instantlinux/proftpd repository overview

⁠proftpd

An easy-to-use, tiny yet full-featured installation of ProFTPD.

⁠Usage

The most-common directives can be specified in environment variables as shown below. One is required, the PASV_ADDRESS. If you need further customizations, put them in one or more files under mount points /etc/proftpd.d and /etc/proftpd/modules.d. In case SFTP is enabled, it is important to create a persistent volume to be mounted in /etc/ssh, to avoid generating SSH keys each time a container is created.

A single upload user can be specified via the FTPUSER_xxx variables. It is activated by defining ftp-user-password-secret thus:

python -c "import crypt,random,string; \
  print crypt.crypt('YOURPASSWORD', '\$6\$' + ''.join( \
[random.choice(string.ascii_letters + string.digits) \
  for _ in range(16)]))" | \
docker secret create ftp-user-password-secret -

An example compose file is provided here in docker-compose.yml. This is for the common scenario of sharing from Docker swarm the contents of a network-attached volume as a read-only anonymous-ftp service. This repo has complete instructions for building a kubernetes cluster⁠ where you can launch with helm⁠ or kubernetes.yaml⁠ using make and customizing Makefile.vars⁠ after cloning this repo:

git clone https://github.com/instantlinux/docker-tools.git
cd docker-tools/k8s
make proftpd

⁠Variables

These variables can be passed to the image from kubernetes.yaml or docker-compose.yml as needed:

⁠Secrets

⁠Notes

Networking this within Kubernetes is a bit tricky. The helm chart included here can deploy to a cluster but you need to decide how to assign the PASV_ADDRESS:

• If you use a ClusterIP (in the range 10.96.0.0/12, such as 10.101.1.30), you don't need to pin proftpd to a single node -- but it won't be reachable outside the cluster because passive ports won't route back to the same node
• If you define an external IP using a load balancer (haproxy or a cloud-infra load balancer), you need to set the label server.proftpd=allow on a single worker node -- which means when that node goes down, so does proftpd

I tried to make proftpd work with haproxy on multiple k8s nodes but none of the online suggestions work.

⁠Contributing

If you want to make improvements to this image, see CONTRIBUTING⁠.