SFTPgo user dir automatic cleanup

data_cleanup.sh

#!/bin/bash

IFS=$'\n\t'
set -euo pipefail

if [[ $EUID -eq 0 ]]; then
        echo "This script must NOT be run as root" 1>&2
        exit 1
fi

set -x

D=/opt/data/users
B=/opt/data/backups

MAXT=7 #days

T="${B}/$(date +%Y-%m-%dT%H:%M:%S)"
mkdir "$T"

# Make tmpdirs for everything
find "$D" -mindepth 2 -type f -printf "$T%h\0" | xargs -0 mkdir -p

# mv files to tmpdirs
find "$D" -mindepth 2 -type f -mtime "+$MAXT" -exec mv -v -- "{}" "$T{}" \;

# delete empty dirs
find "$D" -mindepth 2 -type d  -mtime "+$MAXT" -empty -delete

# Delete unused tmpdirs
find "$B" -type d -empty -delete

# Delete old backup dirs
find "$B" -mindepth 1 -maxdepth 1 -mtime "+$MAXT" -exec rm -rvf -- {} +

# TODO: Delete user dirs for inactive users?

sftpgo-cleanup.service

[Unit]
Description=Cleanup of SFTPgo user directories

[Service]
Type=oneshot

User=sftpgo
Group=sftpgo

RootDirectory=/tmp/%t

ExecStart=/bin/bash /usr/libexec/sftpgo/data_cleanup.sh

CapabilityBoundingSet=
DeviceAllow=
IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateMounts=yes
PrivateNetwork=yes
PrivateTmp=yes
PrivateUsers=yes
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=~AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
UMask=0077

BindReadOnlyPaths=/bin/bash
BindReadOnlyPaths=/lib64
#BindReadOnlyPaths=/usr/bin
BindReadOnlyPaths=/usr/bin/date
BindReadOnlyPaths=/usr/bin/find
BindReadOnlyPaths=/usr/bin/mkdir
BindReadOnlyPaths=/usr/bin/mv
BindReadOnlyPaths=/usr/bin/rm
BindReadOnlyPaths=/usr/bin/xargs
BindReadOnlyPaths=/usr/libexec/sftpgo

BindPaths=/opt/data

sftpgo-cleanup.timer

[Unit]
Description=Run SFTPgo cleanup regularily

[Timer]
OnBootSec=1h
RandomizedDelaySec=1h
OnUnitActiveSec=1h
Persistent=true

[Install]
WantedBy=timers.target