diff --git a/mkosi.default.d/debian/mkosi.default b/mkosi.default.d/debian/mkosi.default index 89c3dcd..e000d28 100644 --- a/mkosi.default.d/debian/mkosi.default +++ b/mkosi.default.d/debian/mkosi.default @@ -1,6 +1,6 @@ [Distribution] Distribution = debian -Release = bullseye +Release = testing Mirror = https://deb.debian.org/debian [Output] diff --git a/mkosi.prepare b/mkosi.prepare index 8b92435..9eed282 100755 --- a/mkosi.prepare +++ b/mkosi.prepare @@ -21,6 +21,10 @@ fi # Generate default self-signed TLS key pair openssl req -subj '/' -new -newkey RSA:3072 -days 3650 -nodes -x509 -keyout /etc/ssl/private/niver.key -out /etc/ssl/certs/niver.crt -# Generate SSH server key pair +# Generate OpenSSH server key pair ssh-keygen -f /etc/ssh/ed25519 -t ed25519 -N "" ssh-keygen -lvf /etc/ssh/ed25519 > /etc/ssh/ed25519.fp + +# Generate SFTPGo key pair +ssh-keygen -f /etc/sftpgo/ed25519 -t ed25519 -N "" +ssh-keygen -lvf /etc/sftpgo/ed25519 > /etc/sftpgo/ed25519.fp diff --git a/mkosi.skeleton/etc/sftpgo/banner.txt b/mkosi.skeleton/etc/sftpgo/banner.txt new file mode 100644 index 0000000..2ef8163 --- /dev/null +++ b/mkosi.skeleton/etc/sftpgo/banner.txt @@ -0,0 +1 @@ +Niver diff --git a/mkosi.skeleton/etc/sftpgo/sftpgo.json b/mkosi.skeleton/etc/sftpgo/sftpgo.json index b816341..94ed367 100644 --- a/mkosi.skeleton/etc/sftpgo/sftpgo.json +++ b/mkosi.skeleton/etc/sftpgo/sftpgo.json @@ -1,291 +1,47 @@ { - "common": { - "idle_timeout": 15, - "upload_mode": 0, - "actions": { - "execute_on": [], - "execute_sync": [], - "hook": "" - }, - "setstat_mode": 0, - "temp_path": "", - "proxy_protocol": 0, - "proxy_allowed": [], - "startup_hook": "", - "post_connect_hook": "", - "post_disconnect_hook": "", - "data_retention_hook": "", - "max_total_connections": 0, - "max_per_host_connections": 20, - "defender": { - "enabled": false, - "driver": "memory", - "ban_time": 30, - "ban_time_increment": 50, - "threshold": 15, - "score_invalid": 2, - "score_valid": 1, - "score_limit_exceeded": 3, - "observation_time": 30, - "entries_soft_limit": 100, - "entries_hard_limit": 150, - "safelist_file": "", - "blocklist_file": "" - }, - "rate_limiters": [ - { - "average": 0, - "period": 1000, - "burst": 1, - "type": 2, - "protocols": [ - "SSH", - "FTP", - "DAV", - "HTTP" - ], - "allow_list": [], - "generate_defender_events": false, - "entries_soft_limit": 100, - "entries_hard_limit": 150 - } - ] - }, "sftpd": { "bindings": [ { "port": 2022, - "address": "", - "apply_proxy_config": true - } - ], - "max_auth_tries": 0, - "banner": "", - "host_keys": [], - "kex_algorithms": [], - "ciphers": [], - "macs": [], - "trusted_user_ca_keys": [], - "login_banner_file": "", - "enabled_ssh_commands": [ - "md5sum", - "sha1sum", - "cd", - "pwd", - "scp" - ], - "keyboard_interactive_authentication": false, - "keyboard_interactive_auth_hook": "", - "password_authentication": true, - "folder_prefix": "" - }, - "ftpd": { - "bindings": [ - { - "port": 0, - "address": "", - "apply_proxy_config": true, - "tls_mode": 0, - "force_passive_ip": "", - "passive_ip_overrides": [], - "client_auth_type": 0, - "tls_cipher_suites": [], - "passive_connections_security": 0, - "active_connections_security": 0, - "debug": false - } - ], - "banner": "", - "banner_file": "", - "active_transfers_port_non_20": true, - "passive_port_range": { - "start": 50000, - "end": 50100 - }, - "disable_active_mode": false, - "enable_site": false, - "hash_support": 0, - "combine_support": 0, - "certificate_file": "", - "certificate_key_file": "", - "ca_certificates": [], - "ca_revocation_lists": [] - }, - "webdavd": { - "bindings": [ - { - "port": 0, - "address": "", - "enable_https": false, - "client_auth_type": 0, - "tls_cipher_suites": [], - "prefix": "", - "proxy_allowed": [] - } - ], - "certificate_file": "", - "certificate_key_file": "", - "ca_certificates": [], - "ca_revocation_lists": [], - "cors": { - "enabled": false, - "allowed_origins": [], - "allowed_methods": [], - "allowed_headers": [], - "exposed_headers": [], - "allow_credentials": false, - "max_age": 0 - }, - "cache": { - "users": { - "expiration_time": 0, - "max_size": 50 + "address": "[::1]" }, - "mime_types": { - "enabled": true, - "max_size": 1000 + { + "port": 2022, + "address": "127.0.0.1" } - } + ], + "host_keys": [ + "/etc/sftpgo/ed25519" + ], + "host_key_algorithms": [ + "ssh-ed25519" + ], + "kex_algorithms": [ + "curve25519-sha256@libssh.org" + ], + "ciphers": [ + "aes128-gcm@openssh.com", + "aes256-gcm@openssh.com", + "chacha20-poly1305@openssh.com" + ], + "macs": [ + "hmac-sha2-256-etm@openssh.com" + ], + "login_banner_file": "/etc/sftpgo/banner.txt", + "enabled_ssh_commands": [] }, "data_provider": { "driver": "sqlite", "name": "sftpgo.db", - "host": "", - "port": 0, - "username": "", - "password": "", - "sslmode": 0, - "connection_string": "", - "sql_tables_prefix": "", - "track_quota": 2, - "delayed_quota_update": 0, - "pool_size": 0, "users_base_dir": "/srv/ht", - "actions": { - "execute_on": [], - "execute_for": [], - "hook": "" - }, "external_auth_hook": "/srv/php/niver/sftpgo-auth.php", - "external_auth_scope": 0, - "credentials_path": "credentials", - "prefer_database_credentials": false, - "pre_login_hook": "", - "post_login_hook": "", - "post_login_scope": 0, - "check_password_hook": "", - "check_password_scope": 0, - "password_hashing": { - "bcrypt_options": { - "cost": 10 - }, - "argon2_options": { - "memory": 65536, - "iterations": 1, - "parallelism": 2 - }, - "algo": "bcrypt" - }, - "password_validation": { - "admins": { - "min_entropy": 0 - }, - "users": { - "min_entropy": 0 - } - }, - "password_caching": true, - "update_mode": 0, - "skip_natural_keys_validation": false, - "create_default_admin": false, - "is_shared": 0 + "external_auth_scope": 0 }, "httpd": { "bindings": [ { - "port": 0, - "address": "", - "enable_web_admin": true, - "enable_web_client": true, - "enable_https": false, - "client_auth_type": 0, - "tls_cipher_suites": [], - "proxy_allowed": [], - "hide_login_url": 0, - "render_openapi": true, - "web_client_integrations": [] - } - ], - "templates_path": "templates", - "static_files_path": "static", - "openapi_path": "openapi", - "backups_path": "backups", - "web_root": "", - "certificate_file": "", - "certificate_key_file": "", - "ca_certificates": [], - "ca_revocation_lists": [], - "signing_passphrase": "", - "max_upload_file_size": 1048576000, - "cors": { - "enabled": false, - "allowed_origins": [], - "allowed_methods": [], - "allowed_headers": [], - "exposed_headers": [], - "allow_credentials": false, - "max_age": 0 - }, - "setup": { - "installation_code": "", - "installation_code_hint": "Installation code" - } - }, - "telemetry": { - "bind_port": 0, - "bind_address": "127.0.0.1", - "enable_profiler": false, - "auth_user_file": "", - "certificate_file": "", - "certificate_key_file": "", - "tls_cipher_suites": [] - }, - "http": { - "timeout": 20, - "retry_wait_min": 2, - "retry_wait_max": 30, - "retry_max": 3, - "ca_certificates": [], - "certificates": [], - "skip_tls_verify": false, - "headers": [] - }, - "kms": { - "secrets": { - "url": "", - "master_key": "", - "master_key_path": "" - } - }, - "mfa": { - "totp": [ - { - "name": "Default", - "issuer": "SFTPGo", - "algo": "sha1" + "port": 0 } ] - }, - "smtp": { - "host": "", - "port": 25, - "from": "", - "user": "", - "password": "", - "auth_type": 0, - "encryption": 0, - "domain": "", - "templates_path": "templates" - }, - "plugins": [] + } } diff --git a/mkosi.skeleton/root/build-maniver.sh b/mkosi.skeleton/root/build-maniver.sh deleted file mode 100755 index 193ba0d..0000000 --- a/mkosi.skeleton/root/build-maniver.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/usr/bin/bash - -cd /root/maniver -cargo build --release -cp /root/maniver/target/release/maniver /usr/local/bin/maniver diff --git a/mkosi.skeleton/root/build-sftpgo.sh b/mkosi.skeleton/root/build-sftpgo.sh index f8a37f5..ff144b3 100755 --- a/mkosi.skeleton/root/build-sftpgo.sh +++ b/mkosi.skeleton/root/build-sftpgo.sh @@ -2,7 +2,6 @@ git clone https://github.com/drakkan/sftpgo /root/sftpgo-src cd /root/sftpgo-src -git checkout v2.2.2 -apt update -apt install -y golang-1.18 -/usr/lib/go-1.18/bin/go build -tags nogcs,nos3,noazblob,nobolt,nomysql,nopgsql,noportable,nometrics -o /usr/local/bin/sftpgo +git checkout v2.2.3 +pacman -Syu go +go build -tags nogcs,nos3,noazblob,nobolt,nomysql,nopgsql,noportable,nometrics -o /usr/local/bin/sftpgo diff --git a/mkosi.skeleton/root/maniver b/mkosi.skeleton/root/maniver deleted file mode 160000 index 2ad9fe6..0000000 --- a/mkosi.skeleton/root/maniver +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 2ad9fe6f3d7d3fc44cc03ef569d82dd601b51664 diff --git a/mkosi.skeleton/usr/local/bin/maniver b/mkosi.skeleton/usr/local/bin/maniver deleted file mode 100755 index c8d2a46..0000000 Binary files a/mkosi.skeleton/usr/local/bin/maniver and /dev/null differ diff --git a/mkosi.skeleton/usr/local/bin/sftpgo b/mkosi.skeleton/usr/local/bin/sftpgo index 0a7aa99..6a06552 100755 Binary files a/mkosi.skeleton/usr/local/bin/sftpgo and b/mkosi.skeleton/usr/local/bin/sftpgo differ diff --git a/mkosi.skeleton/var/lib/tor-instances/niver/.gitkeep b/mkosi.skeleton/var/lib/tor-instances/niver/keys/.gitkeep similarity index 100% rename from mkosi.skeleton/var/lib/tor-instances/niver/.gitkeep rename to mkosi.skeleton/var/lib/tor-instances/niver/keys/.gitkeep