2026 SFTP, rsync & scp over SSH: moving large files to rented ProxyMac Mac mini in HK / JP / KR / SG / US without saturating your uplink

Teams onboarding datasets, Xcode archives, or CI artifacts onto Apple Silicon Mac mini hosts in Hong Kong, Japan, Korea, Singapore, or the United States usually start with a simple scp—then watch the transfer crawl, fail halfway, or anger everyone on the same coffee-shop Wi-Fi. The failure is rarely “SSH is slow”; it is tooling choice × congestion control × resume semantics × disk flush ordering on a path that already carries real RTT. This guide delivers (1) a symptom vocabulary, (2) a four-row decision matrix for SFTP vs rsync vs legacy scp, (3) bandwidth fairness patterns, (4) resume/partial strategies that survive flaky last miles, (5) a nine-step operational runbook, and explicit bridges into long-RTT client tuning, MTU / PMTUD stalls, TCP keepalive knobs, and cross-region latency planning.

• Hidden coupling: saturating uplink SSH also starves VNC mouse events—coordinate bulk jobs with GUI sessions per the cross-region guide.
• Resume myth: plain scp does not magically restart mid-file; you need rsync --partial, dedicated SFTP clients, or chunked tools.
• Disk side: APFS on the mini still needs free space headroom for sparse writes; a “100% full” volume mid-transfer corrupts fewer bits but aborts more jobs.

Why bulk transfers over SSH feel worse than interactive shells

Interactive SSH tolerates jitter because humans type slowly relative to link capacity. A single long-lived bulk flow keeps the congestion window pinned high, exposes every micro-loss on trans-Pacific paths, and interacts badly with middleboxes that police sustained throughput. When RTT exceeds ~120ms, small send-buffer misconfigurations show up as “stalls at 80%” that are actually waiting for ACKs—tune the client first using the IPQoS and cipher recipe, then revisit tooling.

Decision matrix: SFTP, rsync over SSH, and classic scp

Tool	Resumable partial	Directory delta	Built-in throttle	Best default for multi-GB trees
OpenSSH scp (legacy mode)	No—restart from zero	Whole tree each run	No first-class flag	Quick one-offs only
SFTP / GUI clients	Often yes (client-dependent)	Mirror tools vary	Speed limits in UI	Designer hand-offs, drag-drop
rsync -e ssh	Yes with --partial	Strong—checksum modes	--bwlimit	CI artifacts & datasets
sftp batch / reget patterns	Scriptable with care	File-at-a-time	Combine with trickle or QoS	Strict jump-host pipelines

When you already fixed PMTUD black holes but still see saw-tooth throughput, switch the discussion from “which cipher” to how many parallel sessions you run: three unthrottled rsync jobs often lose to one throttled job with a deeper window.

Bandwidth fairness: home office uplinks vs colocated minis

ProxyMac minis sit on well-provisioned datacenter egress; your asymmetric home cable is usually the bottleneck. Use rsync --bwlimit=… in KiB/s to leave headroom for DNS, Slack, and Zoom—especially when executives share the VLAN with your HK → US dataset push. Pair numeric limits with time-of-day windows: schedule heavy rsync during local night hours when Wi-Fi contention drops.

If corporate policy forces traffic through an HTTP proxy, bulk SSH may already be wrapped—see the dedicated ProxyCommand guide in the corporate networking article family; do not stack throttles in two layers without measuring.

Resume, partial files, and atomic hand-off to teammates

Always combine --partial with a deterministic partial directory (e.g. .rsync-partial) so operators know which files are incomplete. For “publish when done” workflows, write into a staging path on the mini then mv into place—atomic rename on the same APFS volume avoids half-visible tarballs. Document checksum policy: -c verifies integrity at the cost of CPU; skip on trusted LAN, enable on cross-border paths with history of bit flips.

Keep ServerAliveInterval and ServerAliveCountMax aligned with TCP user timeout guidance so NAT middleboxes do not silently kill overnight jobs; log disconnect reasons to your ticket system.

Nine-step runbook for resilient pushes into HK / JP / KR / SG / US minis

1. Snapshot intent: record source size, file count, and acceptable completion window in the ticket.
2. Path MTU check: run the triage from the MTU article before multi-hour copies.
3. Pick tool: default to rsync for trees; fall back to GUI SFTP for ad-hoc creatives.
4. Throttle: set --bwlimit or router QoS; confirm spare upstream with a quick speed test.
5. Client tuning: apply IPQoS=throughput for bulk.
6. Disk headroom: df -h on the mini; reserve ≥15% APFS breathing room.
7. Execute with logging: tee verbose logs locally; never paste secrets into public channels.
8. Validate: checksum or size-compare post-copy; spot-check random files.
9. Post-mortem: if SLA missed, attach RTT graphs + rsync stats—not subjective “felt slow” notes.

FAQ

Should I encrypt disk images again inside rsync? Already-compressed formats gain little from SSH compression; disable when CPU-bound.

Does AFP/SMB beat SSH on the same mini? Sometimes for Finder-native workflows, but SSH+rsync stays firewall-friendly and scriptable—pick per workflow, not dogma.

What about zstd pipelines? Excellent when CPU wins over bandwidth—still wrap with the same keepalive and MTU hygiene.

Why bare-metal Mac mini still wins for bulk ingest

Rented Mac mini M4 nodes give predictable NVMe throughput, no neighbor stealing disk IOPS, and macOS-native paths for Xcode and creative suites—ideal when your HK / JP / KR / SG / US strategy needs the same ingest recipe in every geography. Compare regions on the pricing page, rehearse transfers using the help centre, and when GUI verification matters mid-copy, keep VNC sessions on a separate QoS class from bulk SSH.