{ lib, pkgs, config, ... }: {

  services.vsftpd = {
    enable = true;
    userlist = [ "ftp-upload" ];
    userlistEnable = true;
    localUsers = true;
    writeEnable = true;
  };

  users.users.ftp-upload = {
    passwordFile = toString <secrets/ftp/password>;
    isNormalUser = true;
  };

  networking.firewall.allowedTCPPorts = [
    20 # ftp
    21 # ftp
  ];

  networking.firewall.allowedTCPPortRanges = [ {from = 1024 ; to = 65535; }];

}