]>
Commit | Line | Data |
---|---|---|
439049e5 IB |
1 | { lib, pkgs, config, myconfig, ... }: |
2 | { | |
3 | options = { | |
4 | services.pure-ftpd.enable = lib.mkOption { | |
5 | type = lib.types.bool; | |
6 | default = false; | |
7 | description = '' | |
8 | Whether to enable pure-ftpd. | |
9 | ''; | |
10 | }; | |
11 | }; | |
12 | ||
13 | config = lib.mkIf config.services.pure-ftpd.enable { | |
14 | security.acme.certs."ftp" = config.services.myCertificates.certConfig // { | |
15 | domain = "eldiron.immae.eu"; | |
740f9843 IB |
16 | postRun = '' |
17 | systemctl restart pure-ftpd.service | |
18 | ''; | |
19be5cd2 | 19 | extraDomains = { "ftp.immae.eu" = null; }; |
439049e5 IB |
20 | }; |
21 | ||
2368a4b7 IB |
22 | nixpkgs.overlays = [ (self: super: { |
23 | pure-ftpd = self.callPackage ./pure-ftpd.nix {}; | |
24 | }) ]; | |
439049e5 IB |
25 | |
26 | networking = { | |
27 | firewall = { | |
28 | allowedTCPPorts = [ 21 ]; | |
29 | allowedTCPPortRanges = [ { from = 40000; to = 50000; } ]; | |
30 | }; | |
31 | }; | |
32 | ||
33 | users.users = [ | |
34 | { | |
35 | name = "ftp"; | |
926a4007 | 36 | uid = config.ids.uids.ftp; # 8 |
439049e5 IB |
37 | group = "ftp"; |
38 | description = "Anonymous FTP user"; | |
39 | home = "/homeless-shelter"; | |
926a4007 | 40 | extraGroups = [ "keys" ]; |
439049e5 IB |
41 | } |
42 | ]; | |
43 | ||
44 | users.groups.ftp.gid = config.ids.gids.ftp; | |
45 | ||
46 | system.activationScripts.pure-ftpd = '' | |
47 | install -m 0755 -o ftp -g ftp -d /var/lib/ftp | |
48 | ''; | |
49 | ||
742697c9 IB |
50 | mySecrets.keys = [{ |
51 | dest = "pure-ftpd-ldap"; | |
926a4007 IB |
52 | permissions = "0400"; |
53 | user = "ftp"; | |
54 | group = "ftp"; | |
55 | text = '' | |
439049e5 IB |
56 | LDAPServer ${myconfig.env.ftp.ldap.host} |
57 | LDAPPort 389 | |
58 | LDAPUseTLS True | |
59 | LDAPBaseDN ${myconfig.env.ftp.ldap.base} | |
60 | LDAPBindDN ${myconfig.env.ftp.ldap.dn} | |
61 | LDAPBindPW ${myconfig.env.ftp.ldap.password} | |
62 | LDAPDefaultUID 500 | |
63 | LDAPForceDefaultUID False | |
64 | LDAPDefaultGID 100 | |
65 | LDAPForceDefaultGID False | |
66 | LDAPFilter ${myconfig.env.ftp.ldap.filter} | |
67 | ||
68 | LDAPAuthMethod BIND | |
69 | ||
926a4007 IB |
70 | # Pas de possibilite de donner l'Uid/Gid ! |
71 | # Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid | |
439049e5 IB |
72 | LDAPHomeDir immaeFtpDirectory |
73 | ''; | |
742697c9 | 74 | }]; |
926a4007 IB |
75 | |
76 | systemd.services.pure-ftpd = let | |
439049e5 IB |
77 | configFile = pkgs.writeText "pure-ftpd.conf" '' |
78 | PassivePortRange 40000 50000 | |
79 | ChrootEveryone yes | |
80 | CreateHomeDir yes | |
81 | BrokenClientsCompatibility yes | |
82 | MaxClientsNumber 50 | |
83 | Daemonize yes | |
84 | MaxClientsPerIP 8 | |
85 | VerboseLog no | |
86 | DisplayDotFiles yes | |
87 | AnonymousOnly no | |
88 | NoAnonymous no | |
89 | SyslogFacility ftp | |
90 | DontResolve yes | |
91 | MaxIdleTime 15 | |
742697c9 | 92 | LDAPConfigFile /var/secrets/pure-ftpd-ldap |
439049e5 IB |
93 | LimitRecursion 10000 8 |
94 | AnonymousCanCreateDirs no | |
95 | MaxLoad 4 | |
96 | AntiWarez yes | |
97 | Umask 133:022 | |
98 | # ftp | |
99 | MinUID 8 | |
100 | AllowUserFXP no | |
101 | AllowAnonymousFXP no | |
102 | ProhibitDotFilesWrite no | |
103 | ProhibitDotFilesRead no | |
104 | AutoRename no | |
105 | AnonymousCantUpload no | |
106 | MaxDiskUsage 99 | |
107 | CustomerProof yes | |
108 | TLS 1 | |
109 | CertFile /var/lib/acme/ftp/full.pem | |
110 | ''; | |
111 | in { | |
112 | description = "Pure-FTPd server"; | |
113 | wantedBy = [ "multi-user.target" ]; | |
114 | after = [ "network.target" ]; | |
115 | ||
116 | serviceConfig.ExecStart = "${pkgs.pure-ftpd}/bin/pure-ftpd ${configFile}"; | |
117 | serviceConfig.Type = "forking"; | |
118 | serviceConfig.PIDFile = "/run/pure-ftpd.pid"; | |
119 | }; | |
120 | }; | |
121 | ||
122 | } |