podman-quadlet-cookbook/cookbooks/vsftpd

Podman Quadlet: vsftpd

Overview

vsftpd (Very Secure FTP Daemon) is started as a Podman Quadlet. It provides a secure FTP server with TLS support.

This cookbook:

• Builds a custom vsftpd container image locally.
• Supports TLS encryption with a certificate provided by the lego cookbook (Let's Encrypt in production, self-signed in development).
• Maps system users into the container for authentication.
• Includes a timer to periodically rebuild the container image.
• Reloads certificates automatically when renewed.

Prerequisites

• Configuration file /etc/quadlets/vsftpd/vsftpd.conf.d/local.conf must exist.
• For TLS support, the lego cookbook must be configured to provide a certificate named default (see the lego cookbook's README).
• The volumes to share must be mounted on /data with a drop-in (see dropins/vsftpd.container.d/storage.conf).

TLS certificates

The TLS settings are in local.conf (see config/examples/vsftpd.conf.d/local.conf):

ssl_enable=YES
rsa_cert_file=/etc/vsftpd/tls/default.crt
rsa_private_key_file=/etc/vsftpd/tls/default.key

• Before starting vsftpd, vsftpd.service copies the certificates from /var/lib/quadlets/lego/certificates to /run/quadlets/vsftpd/tls (mounted on /etc/vsftpd/tls in the container).
• When lego obtains or renews a certificate, its renewal hook (other/lego/vsftpd.sh) restarts vsftpd.service (if it is running) to load the new certificate.

Usage

In a separate terminal, follow the logs.

sudo make tail-logs

Install the Podman Quadlets and start vsftpd.

sudo make clean install

You should see the vsftpd-build.service building the vsftpd container image. Then, the vsftpd.service should start up.

Verify vsftpd is running:

sudo systemctl status vsftpd.service

Test FTP connectivity:

ftp localhost

Or with TLS:

lftp -u username localhost

When the certificates are renewed by lego, vsftpd.service is restarted automatically to load them.

Restart the vsftpd.target unit.

sudo systemctl restart vsftpd.target

Finally, remove the quadlets, their configuration and their data.

sudo make uninstall clean

Integration tests

sudo make pytest