1 { lib, pkgs, config, myconfig, ... }:
4 services.pure-ftpd.enable = lib.mkOption {
8 Whether to enable pure-ftpd.
13 config = lib.mkIf config.services.pure-ftpd.enable {
14 security.acme.certs."ftp" = config.services.myCertificates.certConfig // {
15 domain = "eldiron.immae.eu";
17 systemctl restart pure-ftpd.service
19 extraDomains = { "ftp.immae.eu" = null; };
22 nixpkgs.overlays = [ (self: super: {
23 pure-ftpd = self.callPackage ./pure-ftpd.nix {};
28 allowedTCPPorts = [ 21 ];
29 allowedTCPPortRanges = [ { from = 40000; to = 50000; } ];
36 uid = config.ids.uids.ftp; # 8
38 description = "Anonymous FTP user";
39 home = "/homeless-shelter";
40 extraGroups = [ "keys" ];
44 users.groups.ftp.gid = config.ids.gids.ftp;
46 system.activationScripts.pure-ftpd = ''
47 install -m 0755 -o ftp -g ftp -d /var/lib/ftp
51 dest = "pure-ftpd-ldap";
56 LDAPServer ${myconfig.env.ftp.ldap.host}
59 LDAPBaseDN ${myconfig.env.ftp.ldap.base}
60 LDAPBindDN ${myconfig.env.ftp.ldap.dn}
61 LDAPBindPW ${myconfig.env.ftp.ldap.password}
63 LDAPForceDefaultUID False
65 LDAPForceDefaultGID False
66 LDAPFilter ${myconfig.env.ftp.ldap.filter}
70 # Pas de possibilite de donner l'Uid/Gid !
71 # Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid
72 LDAPHomeDir immaeFtpDirectory
76 systemd.services.pure-ftpd = let
77 configFile = pkgs.writeText "pure-ftpd.conf" ''
78 PassivePortRange 40000 50000
81 BrokenClientsCompatibility yes
92 LDAPConfigFile /var/secrets/pure-ftpd-ldap
93 LimitRecursion 10000 8
94 AnonymousCanCreateDirs no
102 ProhibitDotFilesWrite no
103 ProhibitDotFilesRead no
105 AnonymousCantUpload no
109 CertFile /var/lib/acme/ftp/full.pem
112 description = "Pure-FTPd server";
113 wantedBy = [ "multi-user.target" ];
114 after = [ "network.target" ];
116 serviceConfig.ExecStart = "${pkgs.pure-ftpd}/bin/pure-ftpd ${configFile}";
117 serviceConfig.Type = "forking";
118 serviceConfig.PIDFile = "/run/pure-ftpd.pid";