✨ Fix proftpd name, add TLS config and cert reload ✨

Rename proftp to proftpd, install proftpd with mod_tls, serve /var/ftp
with a single config file, and reload proftpd when the cert changes.

- .env.scripts: rename proftp to proftpd; SERVICE_PORT 21, EXPOSE_PORTS 49152-65534; add proftpd packages
- Dockerfile: rename proftp to proftpd; port ARGs; PACK_LIST with proftpd, mod_tls, mod_readme, utils, openssl; labels from gen-dockerfile update
- README.md: ports 21 and passive range; mounts for /var/ftp and /etc/letsencrypt
- rootfs/.gitea/workflows/docker.yaml: rename proftp to proftpd
- rootfs/tmp/etc/proftpd/proftpd.conf: single config, anonymous root /var/ftp, TLS 1.2/1.3 with certs at /etc/letsencrypt/live/domain, logs in /data/logs/proftpd
- rootfs/usr/local/etc/docker/init.d/99-proftpd.sh: regenerate from current start-service template; add self-signed cert fallback, cert watcher that sends HUP on change, log dir chmod
- rootfs/usr/local/etc/docker/functions/entrypoint.sh: use if blocks for debug echoes so set -e no longer exits the container when DEBUGGER is off
- TODO.AI.md: log upstream template follow-ups (exit code 20, function-final [ ] && tails)
- README.md: updated (ports and mounts for FTP and Let's Encrypt)

rootfs/tmp/etc/proftpd/proftpd.conf

@@ -1,27 +1,53 @@
-# proftpd config
+# ProFTPD configuration - single file: server, anonymous FTP and TLS
+ModulePath                /usr/lib/proftpd
+LoadModule                mod_tls.c
+LoadModule                mod_readme.c
+ServerName                ProFTPD
+ServerAdmin               root@localhost
+DefaultServer             on
+PidFile                   /run/proftpd/proftpd.pid
+DefaultRoot               ~
+AuthOrder                 mod_auth_unix.c
+PersistentPasswd          off
+UseReverseDNS             off
+User                      ftp
+Group                     ftp
+MaxInstances              20
+UseSendfile               off
+AllowForeignAddress       on
+AllowRetrieveRestart      on
+AllowStoreRestart         on
+DeferWelcome              on
+RootLogin                 off
+RequireValidShell         off
+PassivePorts              49152 65534
+SystemLog                 /data/logs/proftpd/error.log
+LogFormat                 default   "%h %l %u %t \"%r\" %s %b"
+LogFormat                 auth      "%v [%P] %h %t \"%r\" %s"
+
 <Global>
 Umask                     022
 AllowOverwrite            yes
-TransferLog               /dev/stdout
-ExtendedLog               /dev/stdout
-DefaultRoot               /data/ftp
+TransferLog               /data/logs/proftpd/xfers.log
+ExtendedLog               /data/logs/proftpd/proftpd.log
+DefaultRoot               ~
 DisplayConnect            "/etc/motd"
-</Global>  
+</Global>
 
-<Anonymous /data/ftp>
-User                      root
-Group                     root
+<Anonymous /var/ftp>
+User                      ftp
+Group                     ftp
 AccessGrantMsg            "Anonymous login ok, restrictions apply."
 UserAlias                 anonymous ftp
-MaxClients                2000 "Sorry, max %m users -- try again later"
-DisplayLogin              /data/welcome.msg
+MaxClients                20 "Sorry, max %m users -- try again later"
+DisplayLogin              /var/ftp/welcome.msg
 DisplayChdir              .message
 DisplayReadme             README*
 DirFakeUser               on ftp
 DirFakeGroup              on ftp
 WtmpLog                   off
-ExtendedLog               /dev/stdout WRITE,READ default
-ExtendedLog               /dev/stdout AUTH auth
+ExtendedLog               /data/logs/proftpd/access.log WRITE,READ default
+ExtendedLog               /data/logs/proftpd/auth.log AUTH auth
 AllowRetrieveRestart      on
 AnonRequirePassword       off
 <Limit WRITE>
@@ -29,15 +55,15 @@ AnonRequirePassword       off
 </Limit>
 </Anonymous>
 
-PassivePorts              49152 65534
+# TLS - certs at the literal letsencrypt "domain" dir; a self-signed pair is created if missing
+<IfModule mod_tls.c>
 TLSEngine                 on
 TLSRequired               off
-TLSProtocol               TLSv1 TLSv1.1 TLSv1.2
+TLSProtocol               TLSv1.2 TLSv1.3
 TLSOptions                NoSessionReuseRequired
 TLSVerifyClient           off
 TLSRenegotiate            none
-TLSLog                    /dev/stdout
-
-TLSCACertificateFile      /config/ssl/ca.crt
-TLSRSACertificateFile     /config/ssl/localhost.crt
-TLSRSACertificateKeyFile  /config/ssl/localhost.key
+TLSLog                    /data/logs/proftpd/tls.log
+TLSRSACertificateFile     /etc/letsencrypt/live/domain/fullchain.pem
+TLSRSACertificateKeyFile  /etc/letsencrypt/live/domain/privkey.pem
+</IfModule>