modules/private/ftp.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   package = pkgs.pure-ftpd.override { ldapFtpId = "immaeFtp"; };
   4 in
   5 {
   6   options = {
   7     services.pure-ftpd.enable = lib.mkOption {
   8       type = lib.types.bool;
   9       default = false;
  10       description = ''
  11         Whether to enable pure-ftpd.
  12       '';
  13     };
  14   };
  15
  16   config = lib.mkIf config.services.pure-ftpd.enable {
  17     services.duplyBackup.profiles.ftp = {
  18       rootDir = "/var/lib/ftp";
  19     };
  20     security.acme.certs."ftp" = config.myServices.certificates.certConfig // {
  21       domain = "eldiron.immae.eu";
  22       postRun = ''
  23         systemctl restart pure-ftpd.service
  24       '';
  25       extraDomains = { "ftp.immae.eu" = null; };
  26     };
  27
  28     networking = {
  29       firewall = {
  30         allowedTCPPorts = [ 21 ];
  31         allowedTCPPortRanges = [ { from = 40000; to = 50000; } ];
  32       };
  33     };
  34
  35     users.users.ftp = {
  36       uid = config.ids.uids.ftp; # 8
  37       group = "ftp";
  38       description = "Anonymous FTP user";
  39       home = "/homeless-shelter";
  40       extraGroups = [ "keys" ];
  41     };
  42
  43     users.groups.ftp.gid = config.ids.gids.ftp;
  44
  45     system.activationScripts.pure-ftpd = ''
  46       install -m 0755 -o ftp -g ftp -d /var/lib/ftp
  47       '';
  48
  49     secrets.keys = [{
  50       dest = "pure-ftpd-ldap";
  51       permissions = "0400";
  52       user = "ftp";
  53       group = "ftp";
  54       text = ''
  55         LDAPServer          ${config.myEnv.ftp.ldap.host}
  56         LDAPPort            389
  57         LDAPUseTLS          True
  58         LDAPBaseDN          ${config.myEnv.ftp.ldap.base}
  59         LDAPBindDN          ${config.myEnv.ftp.ldap.dn}
  60         LDAPBindPW          ${config.myEnv.ftp.ldap.password}
  61         LDAPDefaultUID      500
  62         LDAPForceDefaultUID False
  63         LDAPDefaultGID      100
  64         LDAPForceDefaultGID False
  65         LDAPFilter          ${config.myEnv.ftp.ldap.filter}
  66
  67         LDAPAuthMethod      BIND
  68
  69         # Pas de possibilite de donner l'Uid/Gid !
  70         # Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid
  71         LDAPHomeDir         immaeFtpDirectory
  72         '';
  73     }];
  74
  75     services.filesWatcher.pure-ftpd = {
  76       restart = true;
  77       paths = [ "/var/secrets/pure-ftpd-ldap" ];
  78     };
  79
  80     systemd.services.pure-ftpd = let
  81       configFile = pkgs.writeText "pure-ftpd.conf" ''
  82         PassivePortRange             40000 50000
  83         ChrootEveryone               yes
  84         CreateHomeDir                yes
  85         BrokenClientsCompatibility   yes
  86         MaxClientsNumber             50
  87         Daemonize                    yes
  88         MaxClientsPerIP              8
  89         VerboseLog                   no
  90         DisplayDotFiles              yes
  91         AnonymousOnly                no
  92         NoAnonymous                  no
  93         SyslogFacility               ftp
  94         DontResolve                  yes
  95         MaxIdleTime                  15
  96         LDAPConfigFile               /var/secrets/pure-ftpd-ldap
  97         LimitRecursion               10000 8
  98         AnonymousCanCreateDirs       no
  99         MaxLoad                      4
 100         AntiWarez                    yes
 101         Umask                        133:022
 102         # ftp
 103         MinUID                       8
 104         AllowUserFXP                 no
 105         AllowAnonymousFXP            no
 106         ProhibitDotFilesWrite        no
 107         ProhibitDotFilesRead         no
 108         AutoRename                   no
 109         AnonymousCantUpload          no
 110         MaxDiskUsage                 99
 111         CustomerProof                yes
 112         TLS                          1
 113         CertFile                     ${config.security.acme.certs.ftp.directory}/full.pem
 114         '';
 115     in {
 116       description = "Pure-FTPd server";
 117       wantedBy = [ "multi-user.target" ];
 118       after = [ "network.target" ];
 119
 120       serviceConfig.ExecStart = "${package}/bin/pure-ftpd ${configFile}";
 121       serviceConfig.Type = "forking";
 122       serviceConfig.PIDFile = "/run/pure-ftpd.pid";
 123     };
 124   };
 125
 126 }