puppet manifest

class base::ftpserver {
   include firewalld
   require base::repositories    # want c7-localrepo installed
   require base::services        # want firewalld running

  package { 'vsftpd':
    ensure           => present,
    install_options  => [ {'--disablerepo' => '*'}, { '--enablerepo' => 'c7-localrepo' }],
    notify           => Service['vsftpd'],
  }

  ini_setting {
    default:
      path         => '/etc/vsftpd/vsftpd.conf',
      notify       => Service['vsftpd'],
      require      => Package['vsftpd'],
      key_val_separator => '=',
      ensure       => present,
    ;
    'disable_anonymous_mode':
      setting     => 'anonymous_enable',
      value       => 'NO',
    ;
    'enable_passive_mode':
      setting     => 'pasv_enable',
      value       => 'YES',
    ;
    'set_passive_minimum_port':
      setting     => 'pasv_min_port',
      value       => '30000',
    ;
    'set_passive_maximum_port':
      setting     => 'pasv_max_port',
      value       => '30100',
  }

  firewalld::custom_service { 'vsftpdserver':
    require       => Service['firewalld'],
    short         => 'vsftpdserver',
    description   => 'vsftpd server for setup',
    port          => [
      {
         'port'      => '21',
         'protocol'  => 'tcp',
      },
      {  'port'      => '30000:30100',
         'protocol'  => 'tcp',
      },
    ],
  }

  firewalld_service { 'Allow FTP in public zone':
    require => Firewalld::Custom_service['vsftpdserver'],
    ensure  => 'present',
    service => 'vsftpdserver',
    zone    => 'public',
  }

  service { 'vsftpd':
    require => Package['vsftpd'],
    ensure => running,
    enable => true,
  }
}