SFTP
Each new build uploaded to your server over SFTP, or FTPS.
We upload each new build of the databases you choose to a server of yours, over SFTP or over FTP with TLS. What lands there, and when, is on Database Delivery. Each file goes up under a temporary name ending in .partial and is renamed once it's complete, so nothing reads half a file.
Deliveries don't come from a fixed set of addresses, so a server that only takes connections from listed ones won't accept them.
SFTP
In the console, add an SFTP destination with the server's host and port, the user we sign in as, and a folder: one starting with / is absolute, anything else is under the user's home.
We sign in with an SSH key we make for the destination, which is what we recommend. Save, and the destination shows its public key, one line to add to that user's ~/.ssh/authorized_keys:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGs1d0RkE5Ge2Jw0n3qM8wq1q5c0V3Gm5n7Jk2bq8pZx vpndetection-deliveryThe private half never leaves us, and deleting the destination is the end of it. A password works too, where the server takes one.
The first Test connection reads the server's host key, pins it and shows its fingerprint, which you can compare with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on the server. From then on we won't connect to a server presenting any other key. If you change the host key on purpose, click Forget beside the pinned one, test again to pin the new key, and activate.
We need the SFTP protocol alone, never a shell, so a chrooted SFTP-only user works, as do managed servers such as AWS Transfer Family.
FTPS
FTPS is FTP over TLS. We only deliver over TLS, never plain FTP, which would send your password and the databases in the clear.
Add an FTPS destination with the host, port, user, password and folder, and pick the TLS mode your server speaks: Explicit upgrades the connection with AUTH TLS, usually on port 21, and is the more common; Implicit is TLS from the first byte, usually on port 990. A test against a port in the other mode fails, sometimes only after 30 seconds and with a login error, so if a test fails that way, try the other mode.
The server's certificate has to validate. For a self-signed one, turn on Accept a certificate that doesn't validate, knowing that anyone between us and the server could then read what we send. We transfer in passive mode, so the server's passive port range has to accept connections from the internet too, and we speak TLS 1.2, which every FTPS server supports.