colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

sftpgo: reduce the passive port range

Browse Source 
hopefully this eases the load on the upstream firewall's UPNP service
This commit is contained in:
Colin
2024-04-22 12:08:23 +00:00
parent 12f2798140
commit d0de6a9254
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
hosts/by-name/servo/services/export/sftpgo/default.nix
View File

@@ -13,13 +13,15 @@ let
pname = "external_auth_hook"; pname = "external_auth_hook";
srcRoot = ./.; srcRoot = ./.;
}; };
in
{
# Client initiates a FTP "control connection" on port 21. # Client initiates a FTP "control connection" on port 21.
# - this handles the client -> server commands, and the server -> client status, but not the actual data # - this handles the client -> server commands, and the server -> client status, but not the actual data
# - file data, directory listings, etc need to be transferred on an ephemeral "data port". # - file data, directory listings, etc need to be transferred on an ephemeral "data port".
# - 50000-50100 is a common port range for this. # - 50000-50100 is a common port range for this.
# 50000 is used by soulseek. # 50000 is used by soulseek.
passiveStart = 50050;
passiveEnd = 50070;
in
{
sane.ports.ports = { sane.ports.ports = {
"21" = { "21" = {
protocol = [ "tcp" ]; protocol = [ "tcp" ];
@@ -43,7 +45,7 @@ in
description = "colin-FTP server data port range"; description = "colin-FTP server data port range";
}; };
}) })
(lib.range 50050 50100) (lib.range passiveStart passiveEnd)
); );
# use nginx/acme to produce a cert for FTPS # use nginx/acme to produce a cert for FTPS
@@ -114,8 +116,8 @@ in
disable_active_mode = true; disable_active_mode = true;
hash_support = true; hash_support = true;
passive_port_range = { passive_port_range = {
start = 50050; start = passiveStart;
end = 50100; end = passiveEnd;
}; };
certificate_file = "/var/lib/acme/ftp.uninsane.org/full.pem"; certificate_file = "/var/lib/acme/ftp.uninsane.org/full.pem";