hosts/aubergine/sftp.nix

   1 { pkgs, lib, ... }:
   2 let
   3   sftpRoot = "/var/lib/sftp";
   4 in
   5 {
   6   systemd.mounts = [
   7     {
   8       where = "${sftpRoot}/films";
   9       type = "none";
  10       what = "/mnt/off3/julm/public/podcasts/films";
  11       options = "bind,ro,noauto";
  12       requires = [ "zfs-import@off3.service" ];
  13       after = [
  14         "zfs-import@off3.service"
  15         "zfs-mount.service"
  16         "var-lib-sftp.mount"
  17         "mnt-off3-julm-public-podcasts.mount"
  18       ];
  19       #bindsTo = [ "mnt-off3-julm-public-podcasts.mount" ];
  20       unitConfig = {
  21         #AssertDirectoryNotEmpty = "/mnt/off3/julm/public/podcasts/films";
  22       };
  23     }
  24   ];
  25   systemd.automounts = [
  26     {
  27       where = "${sftpRoot}/films";
  28       wantedBy = [ "zfs-mount.service" ];
  29       after = [ "zfs-mount.service" "var-lib-sftp.mount" ];
  30       #automountConfig.TimeoutIdleSec = "5 min";
  31     }
  32   ];
  33   fileSystems."${sftpRoot}/camera" = {
  34     device = "/mnt/off2/julm/perso/camera";
  35     options = [ "bind" "ro" "noauto" ];
  36   };
  37   services.openssh.extraConfig = ''
  38     Match User sevy
  39       AllowAgentForwarding no
  40       AllowTcpForwarding no
  41       ChrootDirectory ${sftpRoot}
  42       ForceCommand internal-sftp -u 0002
  43       X11Forwarding no
  44   '';
  45
  46   services.udev.extraRules = ''
  47     SUBSYSTEM=="block", KERNEL=="sd*", ENV{ID_SERIAL}=="TOSHIBA_MK6459GSXP_519DC07HT", \
  48       ACTION=="add", ENV{SYSTEMD_WANTS}+="zfs-import@off3.service"
  49     SUBSYSTEM=="block", KERNEL=="sd*", ENV{ID_SERIAL}=="TOSHIBA_MK6459GSXP_519DC07HT", \
  50       ACTION=="remove", RUN+="${pkgs.systemd}/bin/systemctl stop --no-block zfs-import@off3.service"
  51   '';
  52 }