90 lines
2.2 KiB
Nix
90 lines
2.2 KiB
Nix
{ lib, pkgs, ... }:
|
||
{
|
||
users.users.scan = {
|
||
home = "/var/lib/scans";
|
||
isSystemUser = true;
|
||
group = "scan";
|
||
# this is a low-risk account and since the only thing the account can do is
|
||
# login to the ftp server from my home network, you can also sniff the
|
||
# password since the connection is unencrypted
|
||
password = "meeB3laodoo8na3z";
|
||
};
|
||
users.groups.scan = { };
|
||
|
||
systemd.tmpfiles.rules = [
|
||
"d /var/lib/scans 0755 scan root 7d"
|
||
];
|
||
|
||
sbruder.restic.system.extraExcludes = [ "/var/lib/scans" ];
|
||
|
||
services.vsftpd = {
|
||
enable = true;
|
||
writeEnable = true;
|
||
localUsers = true;
|
||
userlist = [ "scan" ];
|
||
extraConfig = ''
|
||
# I only want this to be reachable from within my home network. Since
|
||
# IPv6 has all ports forwarded, it is disabled here.
|
||
listen=YES
|
||
listen_ipv6=NO
|
||
|
||
# user’s shell is nologin
|
||
check_shell=NO
|
||
|
||
# scans should be readable
|
||
local_umask=022
|
||
|
||
pasv_min_port=30000
|
||
pasv_max_port=30009
|
||
'';
|
||
};
|
||
|
||
services.nginx.virtualHosts."scan.sbruder.de" = {
|
||
enableACME = true;
|
||
forceSSL = true;
|
||
|
||
locations."/" = {
|
||
root = "/var/lib/scans";
|
||
|
||
extraConfig = ''
|
||
autoindex on;
|
||
|
||
allow 192.168.100.0/24;
|
||
allow 2001:470:1f0b:abc::/64;
|
||
deny all;
|
||
'';
|
||
};
|
||
};
|
||
|
||
networking.firewall = {
|
||
allowedTCPPorts = [ 21 ];
|
||
allowedTCPPortRanges = [{ from = 30000; to = 30009; }];
|
||
};
|
||
|
||
systemd.services.scan-converter = {
|
||
wantedBy = [ "multi-user.target" ];
|
||
script = ''
|
||
set -euo pipefail
|
||
${pkgs.inotify-tools}/bin/inotifywait -m --include "\.tif$" -e close_write /var/lib/scans | while read path action file; do
|
||
echo "Converting ''${file}…"
|
||
${pkgs.imagemagick}/bin/convert -strip "/var/lib/scans/$file" "/var/lib/scans/''${file%.*}.png"
|
||
rm "/var/lib/scans/$file"
|
||
done
|
||
'';
|
||
serviceConfig = {
|
||
User = "scan";
|
||
Restart = "always";
|
||
|
||
# systemd-analyze --no-pager security scan-converter.service
|
||
CapabilityBoundingSet = null;
|
||
PrivateDevices = true;
|
||
PrivateNetwork = true;
|
||
PrivateTmp = true;
|
||
PrivateUsers = true;
|
||
ProtectHome = true;
|
||
RestrictNamespaces = true;
|
||
SystemCallFilter = "@system-service";
|
||
};
|
||
};
|
||
}
|