✨ Fix proftpd name, add TLS config and cert reload ✨

Rename proftp to proftpd, install proftpd with mod_tls, serve /var/ftp
with a single config file, and reload proftpd when the cert changes.

- .env.scripts: rename proftp to proftpd; SERVICE_PORT 21, EXPOSE_PORTS 49152-65534; add proftpd packages
- Dockerfile: rename proftp to proftpd; port ARGs; PACK_LIST with proftpd, mod_tls, mod_readme, utils, openssl; labels from gen-dockerfile update
- README.md: ports 21 and passive range; mounts for /var/ftp and /etc/letsencrypt
- rootfs/.gitea/workflows/docker.yaml: rename proftp to proftpd
- rootfs/tmp/etc/proftpd/proftpd.conf: single config, anonymous root /var/ftp, TLS 1.2/1.3 with certs at /etc/letsencrypt/live/domain, logs in /data/logs/proftpd
- rootfs/usr/local/etc/docker/init.d/99-proftpd.sh: regenerate from current start-service template; add self-signed cert fallback, cert watcher that sends HUP on change, log dir chmod
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: use if blocks for debug echoes so set -e no longer exits the container when DEBUGGER is off
- TODO.AI.md: log upstream template follow-ups (exit code 20, function-final [ ] && tails)
- README.md: updated (ports and mounts for FTP and Let's Encrypt)

rootfs/.gitea/workflows/docker.yaml

@@ -1,9 +1,9 @@
-name: proftp
+name: proftpd
 
 on: push
 
 jobs:
-  release-proftp:
+  release-proftpd:
     runs-on: act_runner
     container:
       image: catthehacker/ubuntu:act-latest

rootfs/tmp/etc/proftpd/proftpd.conf

@@ -1,27 +1,53 @@
-# proftpd config
+# ProFTPD configuration - single file: server, anonymous FTP and TLS
+ModulePath                /usr/lib/proftpd
+LoadModule                mod_tls.c
+LoadModule                mod_readme.c
+ServerName                ProFTPD
+ServerAdmin               root@localhost
+DefaultServer             on
+PidFile                   /run/proftpd/proftpd.pid
+DefaultRoot               ~
+AuthOrder                 mod_auth_unix.c
+PersistentPasswd          off
+UseReverseDNS             off
+User                      ftp
+Group                     ftp
+MaxInstances              20
+UseSendfile               off
+AllowForeignAddress       on
+AllowRetrieveRestart      on
+AllowStoreRestart         on
+DeferWelcome              on
+RootLogin                 off
+RequireValidShell         off
+PassivePorts              49152 65534
+SystemLog                 /data/logs/proftpd/error.log
+LogFormat                 default   "%h %l %u %t \"%r\" %s %b"
+LogFormat                 auth      "%v [%P] %h %t \"%r\" %s"
+
 <Global>
 Umask                     022
 AllowOverwrite            yes
-TransferLog               /dev/stdout
-ExtendedLog               /dev/stdout
-DefaultRoot               /data/ftp
+TransferLog               /data/logs/proftpd/xfers.log
+ExtendedLog               /data/logs/proftpd/proftpd.log
+DefaultRoot               ~
 DisplayConnect            "/etc/motd"
-</Global>  
+</Global>
 
-<Anonymous /data/ftp>
-User                      root
-Group                     root
+<Anonymous /var/ftp>
+User                      ftp
+Group                     ftp
 AccessGrantMsg            "Anonymous login ok, restrictions apply."
 UserAlias                 anonymous ftp
-MaxClients                2000 "Sorry, max %m users -- try again later"
-DisplayLogin              /data/welcome.msg
+MaxClients                20 "Sorry, max %m users -- try again later"
+DisplayLogin              /var/ftp/welcome.msg
 DisplayChdir              .message
 DisplayReadme             README*
 DirFakeUser               on ftp
 DirFakeGroup              on ftp
 WtmpLog                   off
-ExtendedLog               /dev/stdout WRITE,READ default
-ExtendedLog               /dev/stdout AUTH auth
+ExtendedLog               /data/logs/proftpd/access.log WRITE,READ default
+ExtendedLog               /data/logs/proftpd/auth.log AUTH auth
 AllowRetrieveRestart      on
 AnonRequirePassword       off
 <Limit WRITE>
@@ -29,15 +55,15 @@ AnonRequirePassword       off
 </Limit>
 </Anonymous>
 
-PassivePorts              49152 65534
+# TLS - certs at the literal letsencrypt "domain" dir; a self-signed pair is created if missing
+<IfModule mod_tls.c>
 TLSEngine                 on
 TLSRequired               off
-TLSProtocol               TLSv1 TLSv1.1 TLSv1.2
+TLSProtocol               TLSv1.2 TLSv1.3
 TLSOptions                NoSessionReuseRequired
 TLSVerifyClient           off
 TLSRenegotiate            none
-TLSLog                    /dev/stdout
-
-TLSCACertificateFile      /config/ssl/ca.crt
-TLSRSACertificateFile     /config/ssl/localhost.crt
-TLSRSACertificateKeyFile  /config/ssl/localhost.key
+TLSLog                    /data/logs/proftpd/tls.log
+TLSRSACertificateFile     /etc/letsencrypt/live/domain/fullchain.pem
+TLSRSACertificateKeyFile  /etc/letsencrypt/live/domain/privkey.pem
+</IfModule>

rootfs/usr/local/etc/docker/functions/entrypoint.sh

@@ -645,7 +645,7 @@ __symlink() {
   [ "$from" = "$to" ] && return 0
   __rm "$from"
   [ -d "${from%/*}" ] || mkdir -p "${from%/*}" 2>/dev/null
-  ln -sf "$to" "$from" && [ "$DEBUGGER" = "on" ] && echo "Created symlink: $from -> $to"
+  ln -sf "$to" "$from" && if [ "$DEBUGGER" = "on" ]; then echo "Created symlink: $from -> $to"; fi
 }
 # - - - - - - - - - - - - - - - - - - - - - - - - -
 __file_copy() {
@@ -1180,7 +1180,7 @@ EOF
       if [ ! -e "/usr/sbin/sendmail" ] && command -v msmtp &>/dev/null; then
         __symlink "/usr/sbin/sendmail" "$(command -v msmtp)"
       fi
-      [ "$DEBUGGER" = "on" ] && echo "Done setting up msmtp"
+      if [ "$DEBUGGER" = "on" ]; then echo "Done setting up msmtp"; fi
     fi
 
   ################# sSMTP relay setup
@@ -1221,7 +1221,7 @@ EOF
         __symlink "/etc/ssmtp/revaliases" "/config/ssmtp/revaliases"
         __initialize_replace_variables "/etc/ssmtp/revaliases"
       fi
-      [ "$DEBUGGER" = "on" ] && echo "Done setting up ssmtp"
+      if [ "$DEBUGGER" = "on" ]; then echo "Done setting up ssmtp"; fi
     fi
 
     ################# postfix relay setup
@@ -1275,7 +1275,7 @@ EOF
       if [ ! -f "/run/init.d/postfix.pid" ]; then
         __exec_service postfix start
       fi
-      [ "$DEBUGGER" = "on" ] && echo "Done setting up postfix"
+      if [ "$DEBUGGER" = "on" ]; then echo "Done setting up postfix"; fi
     fi
   fi
   [ -f "/root/dead.letter" ] && __rm "/root/dead.letter"