1 { lib, pkgs, config, myconfig, ... }:
3 package = pkgs.pure-ftpd.override { ldapFtpId = "immaeFtp"; };
7 services.pure-ftpd.enable = lib.mkOption {
11 Whether to enable pure-ftpd.
16 config = lib.mkIf config.services.pure-ftpd.enable {
17 security.acme.certs."ftp" = config.services.myCertificates.certConfig // {
18 domain = "eldiron.immae.eu";
20 systemctl restart pure-ftpd.service
22 extraDomains = { "ftp.immae.eu" = null; };
27 allowedTCPPorts = [ 21 ];
28 allowedTCPPortRanges = [ { from = 40000; to = 50000; } ];
35 uid = config.ids.uids.ftp; # 8
37 description = "Anonymous FTP user";
38 home = "/homeless-shelter";
39 extraGroups = [ "keys" ];
43 users.groups.ftp.gid = config.ids.gids.ftp;
45 system.activationScripts.pure-ftpd = ''
46 install -m 0755 -o ftp -g ftp -d /var/lib/ftp
50 dest = "pure-ftpd-ldap";
55 LDAPServer ${myconfig.env.ftp.ldap.host}
58 LDAPBaseDN ${myconfig.env.ftp.ldap.base}
59 LDAPBindDN ${myconfig.env.ftp.ldap.dn}
60 LDAPBindPW ${myconfig.env.ftp.ldap.password}
62 LDAPForceDefaultUID False
64 LDAPForceDefaultGID False
65 LDAPFilter ${myconfig.env.ftp.ldap.filter}
69 # Pas de possibilite de donner l'Uid/Gid !
70 # Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid
71 LDAPHomeDir immaeFtpDirectory
75 services.filesWatcher.pure-ftpd = {
77 paths = [ "/var/secrets/pure-ftpd-ldap" ];
80 systemd.services.pure-ftpd = let
81 configFile = pkgs.writeText "pure-ftpd.conf" ''
82 PassivePortRange 40000 50000
85 BrokenClientsCompatibility yes
96 LDAPConfigFile /var/secrets/pure-ftpd-ldap
97 LimitRecursion 10000 8
98 AnonymousCanCreateDirs no
106 ProhibitDotFilesWrite no
107 ProhibitDotFilesRead no
109 AnonymousCantUpload no
113 CertFile ${config.security.acme.directory}/ftp/full.pem
116 description = "Pure-FTPd server";
117 wantedBy = [ "multi-user.target" ];
118 after = [ "network.target" ];
120 serviceConfig.ExecStart = "${package}/bin/pure-ftpd ${configFile}";
121 serviceConfig.Type = "forking";
122 serviceConfig.PIDFile = "/run/pure-ftpd.pid";