budget a short runbook and a containerized test fixture; without them, the first production incident will be diagnosed by trial and error. Net recommendation: do not adopt the package — use native disks behind an internal interface, and treat the dependency as technical debt to retire.
How can I help you explore Laravel packages today?