hosts/losurdo/sftp.nix

   1 { inputs, pkgs, lib, config, hostName, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   nginxRoot = "/var/lib/nginx/${domain}/sftp";
   5   sftpRoot = "/var/lib/sftp";
   6 in
   7 {
   8 fileSystems.${sftpRoot} = {
   9   device = "${hostName}/var/sftp";
  10   fsType = "zfs";
  11 };
  12 services.sanoid.datasets."${hostName}/var/sftp" = {
  13   use_template = [ "snap" ];
  14   daily = 31;
  15 };
  16 services.nginx.virtualHosts = let
  17   virtualHost = {
  18     root = nginxRoot;
  19     locations."/".extraConfig = ''
  20       #autoindex on;
  21       return 444;
  22     '';
  23     locations."/sevy".extraConfig = ''
  24       autoindex on;
  25       fancyindex on;
  26       fancyindex_exact_size off;
  27       fancyindex_name_length 255;
  28       open_file_cache off;
  29       #open_file_cache_valid 1s;
  30     '';
  31   };
  32   in {
  33   "sftp.${hostName}.wg" = lib.mkMerge [ virtualHost {
  34     listenAddresses = [ "${hostName}.wg" ];
  35     extraConfig = ''
  36       access_log /var/log/nginx/wg-intra/${hostName}/sftp/access.json json buffer=32k;
  37       error_log  /var/log/nginx/wg-intra/${hostName}/sftp/error.log warn;
  38     '';
  39   } ];
  40   "sftp.${domain}" = lib.mkMerge [ virtualHost {
  41     forceSSL = true;
  42     useACMEHost = domain;
  43     extraConfig = ''
  44       access_log /var/log/nginx/${domain}/${hostName}/sftp/access.json json buffer=32k;
  45       error_log  /var/log/nginx/${domain}/${hostName}/sftp/error.log warn;
  46     '';
  47   } ];
  48 };
  49 systemd.services.nginx = {
  50   serviceConfig = {
  51     LogsDirectory = lib.mkForce [
  52       "nginx/wg-intra/${hostName}/sftp"
  53       "nginx/${domain}/${hostName}/sftp"
  54     ];
  55     BindReadOnlyPaths = [
  56       "${sftpRoot}/sevy/public:${nginxRoot}/sevy"
  57     ];
  58   };
  59 };
  60 /*
  61 services.syncoid.commands = {
  62   "${hostName}/var/sftp" = {
  63     sendOptions = "raw";
  64     target = "backup@mermet.${networking.domain}:rpool/backup/${hostName}/var/sftp";
  65   };
  66 };
  67 */
  68 fileSystems."${sftpRoot}/torrents" = {
  69   device = "/var/lib/transmission/downloaded";
  70   options = [ "bind" "ro" ];
  71 };
  72 fileSystems."${sftpRoot}/podcasts" = {
  73   device = "/home/julm/dl";
  74   options = [ "bind" "ro" ];
  75 };
  76 services.openssh.extraConfig = ''
  77   Match User sevy
  78     AllowAgentForwarding no
  79     AllowTcpForwarding no
  80     ChrootDirectory ${sftpRoot}
  81     ForceCommand internal-sftp
  82     X11Forwarding no
  83 '';
  84 }