diff --git a/.drone.jsonnet b/.drone.jsonnet index 7c580f8..465591b 100644 --- a/.drone.jsonnet +++ b/.drone.jsonnet @@ -90,10 +90,7 @@ local PipelineNotifications(depends_on=[]) = { spec: './manifest.tmpl', }, when: { - ref: [ - 'refs/heads/master', - 'refs/tags/**', - ], + status: ['success'], }, }, { @@ -105,13 +102,7 @@ local PipelineNotifications(depends_on=[]) = { DOCKERHUB_REPO_PREFIX: 'xoxys', DOCKERHUB_REPO_NAME: 'bitwardenrs', README_PATH: 'README.md', - SHORT_DESCRIPTION: 'Rootless bitwardenrs - Self-hosted RSS feed aggregator', - }, - when: { - ref: [ - 'refs/heads/master', - 'refs/tags/**', - ], + SHORT_DESCRIPTION: 'Rootless Bitwarden_RS - Self-hosted password manager', }, }, { @@ -131,12 +122,13 @@ local PipelineNotifications(depends_on=[]) = { username: { from_secret: 'matrix_username' }, password: { from_secret: 'matrix_password' }, }, - when: { - status: ['success', 'failure'], - }, }, ], trigger: { + ref: [ + 'refs/heads/master', + 'refs/tags/**', + ], status: ['success', 'failure'], }, depends_on: depends_on, diff --git a/.drone.yml b/.drone.yml index 9658184..4142f06 100644 --- a/.drone.yml +++ b/.drone.yml @@ -86,9 +86,8 @@ steps: username: from_secret: docker_username when: - ref: - - refs/heads/master - - refs/tags/** + status: + - success - name: readme image: sheogorath/readme-to-dockerhub @@ -100,11 +99,7 @@ steps: DOCKERHUB_USERNAME: from_secret: docker_username README_PATH: README.md - SHORT_DESCRIPTION: Rootless bitwardenrs - Self-hosted RSS feed aggregator - when: - ref: - - refs/heads/master - - refs/tags/** + SHORT_DESCRIPTION: Rootless Bitwarden_RS - Self-hosted password manager - name: microbadger image: plugins/webhook @@ -122,12 +117,11 @@ steps: template: "Status: **{{ build.status }}**
Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}
Message: {{ build.message }}" username: from_secret: matrix_username - when: - status: - - success - - failure trigger: + ref: + - refs/heads/master + - refs/tags/** status: - success - failure diff --git a/overlay/etc/templates/env.tmpl b/overlay/etc/templates/env.tmpl index 3ca0565..39da7a2 100644 --- a/overlay/etc/templates/env.tmpl +++ b/overlay/etc/templates/env.tmpl @@ -30,123 +30,46 @@ LOG_LEVEL={{ getenv "BITWARDENRS_LOG_LEVEL" "Info" }} ENABLE_DB_WAL=true -## Disable icon downloading -## Set to true to disable icon downloading, this would still serve icons from $ICON_CACHE_FOLDER, -## but it won't produce any external network request. Needs to set $ICON_CACHE_TTL to 0, -## otherwise it will delete them and they won't be downloaded again. -# DISABLE_ICON_DOWNLOAD=false +DISABLE_ICON_DOWNLOAD={{ getenv "BITWARDENRS_DISABLE_ICON_DOWNLOAD" "false" }} +ICON_DOWNLOAD_TIMEOUT={{ getenv "BITWARDENRS_ICON_DOWNLOAD_TIMEOUT" "10" }} +{{ if (getenv "BITWARDENRS_ICON_BLACKLIST_REGEXL") -}} +ICON_BLACKLIST_REGEX={{ getenv "BITWARDENRS_ICON_BLACKLIST_REGEXL" }} +{{ end -}} +ICON_BLACKLIST_NON_GLOBAL_IPS={{ getenv "BITWARDENRS_ICON_BLACKLIST_NON_GLOBAL_IPS" "true" }} -## Icon download timeout -## Configure the timeout value when downloading the favicons. -## The default is 10 seconds, but this could be to low on slower network connections -# ICON_DOWNLOAD_TIMEOUT=10 +DISABLE_2FA_REMEMBER=false -## Icon blacklist Regex -## Any domains or IPs that match this regex won't be fetched by the icon service. -## Useful to hide other servers in the local network. Check the WIKI for more details -# ICON_BLACKLIST_REGEX=192\.168\.1\.[0-9].*^ +SIGNUPS_ALLOWED={{ getenv "BITWARDENRS_SIGNUPS_ALLOWED" "true" }} +SIGNUPS_VERIFY={{ getenv "BITWARDENRS_SIGNUPS_VERIFY" "false" }} +SIGNUPS_VERIFY_RESEND_TIME={{ getenv "BITWARDENRS_SIGNUPS_VERIFY_RESEND_TIME" "3600" }} +SIGNUPS_VERIFY_RESEND_LIMIT={{ getenv "BITWARDENRS_SIGNUPS_VERIFY" "6" }} +{{ if (getenv "BITWARDENRS_SIGNUPS_DOMAINS_WHITELIST") -}} +SIGNUPS_DOMAINS_WHITELIST={{ getenv "BITWARDENRS_SIGNUPS_DOMAINS_WHITELIST" }} +{{ end -}} -## Any IP which is not defined as a global IP will be blacklisted. -## Usefull to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block -# ICON_BLACKLIST_NON_GLOBAL_IPS=true +INVITATIONS_ALLOWED={{ getenv "BITWARDENRS_INVITATIONS_ALLOWED" "true" }} -## Disable 2FA remember -## Enabling this would force the users to use a second factor to login every time. -## Note that the checkbox would still be present, but ignored. -# DISABLE_2FA_REMEMBER=false +ADMIN_TOKEN={{ getenv "BITWARDENRS_ADMIN_TOKEN" }} +DISABLE_ADMIN_TOKEN=false -## Controls if new users can register -# SIGNUPS_ALLOWED=true -## Controls if new users need to verify their email address upon registration -## Note that setting this option to true prevents logins until the email address has been verified! -## The welcome email will include a verification link, and login attempts will periodically -## trigger another verification email to be sent. -# SIGNUPS_VERIFY=false +PASSWORD_ITERATIONS={{ getenv "BITWARDENRS_PASSWORD_ITERATIONS" "100000" }} +SHOW_PASSWORD_HINT={{ getenv "BITWARDENRS_SHOW_PASSWORD_HINT" "true" }} +DOMAIN={{ getenv "BITWARDENRS_DOMAIN" "http://localhost/" }} -## If SIGNUPS_VERIFY is set to true, this limits how many seconds after the last time -## an email verification link has been sent another verification email will be sent -# SIGNUPS_VERIFY_RESEND_TIME=3600 +AUTHENTICATOR_DISABLE_TIME_DRIFT={{ getenv "BITWARDENRS_AUTHENTICATOR_DISABLE_TIME_DRIFT" "false" }} -## If SIGNUPS_VERIFY is set to true, this limits how many times an email verification -## email will be re-sent upon an attempted login. -# SIGNUPS_VERIFY_RESEND_LIMIT=6 - -## Controls if new users from a list of comma-separated domains can register -## even if SIGNUPS_ALLOWED is set to false -# SIGNUPS_DOMAINS_WHITELIST=example.com,example.net,example.org - -## Token for the admin interface, preferably use a long random string -## One option is to use 'openssl rand -base64 48' -## If not set, the admin panel is disabled -# ADMIN_TOKEN=Vy2VyYTTsKPv8W5aEOWUbB/Bt3DEKePbHmI4m9VcemUMS2rEviDowNAFqYi1xjmp - -## Enable this to bypass the admin panel security. This option is only -## meant to be used with the use of a separate auth layer in front -# DISABLE_ADMIN_TOKEN=false - -## Invitations org admins to invite users, even when signups are disabled -# INVITATIONS_ALLOWED=true - -## Controls the PBBKDF password iterations to apply on the server -## The change only applies when the password is changed -# PASSWORD_ITERATIONS=100000 - -## Whether password hint should be sent into the error response when the client request it -# SHOW_PASSWORD_HINT=true - -## Domain settings -## The domain must match the address from where you access the server -## It's recommended to configure this value, otherwise certain functionality might not work, -## like attachment downloads, email links and U2F. -## For U2F to work, the server must use HTTPS, you can use Let's Encrypt for free certs -# DOMAIN=https://bw.domain.tld:8443 - -## Yubico (Yubikey) Settings -## Set your Client ID and Secret Key for Yubikey OTP -## You can generate it here: https://upgrade.yubico.com/getapikey/ -## You can optionally specify a custom OTP server -# YUBICO_CLIENT_ID=11111 -# YUBICO_SECRET_KEY=AAAAAAAAAAAAAAAAAAAAAAAA -# YUBICO_SERVER=http://yourdomain.com/wsapi/2.0/verify - -## Duo Settings -## You need to configure all options to enable global Duo support, otherwise users would need to configure it themselves -## Create an account and protect an application as mentioned in this link (only the first step, not the rest): -## https://help.bitwarden.com/article/setup-two-step-login-duo/#create-a-duo-security-account -## Then set the following options, based on the values obtained from the last step: -# DUO_IKEY= -# DUO_SKEY= -# DUO_HOST= -## After that, you should be able to follow the rest of the guide linked above, -## ignoring the fields that ask for the values that you already configured beforehand. - -## Authenticator Settings -## Disable authenticator time drifted codes to be valid. -## TOTP codes of the previous and next 30 seconds will be invalid -## -## According to the RFC6238 (https://tools.ietf.org/html/rfc6238), -## we allow by default the TOTP code which was valid one step back and one in the future. -## This can however allow attackers to be a bit more lucky with there attempts because there are 3 valid codes. -## You can disable this, so that only the current TOTP Code is allowed. -## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid. -## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid. -# AUTHENTICATOR_DISABLE_TIME_DRIFT = false - -## Rocket specific settings, check Rocket documentation to learn more ROCKET_ADDRESS=0.0.0.0 ROCKET_PORT=8080 -ROCKET_TLS= -## Mail specific settings, set SMTP_HOST and SMTP_FROM to enable the mail service. -## To make sure the email links are pointing to the correct host, set the DOMAIN variable. -## Note: if SMTP_USERNAME is specified, SMTP_PASSWORD is mandatory -# SMTP_HOST=smtp.domain.tld -# SMTP_FROM=bitwarden-rs@domain.tld -# SMTP_FROM_NAME=Bitwarden_RS -# SMTP_PORT=587 -# SMTP_SSL=true -# SMTP_USERNAME=username -# SMTP_PASSWORD=password -# SMTP_AUTH_MECHANISM="Plain" -# SMTP_TIMEOUT=15 +SMTP_HOST={{ getenv "BITWARDENRS_SMTP_HOST" }} +SMTP_FROM={{ getenv "BITWARDENRS_SMTP_FROM" }} +SMTP_FROM_NAME={{ getenv "BITWARDENRS_SMTP_FROM_NAME" "Bitwarden_RS" }} +SMTP_PORT={{ getenv "BITWARDENRS_SMTP_PORT" "587" }} +SMTP_SSL={{ getenv "BITWARDENRS_SMTP_SSL" "true" }} +{{ if (getenv "BITWARDENRS_SMTP_USERNAME") -}} +SMTP_USERNAME={{ getenv "BITWARDENRS_SMTP_USERNAME" }} +SMTP_PASSWORD={{ getenv "BITWARDENRS_SMTP_PASSWORD" }} +{{ end -}} +SMTP_AUTH_MECHANISM={{ getenv "BITWARDENRS_SMTP_AUTH_MECHANISM" "Plain" }} +SMTP_TIMEOUT={{ getenv "BITWARDENRS_SMTP_TIMEOUT" "15" }}