Skip to content

Commit 4d3cc1c

Browse files
vpolarisvpolaris
committed
through new release
1 parent e8773da commit 4d3cc1c

File tree

6 files changed

+363
-42
lines changed

6 files changed

+363
-42
lines changed

‎Dockerfile

+276
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
FROM scratch
2+
LABEL maintainer="szfd9g <[email protected]>"
3+
ENV DISTTAG=f35container FGC=f35 FBR=f35 container=podman
4+
ENV DNFOPTION="--setopt=install_weak_deps=False --nodocs"
5+
ENV DB_BACKUP enabled
6+
ENV LANG C.UTF8
7+
ENV TERM=xterm
8+
ARG admpass
9+
ARG OS
10+
ARG HTTPS
11+
12+
#Add Image container
13+
ADD layer.tar /
14+
15+
#Create Vaultwarden user and admin container manager
16+
RUN printf "Create Vaultwarden user \n" \
17+
&& adduser -u 10502 --shell /bin/bash --comment "Vaultwarden RS User Service" --user-group -m vaultwarden
18+
19+
#System update
20+
RUN printf "System update \n" \
21+
&& dnf makecache \
22+
&& dnf -y upgrade \
23+
dnf \
24+
rpm \
25+
yum \
26+
libmodulemd $DNFOPTION \
27+
&& dnf -y upgrade $DNFOPTION
28+
29+
30+
#Install apache
31+
RUN printf "Install apache \n" \
32+
&& dnf -y install \
33+
httpd \
34+
mod_ssl \
35+
openssl $DNFOPTION
36+
37+
#Install Dev tools
38+
RUN printf "Install development tools \n" \
39+
&& dnf -y install \
40+
git \
41+
gcc \
42+
openssl-devel \
43+
python2 $DNFOPTION
44+
45+
RUN clear \
46+
&& printf "Selected OS is ${OS}\n" \
47+
&& if [ "${OS}" == "CentOS" ]; then \
48+
dnf -y install gcc-c++ make $DNFOPTION; \
49+
else \
50+
dnf -y install g++ $DNFOPTION \
51+
;fi
52+
53+
#Install Rust
54+
RUN clear \
55+
&& printf "Rust Installation \n" \
56+
&&curl -Lo /tmp/sh.rustup.rs -sSf https://sh.rustup.rs \
57+
&& bash -E /tmp/sh.rustup.rs -y --default-host "$(uname -m)"-unknown-linux-gnu --default-toolchain nightly --profile minimal
58+
ENV PATH="~/.cargo/bin:${PATH}"
59+
60+
#Install Node.JS and npm
61+
RUN clear \
62+
&& printf "Install node.js and npm\n" \
63+
# && curl -Lo /tmp/setup_14.x -sSf https://rpm.nodesource.com/setup_14.x \
64+
# && bash -E /tmp/setup_14.x \
65+
# && sed -i 's/failovermethod=priority/#failovermethod=priority/g' /etc/yum.repos.d/nodesource-fc34.repo \
66+
&& dnf -y module install nodejs:16/development $DNFOPTION \
67+
&& npm -g install npm@8
68+
69+
# Compile the back-end
70+
RUN clear \
71+
&& printf "Compile the back-end \n" \
72+
&& git clone https://github.com/dani-garcia/vaultwarden.git /tmp/vaultwarden \
73+
&& ~/.cargo/bin/cargo build --features sqlite --release --manifest-path=/tmp/vaultwarden/Cargo.toml
74+
75+
#Compile the front-end
76+
77+
RUN mkdir /tmp/vault
78+
79+
RUN clear \
80+
&& printf "Clone Web vault\n" \
81+
&& git clone https://github.com/bitwarden/web.git /tmp/vault \
82+
&& chown -R vaultwarden:vaultwarden /tmp/vault
83+
84+
USER vaultwarden
85+
WORKDIR /tmp/vault
86+
87+
RUN clear \
88+
&& printf "Select Branch\n" \
89+
&& git pull origin master \
90+
&& printf "Select Version\n" \
91+
&& git checkout v2.28.0 \
92+
&& printf "Update Web vault\n" \
93+
&& git submodule update --recursive --init
94+
95+
RUN printf "Apply patch\n" \
96+
&& curl -Lo v2.28.0.patch -sSf https://raw.githubusercontent.com/dani-garcia/bw_web_builds/master/patches/v2.28.0.patch \
97+
&& chown vaultwarden:vaultwarden v2.28.0.patch \
98+
&& git apply v2.28.0.patch --reject
99+
100+
RUN printf "NPM Compile\n" \
101+
&& npm ci --legacy-peer-deps \
102+
&& npm run dist:oss:selfhost
103+
104+
USER root
105+
WORKDIR /
106+
107+
RUN clear \
108+
&& printf "Create admin user\n" \
109+
&& if [[ -z "$admpass" ]] ; then \
110+
user_password="$(tr -cd [:alnum:] < /dev/urandom | fold -w 16 | head -n 1)";export user_password; adduser --shell /bin/bash --comment "Admin RS server" --user-group -G wheel -m --password $(mkpasswd -H md5 ${user_password}) admin;echo "Admin RS Password is ${user_password}"; \
111+
else \
112+
adduser --shell /bin/bash --comment "Admin RS server" --user-group -G wheel -m --password $(openssl passwd -1 ${admpass}) admin;echo "Admin RS Password is ${admpass}" \
113+
;fi
114+
115+
RUN printf "Create Directory Structure\n" \
116+
&& if ! [ -d "var/lib/vaultwarden/data" ]; then \
117+
mkdir -p /var/lib/vaultwarden/{data,certs,logs,backup} \
118+
&& mkdir -p /var/lib/vaultwarden/logs/{vaultwarden,httpd} \
119+
;fi
120+
121+
RUN if ! [ -d "var/lib/vaultwarden/logs/vaultwarden" ]; then \
122+
mkdir -p /var/lib/vaultwarden/logs/{vaultwarden,httpd} \
123+
;fi
124+
125+
RUN mkdir -p /etc/vaultwarden /home/admin/.ssl \
126+
&& chown -R vaultwarden:vaultwarden /var/lib/vaultwarden/ \
127+
&& chown -R admin:vaultwarden /home/admin/.ssl
128+
129+
#Move files and set permissions
130+
131+
#vaultwarden RS server
132+
RUN printf "Move files and set permissions\n" \
133+
&& mv /tmp/vaultwarden/target/release/vaultwarden /usr/local/bin/vaultwarden
134+
COPY ./configurations/.env /etc/vaultwarden/.env
135+
RUN chmod -R 750 /usr/local/bin/vaultwarden /var/lib/vaultwarden/ \
136+
&& chmod -R 770 /etc/vaultwarden/ \
137+
&& chown -R root:vaultwarden /usr/local/bin/vaultwarden /etc/vaultwarden/
138+
139+
#Apache
140+
RUN clear \
141+
&& printf "Configure Appache\n" \
142+
COPY ./configurations/ssl.conf /etc/httpd/conf.d/ssl.conf
143+
COPY ./configurations/server-status.conf /etc/httpd/conf.d/server-status.conf
144+
COPY ./configurations/vhost.conf /etc/httpd/conf.d/vhost.conf
145+
RUN chmod 644 /etc/httpd/conf.d/{ssl.conf,vhost.conf,server-status.conf} \
146+
&& cp -a /tmp/vault/build/ /var/www/vault/ \
147+
&& chown -R apache:apache /var/www/vault/ /var/lib/vaultwarden/logs/httpd
148+
149+
#Create certificates and keys for Vault if are not provided
150+
RUN clear \
151+
&& printf "Configure Certificates\n" \
152+
&& if ! [ -f "/var/lib/vaultwarden/certs/CA-Vaultwarden.pem" ]; then \
153+
openssl req -new -x509 -nodes -days 7300 -outform PEM -newkey rsa:4096 -sha256 \
154+
-keyout /home/admin/.ssl/CA-Vaultwarden.key \
155+
-out /home/admin/.ssl/CA-Vaultwarden.pem \
156+
-subj "/CN=CA Vaultwarden/[email protected]/C=FR/ST=IDF/L=Paris/O=Podman Inc/OU=Podman builder" \
157+
&& cp /home/admin/.ssl/CA-Vaultwarden.* /var/lib/vaultwarden/certs; \
158+
else \
159+
cp /var/lib/vaultwarden/certs/CA-Vaultwarden.pem /home/admin/.ssl/CA-Vaultwarden.pem \
160+
;fi
161+
162+
RUN if [ -f "/var/lib/valtwarden/certs/CA-Vaultwarden.key" ]; then \
163+
cp /var/lib/vaultwarden/certs/CA-vaultwarden.key /home/admin/.ssl/CA-Vaultwarden.key \
164+
;fi
165+
166+
RUN if ! [ -f "/var/lib/vaultwarden/certs/vaultwarden.pem" ]; then \
167+
openssl req -nodes -newkey rsa:2048 -sha256 \
168+
-keyout /etc/pki/tls/private/vaultwarden.key \
169+
-out /home/admin/.ssl/vaultwarden.csr \
170+
-subj "/CN=vault.vaultwarden.lan/[email protected]/C=FR/ST=IDF/L=Paris/O=Podman Inc/OU=Podman builder" \
171+
&& cp /home/admin/.ssl/vaultwarden.csr /var/lib/vaultwarden/certs \
172+
&& cp /etc/pki/tls/private/vaultwarden.key /var/lib/vaultwarden/certs \
173+
;else \
174+
cp /var/lib/vaultwarden/certs/vaultwarden.csr /home/admin/.ssl/vaultwarden.csr \
175+
&& cp /var/lib/vaultwarden/certs/vaultwarden.key /etc/pki/tls/private/vaultwarden.key \
176+
;fi
177+
178+
RUN if ! [ -f "/var/lib/vaultwarden/certs/vaultwarden.pem" ]; then \
179+
openssl x509 -req -outform PEM -CAcreateserial \
180+
-in /home/admin/.ssl/vaultwarden.csr \
181+
-CA /home/admin/.ssl/CA-Vaultwarden.pem \
182+
-CAkey /home/admin/.ssl/CA-Vaultwarden.key \
183+
-out /etc/pki/tls/certs/vaultwarden.pem; \
184+
cp /etc/pki/tls/certs/vaultwarden.pem /var/lib/vaultwarden/certs; \
185+
else \
186+
cp /var/lib/vaultwarden/certs/vaultwarden.pem /etc/pki/tls/certs/vaultwarden.pem \
187+
;fi
188+
189+
#Set file permissions and add CA to SSL store
190+
RUN chmod 440 /etc/pki/tls/private/vaultwarden.key \
191+
&& chmod 644 /etc/pki/tls/certs/vaultwarden.pem \
192+
&& chmod 644 /home/admin/.ssl/CA-Vaultwarden.pem \
193+
&& cp /home/admin/.ssl/CA-Vaultwarden.pem /etc/pki/ca-trust/source/anchors/ \
194+
&& update-ca-trust
195+
196+
RUN if [ -f "/home/admin/.ssl/CA-Vaultwarden.key" ]; then \
197+
chmod 440 /home/admin/.ssl/CA-Vaultwarden.key \
198+
;fi
199+
200+
RUN clear \
201+
&& printf "Install automatic update \n" \
202+
&& dnf -y install dnf-automatic \
203+
&& sed -i 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf \
204+
&& mkdir /etc/systemd/system/dnf-automatic-install.timer.d
205+
206+
COPY ./services/timer.conf /etc/systemd/system/dnf-automatic-install.timer.d
207+
208+
#install scripts
209+
RUN printf "Install scripts\n" \
210+
&& mkdir -m 700 -p /opt/scripts
211+
COPY ./scripts/sql.backup.py /opt/scripts/sql.backup.py
212+
RUN printf "DB_BACKUP=enabled\n" > /opt/scripts/.env \
213+
&& chown -R vaultwarden: /opt/scripts \
214+
&& chmod u+x /opt/scripts/sql.backup.py
215+
216+
#Systemd configuration
217+
RUN clear \
218+
&& printf "Systemd configuration\n" \
219+
&& mkdir /etc/systemd/system/{httpd.service.d,system.slice.d}
220+
COPY ./services/vaultwarden.service /etc/systemd/system/vaultwarden.service
221+
COPY ./services/vaultwarden-httpd.slice /etc/systemd/system/vaultwarden-httpd.slice
222+
COPY ./services/healthcheck.timer /etc/systemd/system/healthcheck.timer
223+
COPY ./services/slice.conf /etc/systemd/system/httpd.service.d/slice.conf
224+
COPY ./services/db-backup.timer /etc/systemd/system/db-backup.timer
225+
COPY ./services/db-backup.service /etc/systemd/system/db-backup.service
226+
COPY ./services/memorymax.conf /etc/systemd/system/system.slice.d/memorymax.conf
227+
RUN chmod 644 /etc/systemd/system/{vaultwarden.service,healthcheck.timer,vaultwarden-httpd.slice,db-backup.timer,db-backup.service} \
228+
/etc/systemd/system/httpd.service.d/slice.conf
229+
RUN systemctl enable vaultwarden.service httpd.service dnf-automatic-install.timer db-backup.timer
230+
CMD ["/usr/sbin/init"]
231+
RUN if ! [ -s /etc/pki/tls/certs/localhost.crt ]; then \
232+
rm -f /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key \
233+
&& /usr/libexec/httpd-ssl-gencerts \
234+
;fi
235+
236+
#Used only if Dockerfile is not set by setup
237+
RUN if [ -z 443 ]; then export HTTPS="443";fi
238+
EXPOSE 443
239+
240+
#Clean up
241+
RUN clear \
242+
&& printf "Clean up\n" \
243+
&& if [ "${OS}" == "CentOS" ]; then \
244+
dnf -y remove gcc-c++ make xz tar squashfs-tools snappy --setopt=clean_requirements_on_remove=1; \
245+
else \
246+
dnf -y remove g++ --setopt=clean_requirements_on_remove=1 \
247+
;fi
248+
249+
250+
RUN rm -f /tmp/sh.rustup.rs /tmp/setup_14.x \
251+
&& rm -rf /tmp/vaultwarden/ /tmp/vault \
252+
&& yes | ~/.cargo/bin/rustup self uninstall \
253+
&& rm -rf ~/.config/ ~/.node-gyp/ ~/.npm ~/anaconda-* ~/original-ks.cfg /home/vaultwarden/.npm \
254+
&& dnf -y remove nodejs git gcc openssl-devel python2 --setopt=clean_requirements_on_remove=1 \
255+
&& dnf -y autoremove \
256+
&& dnf clean all \
257+
&& rm -rf /usr/{share/locale,{lib,lib64}/gconv,bin/localedef,sbin/build-locale-archive} \
258+
&& rm -rf /usr/share/{man,doc,info,gnome/help,httpd} \
259+
&& rm -rf \
260+
/tmp/* \
261+
/sbin/sln \
262+
/var/tmp/* \
263+
/usr/share/fonts/* \
264+
/usr/share/i18n/* \
265+
/usr/share/cracklib/* \
266+
/usr/include/* \
267+
/usr/local/include/* \
268+
/usr/share/sgml/docbook/xsl-stylesheets* \
269+
/usr/share/adobe/resources/* \
270+
&& rm -rf /etc/ld.so.cache /var/cache/ldconfig \
271+
&& mkdir -p --mode=0755 /var/cache/ldconfig \
272+
&& rm -rf /var/cache/yum \
273+
&& mkdir -p --mode=0755 /var/cache/yum
274+
275+
RUN touch /var/lib/vaultwarden/build.completed
276+

‎README.md

+12-13
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,27 @@
66
This project want to build a podman container to host a complete solution of [Vaultwarden API][vaultwarden-rs] and a [Web vault][Web-vault]: interface. Which is proxified by an Apache web server and initialized by Systemd in a rootless environment.
77

88
- Podman don't need a daemon to run a container
9+
- Podman don'need root privileges run a container
910
- Vaultwarden API don't need to be register
1011
- Web vault can be accessed by mobile client or browser
1112

1213
Make sure you can do the difference between the official clients and the Web Vault powered by Bitwarden Inc and the unofficial Vaultwarden API a fork written in Rust by his author Dani Garcia.
1314

14-
+ Note :
15-
Due to new denomination of Vaultwarden, I changed named object accordingly.
16-
1715
## Features
1816

19-
- Support Fedora 34 and CentOS 8 as image containers
17+
- Support Fedora 35 and CentOS 8 as image containers
2018
- Vaultwarden and the Web vault are built from sources
2119
- You can import your own certificates or create a self-signed set
2220
- Token and password are automatically generated
2321
- Full automation process
22+
- Automatic backup of database
23+
- Settings are preserved between each build
2424

2525
Podman can be used in almost all modern Linux distribution even in [WSL2]. Fedora like (CentOS, Red Hat) or Debian like (Ubuntu, Raspian) are well supported. Running Vaultwarden with its own web server make this solution highly portable and secure because you can run the container without root privileges. System administrators will appreciate the fact that the two services will be handled by systemd with all the capabilities associate to this init manager
2626

2727
> the main goal is to build from scratch all the stuff under you eyes.
2828
> we pull image container directly from well known repositories
29-
> https://fr2.rpmfind.net/linux/fedora/linux/releases/34/Container for Fedora
29+
> https://fr2.rpmfind.net/linux/fedora/linux/releases/35/Container for Fedora
3030
> https://cloud.centos.org/centos/8/ for CentOS8
3131
> clone sources from there git repositories
3232
> All tools are fresh installed
@@ -45,7 +45,6 @@ We use a number of open-source projects to work properly:
4545
- [node.js] - Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine.
4646
- [Sass] - Sass is the most mature, stable, and powerful professional grade CSS extension language in the world.
4747
- [npm] - npm is the world's largest software registry.
48-
- [Gulp] A toolkit to automate & enhance your workflow
4948

5049
And of course, This project itself is open source and located on GitHub.
5150

@@ -62,7 +61,7 @@ If SELinux is active you need to check if **policycoreutils-python** package is
6261
#### Built Process:
6362
```sh
6463
git clone https://github.com/vpolaris/Podman-Bitwarden.git
65-
cd Podman-Bitwarden
64+
cd Podman-Vaultwarden
6665
chmod u+x setup.sh; sudo ./setup.sh
6766
```
6867

@@ -78,6 +77,7 @@ Answer the questions
7877
+ Port number, 443 by default (https)
7978
+ The tag version, this number will be append to the image name
8079
+ Certificate, if you have a set of PEM certificates (CA and web server) and you want to use it to setup the apache server, answer yes and indicate their locations. Only useful to the first run as these certificates will be conserved between each build
80+
+ Enable or disable database backup
8181

8282
At the end of questions, you can start the process immediately or copy the information for a later usage
8383

@@ -86,7 +86,7 @@ you can access by default to the vault via
8686
https://vault.vaultwarden.lan
8787
or the domain name you provided
8888

89-
[![N|Solid](https://github.com/vpolaris/Podman-Bitwarden/blob/main/docs/vaultwarden_logon_screen.PNG)
89+
[![N|Solid](https://github.com/vpolaris/Podman-Vaultwarden/blob/main/docs/vaultwarden_logon_screen.PNG)
9090

9191
## Manage the container
9292

@@ -244,7 +244,7 @@ On Linux Platform
244244
A valid response should be
245245
```
246246
Ncat: Version 7.80 ( https://nmap.org/ncat )
247-
Ncat: Connected to 192.168.124.219:2443.
247+
Ncat: Connected to 192.168.xxx.xxx:2443.
248248
Ncat: 0 bytes sent, 0 bytes received in 0.01 seconds.
249249
```
250250
In case of failure
@@ -309,8 +309,8 @@ If something continue to goes wrong check also routing table and third party dev
309309
I found my inspiration from these web sites
310310

311311
**For Vaultwarden and the vault combined**
312-
+ https://fiat-tux.fr/2019/01/14/installer-un-serveur-vaultwarden_rs/
313-
+ https://illuad.fr/2020/06/11/install-a-vaultwarden-rs-server.html
312+
+ https://fiat-tux.fr/2019/01/14/installer-un-serveur-bitwarden_rs/
313+
+ https://illuad.fr/2020/06/11/install-a-bitwarden-rs-server.html
314314

315315
**Ressource Control Group and Timer**
316316
+ https://medium.com/horrible-hacks/using-systemd-as-a-better-cron-a4023eea996d
@@ -323,7 +323,7 @@ AGPL-3.0 License
323323

324324
[//]: # (These are reference links used in the body of this note and get stripped out when the markdown processor does its job. There is no need to format nicely because it shouldn't be seen. Thanks SO - http://stackoverflow.com/questions/4823468/store-comments-in-markdown-syntax)
325325

326-
[Web-vault]: https://vaultwarden.com/
326+
[Web-vault]: https://bitwarden.com/
327327
[vaultwarden-rs]: <https://github.com/dani-garcia/vaultwarden/wiki>
328328
[gcc]: <https://gcc.gnu.org/>
329329
[npm]: <https://docs.npmjs.com/about-npm>
@@ -337,5 +337,4 @@ AGPL-3.0 License
337337
[@tjholowaychuk]: <http://twitter.com/tjholowaychuk>
338338
[express]: <http://expressjs.com>
339339
[AngularJS]: <http://angularjs.org>
340-
[Gulp]: <http://gulpjs.com>
341340

‎configurations/serveur-status.conf ‎configurations/server-status.conf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Listen 8800
22
<VirtualHost 127.0.0.1:8800>
3-
ServerName web-monitor:8800
3+
ServerName web-monitor:8800
44
ServerAlias webmon
55
ServerAdmin admin@localhost
66
DocumentRoot /var/www/html
@@ -12,4 +12,4 @@ Listen 8800
1212
Require local localhost
1313
</Location>
1414
</IfModule>
15-
</VirtualHost>
15+
</VirtualHost>

0 commit comments

Comments
 (0)