.woodpecker/build-container.yml

@@ -6,15 +6,26 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  - name: security-build
-    image: quay.io/thegeeklab/wp-docker-buildx:4
+  binary:
+    image: docker.io/clux/muslrust:stable
+    commands:
+      - apt-get -qq update && apt-get install -yqq --no-install-recommends libpq-dev
+      - make build
+
+  executable:
+    image: docker.io/alpine
+    commands:
+      - src/target/x86_64-unknown-linux-musl/release/vaultwarden --help
+      - src/target/x86_64-unknown-linux-musl/release/vaultwarden --version
+
+  security-build:
+    image: quay.io/thegeeklab/wp-docker-buildx:1
     settings:
       containerfile: Containerfile
       output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
       repo: thegeeklab/${CI_REPO_NAME}
-      cache_to: type=local,dest=oci/cache/${CI_REPO_NAME},mode=max
 
-  - name: security-scan
+  security-scan:
     image: ghcr.io/aquasecurity/trivy
     commands:
       - trivy -v
@@ -25,10 +36,11 @@ steps:
       TRIVY_NO_PROGRESS: "true"
       TRIVY_SEVERITY: HIGH,CRITICAL
       TRIVY_TIMEOUT: 1m
+      TRIVY_SKIP_FILES: /usr/local/bin/gomplate
 
-  - name: publish-dockerhub
-    image: quay.io/thegeeklab/wp-docker-buildx:4
+  publish-dockerhub:
     group: container
+    image: quay.io/thegeeklab/wp-docker-buildx:1
     settings:
       auto_tag: true
       containerfile: Containerfile
@@ -38,17 +50,15 @@ steps:
       repo: thegeeklab/${CI_REPO_NAME}
       username:
         from_secret: docker_username
-      cache_from:
-        - 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
     when:
       - event: [tag]
       - event: [push, manual]
         branch:
           - ${CI_REPO_DEFAULT_BRANCH}
 
-  - name: publish-quay
-    image: quay.io/thegeeklab/wp-docker-buildx:4
+  publish-quay:
     group: container
+    image: quay.io/thegeeklab/wp-docker-buildx:1
     settings:
       auto_tag: true
       containerfile: Containerfile
@@ -59,8 +69,6 @@ steps:
       repo: quay.io/thegeeklab/${CI_REPO_NAME}
       username:
         from_secret: quay_username
-      cache_from:
-        - 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
     when:
       - event: [tag]
       - event: [push, manual]

.woodpecker/build-package.yml

@@ -6,20 +6,22 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  - name: changelog
+  changelog:
     image: quay.io/thegeeklab/git-sv
     commands:
+      - git fetch --depth=2147483647
       - git sv current-version
       - git sv release-notes -t ${CI_COMMIT_TAG:-next} -o CHANGELOG.md
       - cat CHANGELOG.md
 
-  - name: publish-gitea
-    image: quay.io/thegeeklab/wp-gitea-release
+  publish-gitea:
+    image: plugins/gitea-release
     settings:
       api_key:
         from_secret: gitea_token
       base_url: https://gitea.rknet.org
       note: CHANGELOG.md
+      overwrite: true
       title: ${CI_COMMIT_TAG}
     when:
       - event: [tag]

.woodpecker/docs.yml

@@ -6,27 +6,26 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  - name: markdownlint
+  markdownlint:
     image: quay.io/thegeeklab/markdownlint-cli
-    group: test
     commands:
       - markdownlint 'README.md'
 
-  - name: spellcheck
+  spellcheck:
     image: quay.io/thegeeklab/alpine-tools
-    group: test
     commands:
       - spellchecker --files '_docs/**/*.md' 'README.md' -d .dictionary -p spell indefinite-article syntax-urls
     environment:
       FORCE_COLOR: "true"
+      NPM_CONFIG_LOGLEVEL: "error"
 
-  - name: link-validation
+  link-validation:
     image: docker.io/lycheeverse/lychee
     group: test
     commands:
       - lychee --no-progress --format detailed README.md
 
-  - name: pushrm-dockerhub
+  pushrm-dockerhub:
     image: docker.io/chko/docker-pushrm:1
     secrets:
       - source: docker_password
@@ -43,7 +42,7 @@ steps:
           - ${CI_REPO_DEFAULT_BRANCH}
         status: [success]
 
-  - name: pushrm-quay
+  pushrm-quay:
     image: docker.io/chko/docker-pushrm:1
     secrets:
       - source: quay_token

.woodpecker/notify.yml

@@ -8,7 +8,7 @@ when:
 runs_on: [success, failure]
 
 steps:
-  - name: matrix
+  matrix:
     image: quay.io/thegeeklab/wp-matrix
     settings:
       homeserver:

Containerfile

@@ -1,73 +1,42 @@
-FROM docker.io/clux/muslrust:1.78.0-stable@sha256:cbc004d60c76bb716abcb0bf9d1ec3fcaf13f7f096fa0c86891a5b6b311e6481 as build
-
-ARG WEBVAULT_VERSION
-ARG VAULTWARDEN_VERSION
-
-ARG DEBIAN_FRONTEND=noninteractive
-ARG LANG=C.UTF-8
-ARG TZ=UTC
-ARG RUSTFLAGS="-C link-arg=-s"
-ARG DB=sqlite,postgresql
-
-ARG TARGETPLATFORM
-
-# renovate: datasource=github-releases depName=dani-garcia/bw_web_builds versioning=loose
-ENV WEBVAULT_VERSION="${WEBVAULT_VERSION:-v2024.3.1}"
-# renovate: datasource=github-releases depName=dani-garcia/vaultwarden
-ENV VAULTWARDEN_VERSION="${VAULTWARDEN_VERSION:-1.30.5}"
-
-WORKDIR /src
-
-RUN apt-get update && apt-get install -y --no-install-recommends && \
-    mkdir -p /release/web-vault && \
-    mkdir -p /data
-
-RUN echo "Using Vaultwarden version '${VAULTWARDEN_VERSION##v}'" && \
-    curl -sSL "https://github.com/dani-garcia/vaultwarden/archive/${VAULTWARDEN_VERSION##v}.tar.gz" | \
-      tar xz --strip-components=1 && \
-    echo "Using Web Vault version '${WEBVAULT_VERSION##v}'" && \
-    curl -SsfL "https://github.com/dani-garcia/bw_web_builds/releases/download/${WEBVAULT_VERSION}/bw_web_${WEBVAULT_VERSION}.tar.gz" | \
-      tar xz -C /release
-
-RUN echo "Building for platform '$TARGETPLATFORM'" && \
-  case "$TARGETPLATFORM" in \
-  "linux/amd64") echo x86_64-unknown-linux-musl > rust_target ;; \
-  "linux/arm64") echo aarch64-unknown-linux-musl > rust_target ;; \
-  *) exit 1 ;; \
-esac
-
-RUN rustup set profile minimal && \
-    rustup target add $(cat rust_target) && \
-    VW_VERSION="${VAULTWARDEN_VERSION##v}" cargo build -j 4 --features "$DB" --target $(cat rust_target) --release
-
-RUN ldd target/$(cat rust_target)/release/vaultwarden && \
-    target/$(cat rust_target)/release/vaultwarden --help && \
-    target/$(cat rust_target)/release/vaultwarden --version
-
-FROM docker.io/alpine:3.20@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd
+FROM docker.io/thegeeklab/alpine:latest@sha256:881dac782c1de3466e2ab092847aebd34e187157c20701e40f51b7a6adf15076
 
 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.title="Vaultwarden"
+LABEL org.opencontainers.image.title="vaultwarden"
 LABEL org.opencontainers.image.url="https://gitea.rknet.org/container/vaultwarden"
 LABEL org.opencontainers.image.source="https://gitea.rknet.org/container/vaultwarden"
 LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/container/vaultwarden"
 
-ENV DATA_FOLDER=/data
-ENV ROCKET_ADDRESS=0.0.0.0
-ENV ROCKET_PORT=8000
-ENV WEBSOCKET_ADDRESS=0.0.0.0
-ENV WEBSOCKET_PORT=3012
+ARG WEBVAULT_VERSION
 
-COPY --from=build --chown=65532:65532 /data /data
-COPY --from=build /release/web-vault /web-vault
-COPY --from=build /src/target/**/release/vaultwarden /bin/vaultwarden
+# renovate: datasource=github-releases depName=dani-garcia/bw_web_builds versioning=loose
+ENV WEBVAULT_VERSION="${WEBVAULT_VERSION:-v2023.10.0}"
 
-EXPOSE 8000
+ADD overlay/ /
+
+RUN apk --update add --virtual .build-deps tar curl && \
+    apk --update add openssl postgresql-libs sqlite ca-certificates && \
+    mkdir -p /app/web-vault /app/data && \
+    echo "Using Web Vault version '${WEBVAULT_VERSION##v}' ..." && \
+    curl -SsfL "https://github.com/dani-garcia/bw_web_builds/releases/download/${WEBVAULT_VERSION}/bw_web_${WEBVAULT_VERSION}.tar.gz" | \
+      tar xz -C /app && \
+    apk del .build-deps && \
+    rm -rf /var/cache/apk/* && \
+    rm -rf /tmp/* && \
+    chown -R app:app /app
+
+ADD src/target/x86_64-unknown-linux-musl/release/vaultwarden /app
+
+VOLUME /app/data
+
+EXPOSE 8080
 EXPOSE 3012
 
+USER app
+
 STOPSIGNAL SIGTERM
 
-USER 65532
-
-CMD ["/bin/vaultwarden"]
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD /usr/local/bin/healthcheck
+WORKDIR /app
+CMD []

Makefile

@@ -0,0 +1,31 @@
+# renovate: datasource=github-releases depName=dani-garcia/vaultwarden
+export BUILD_VERSION ?= 1.30.1
+export DEBIAN_FRONTEND ?= noninteractive
+export LANG ?= C.UTF-8
+export TZ ?= UTC
+export RUSTFLAGS ?= -C link-arg=-s
+
+DB ?= sqlite,postgresql
+SRC := src
+
+.PHONY: all
+all: build
+
+.PHONY: build
+build: build-src build-bin
+
+.PHONY: build-src
+build-src:
+	mkdir -p $(SRC); \
+	curl -sSL "https://github.com/dani-garcia/vaultwarden/archive/$${BUILD_VERSION##v}.tar.gz" | tar xz -C $(SRC) --strip-components=1
+
+.PHONY: build-bin
+build-bin:
+	rustup set profile minimal && \
+	cd $(SRC) && \
+	rustup target add x86_64-unknown-linux-musl && \
+	BWRS_VERSION="$${BUILD_VERSION##v}" cargo build -j 8 --features $(DB) --release
+
+.PHONY: clean
+clean:
+	rm -rf $(SRC)

README.md

@@ -12,13 +12,65 @@ Custom image for Vaultwarden password manager
 
 <!-- spellchecker-enable -->
 
-Custom rootless container image for [Vaultwarden](https://github.com/dani-garcia/vaultwarden). Vaultwarden is a Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients.
+Custom rootless container image for [vaultwarden](https://github.com/dani-garcia/vaultwarden). Vaultwarden is a Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
 
 > **WARNING**: This version only supports SQLite and PostgreSQL databases.
 
 ## Configuration
 
-In Vaultwarden the configuration can be done either via environment variables or the admin page. A complete list of all environment variables can be found in the [Vaultwarden Repository](https://github.com/dani-garcia/vaultwarden/blob/main/.env.template).
+```Shell
+VAULTWARDEN_DATABASE_URL=
+
+VAULTWARDEN_TEMPLATES_FOLDER=
+VAULTWARDEN_RELOAD_TEMPLATES=False
+
+VAULTWARDEN_IP_HEADER=X-Forwarded-For
+
+VAULTWARDEN_ICON_CACHE_TTL=2592000
+VAULTWARDEN_ICON_CACHE_NEGTTL=259200
+
+VAULTWARDEN_WEB_VAULT_ENABLED=True
+VAULTWARDEN_WEBSOCKET_ENABLED=False
+
+VAULTWARDEN_EXTENDED_LOGGING=True
+VAULTWARDEN_LOG_LEVEL=Info
+
+VAULTWARDEN_DISABLE_ICON_DOWNLOAD=False
+VAULTWARDEN_ICON_DOWNLOAD_TIMEOUT=10
+VAULTWARDEN_ICON_BLACKLIST_REGEXL=
+VAULTWARDEN_ICON_BLACKLIST_NON_GLOBAL_IPS=True
+
+VAULTWARDEN_DISABLE_2FA_REMEMBER=False
+VAULTWARDEN_SIGNUPS_ALLOWED=True
+VAULTWARDEN_SIGNUPS_VERIFY=False
+VAULTWARDEN_SIGNUPS_VERIFY_RESEND_TIME=3600
+VAULTWARDEN_SIGNUPS_VERIFY_RESEND_LIMIT=6
+VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST=
+
+VAULTWARDEN_INVITATIONS_ALLOWED=True
+
+# Set an indicidual admin token to enable the admin UI
+VAULTWARDEN_ADMIN_TOKEN=
+
+VAULTWARDEN_PASSWORD_ITERATIONS=100000
+VAULTWARDEN_SHOW_PASSWORD_HINT=True
+VAULTWARDEN_DOMAIN=http://localhost/
+
+VAULTWARDEN_AUTHENTICATOR_DISABLE_TIME_DRIFT=False
+
+# If you dont set a smtp host, all other smpt settings will be ignored
+VAULTWARDEN_SMTP_HOST=
+VAULTWARDEN_SMTP_FROM=
+VAULTWARDEN_SMTP_FROM_NAME=vaultwarden
+VAULTWARDEN_SMTP_PORT=465
+VAULTWARDEN_SMTP_SECURITY=force_tls
+VAULTWARDEN_SMTP_USERNAME=
+VAULTWARDEN_SMTP_PASSWORD=
+VAULTWARDEN_SMTP_AUTH_MECHANISM=Plain
+VAULTWARDEN_SMTP_TIMEOUT=15
+
+VAULTWARDEN_ROCKET_WORKERS=
+```
 
 ## License
 

overlay/etc/templates/env.tmpl

@@ -0,0 +1,85 @@
+## Vaultwarden Configuration File
+DATA_FOLDER=/app/data
+RSA_KEY_FILENAME=/app/data/rsa_key
+ICON_CACHE_FOLDER=/app/data/icon_cache
+ATTACHMENTS_FOLDER=/app/data/attachments
+
+{{ if (getenv "VAULTWARDEN_DATABASE_URL") -}}
+DATABASE_URL={{ getenv "VAULTWARDEN_DATABASE_URL" }}
+{{ end -}}
+
+USER_ATTACHMENT_LIMIT={{ getenv "VAULTWARDEN_USER_ATTACHMENT_LIMIT" "1024" }}
+ORG_ATTACHMENT_LIMIT={{ getenv "VAULTWARDEN_ORG_ATTACHMENT_LIMIT" "1024" }}
+
+{{ if (getenv "VAULTWARDEN_TEMPLATES_FOLDER") -}}
+TEMPLATES_FOLDER={{ getenv "VAULTWARDEN_TEMPLATES_FOLDER" }}
+{{ end -}}
+RELOAD_TEMPLATES={{ getenv "VAULTWARDEN_RELOAD_TEMPLATES" "false" | conv.ToBool }}
+
+IP_HEADER={{ getenv "VAULTWARDEN_IP_HEADER" "X-Forwarded-For" }}
+
+ICON_CACHE_TTL={{ getenv "VAULTWARDEN_ICON_CACHE_TTL" "2592000" }}
+ICON_CACHE_NEGTTL={{ getenv "VAULTWARDEN_ICON_CACHE_NEGTTL" "259200" }}
+
+WEB_VAULT_FOLDER=/app/web-vault/
+WEB_VAULT_ENABLED={{ getenv "VAULTWARDEN_WEB_VAULT_ENABLED" "true" | conv.ToBool }}
+
+WEBSOCKET_ENABLED={{ getenv "VAULTWARDEN_WEBSOCKET_ENABLED" "false" | conv.ToBool }}
+WEBSOCKET_ADDRESS=0.0.0.0
+WEBSOCKET_PORT=3012
+
+EXTENDED_LOGGING={{ getenv "VAULTWARDEN_EXTENDED_LOGGING" "true" | conv.ToBool }}
+LOG_LEVEL={{ getenv "VAULTWARDEN_LOG_LEVEL" "Info" }}
+
+ENABLE_DB_WAL=true
+
+DISABLE_ICON_DOWNLOAD={{ getenv "VAULTWARDEN_DISABLE_ICON_DOWNLOAD" "false" | conv.ToBool }}
+ICON_DOWNLOAD_TIMEOUT={{ getenv "VAULTWARDEN_ICON_DOWNLOAD_TIMEOUT" "10" }}
+{{ if (getenv "VAULTWARDEN_ICON_BLACKLIST_REGEXL") -}}
+ICON_BLACKLIST_REGEX={{ getenv "VAULTWARDEN_ICON_BLACKLIST_REGEXL" }}
+{{ end -}}
+ICON_BLACKLIST_NON_GLOBAL_IPS={{ getenv "VAULTWARDEN_ICON_BLACKLIST_NON_GLOBAL_IPS" "true" | conv.ToBool }}
+
+DISABLE_2FA_REMEMBER={{ getenv "VAULTWARDEN_DISABLE_2FA_REMEMBER" "false" | conv.ToBool }}
+
+SIGNUPS_ALLOWED={{ getenv "VAULTWARDEN_SIGNUPS_ALLOWED" "true" | conv.ToBool }}
+SIGNUPS_VERIFY={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY" "false" | conv.ToBool }}
+SIGNUPS_VERIFY_RESEND_TIME={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY_RESEND_TIME" "3600" }}
+SIGNUPS_VERIFY_RESEND_LIMIT={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY_RESEND_LIMIT" "6" }}
+{{ if (getenv "VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST") -}}
+SIGNUPS_DOMAINS_WHITELIST={{ getenv "VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST" }}
+{{ end -}}
+
+INVITATIONS_ALLOWED={{ getenv "VAULTWARDEN_INVITATIONS_ALLOWED" "true" | conv.ToBool }}
+INVITATION_ORG_NAME={{ getenv "VAULTWARDEN_INVITATION_ORG_NAME" "Vaultwarden" }}
+
+{{ if (getenv "VAULTWARDEN_ADMIN_TOKEN") -}}
+ADMIN_TOKEN={{ getenv "VAULTWARDEN_ADMIN_TOKEN" }}
+{{ end -}}
+DISABLE_ADMIN_TOKEN=false
+
+PASSWORD_ITERATIONS={{ getenv "VAULTWARDEN_PASSWORD_ITERATIONS" "100000" }}
+SHOW_PASSWORD_HINT={{ getenv "VAULTWARDEN_SHOW_PASSWORD_HINT" "true" | conv.ToBool }}
+DOMAIN={{ getenv "VAULTWARDEN_DOMAIN" "http://localhost/" }}
+
+AUTHENTICATOR_DISABLE_TIME_DRIFT={{ getenv "VAULTWARDEN_AUTHENTICATOR_DISABLE_TIME_DRIFT" "false" | conv.ToBool }}
+
+ROCKET_ADDRESS=0.0.0.0
+ROCKET_PORT=8080
+{{ if (getenv "VAULTWARDEN_ROCKET_WORKERS") -}}
+ROCKET_WORKERS={{ getenv "VAULTWARDEN_ROCKET_WORKERS" }}
+{{ end -}}
+
+{{ if (getenv "VAULTWARDEN_SMTP_HOST") -}}
+SMTP_HOST={{ getenv "VAULTWARDEN_SMTP_HOST" }}
+SMTP_FROM={{ getenv "VAULTWARDEN_SMTP_FROM" }}
+SMTP_FROM_NAME={{ getenv "VAULTWARDEN_SMTP_FROM_NAME" "Vaultwarden" }}
+SMTP_PORT={{ getenv "VAULTWARDEN_SMTP_PORT" "465" }}
+SMTP_SECURITY={{ getenv "VAULTWARDEN_SMTP_SECURITY" "force_tls" }}
+{{ if (getenv "VAULTWARDEN_SMTP_USERNAME") -}}
+SMTP_USERNAME={{ getenv "VAULTWARDEN_SMTP_USERNAME" }}
+SMTP_PASSWORD={{ getenv "VAULTWARDEN_SMTP_PASSWORD" }}
+{{ end -}}
+SMTP_AUTH_MECHANISM={{ getenv "VAULTWARDEN_SMTP_AUTH_MECHANISM" "Plain" }}
+SMTP_TIMEOUT={{ getenv "VAULTWARDEN_SMTP_TIMEOUT" "15" }}
+{{ end -}}

overlay/usr/local/bin/entrypoint

@@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+
+# shellcheck disable=SC3040
+set -eo pipefail
+
+# shellcheck disable=SC1091
+. /usr/local/lib/log.sh
+
+/usr/local/bin/gomplate -o /app/.env -f /etc/templates/env.tmpl
+
+if [ -n "$VAULTWARDEN_DATABASE_URL" ]; then
+  WAITFOR_HOST=$(/usr/local/bin/url-parser --url "$VAULTWARDEN_DATABASE_URL" host)
+  WAITFOR_PORT=$(/usr/local/bin/url-parser --url "$VAULTWARDEN_DATABASE_URL" port)
+
+  log_info "Wait for database server on '${WAITFOR_HOST}:${WAITFOR_PORT:-5432}'"
+  /usr/local/bin/wait-for "${WAITFOR_HOST}":"${WAITFOR_PORT:-5432}"
+fi
+
+log_info "Start Vaultwarden Server\n"
+exec /app/vaultwarden

overlay/usr/local/bin/healthcheck

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+
+# shellcheck disable=SC3040
+set -eo pipefail
+
+URL=http://127.0.0.1:8080/alive
+
+wget --quiet --tries=1 --spider ${URL} || exit 1
+
+exit 0