chore(deps): update docker.io/clux/muslrust docker tag to v1.78.0 (#182)

Reviewed-on: #182
Co-authored-by: Renovator Bot <renovator@rknet.org>
Co-committed-by: Renovator Bot <renovator@rknet.org>

.woodpecker/build-container.yml

@@ -6,26 +6,15 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  binary:
-    image: docker.io/clux/muslrust:stable
-    commands:
-      - apt-get -qq update && apt-get install -yqq --no-install-recommends libpq-dev
-      - make build
-
-  executable:
-    image: docker.io/alpine
-    commands:
-      - src/target/x86_64-unknown-linux-musl/release/vaultwarden --help
-      - src/target/x86_64-unknown-linux-musl/release/vaultwarden --version
-
-  security-build:
-    image: quay.io/thegeeklab/wp-docker-buildx:1
+  - name: security-build
+    image: quay.io/thegeeklab/wp-docker-buildx:4
     settings:
       containerfile: Containerfile
       output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
       repo: thegeeklab/${CI_REPO_NAME}
+      cache_to: type=local,dest=oci/cache/${CI_REPO_NAME},mode=max
 
-  security-scan:
+  - name: security-scan
     image: ghcr.io/aquasecurity/trivy
     commands:
       - trivy -v
@@ -36,11 +25,10 @@ steps:
       TRIVY_NO_PROGRESS: "true"
       TRIVY_SEVERITY: HIGH,CRITICAL
       TRIVY_TIMEOUT: 1m
-      TRIVY_SKIP_FILES: /usr/local/bin/gomplate
 
-  publish-dockerhub:
+  - name: publish-dockerhub
+    image: quay.io/thegeeklab/wp-docker-buildx:4
     group: container
-    image: quay.io/thegeeklab/wp-docker-buildx:1
     settings:
       auto_tag: true
       containerfile: Containerfile
@@ -50,15 +38,17 @@ steps:
       repo: thegeeklab/${CI_REPO_NAME}
       username:
         from_secret: docker_username
+      cache_from:
+        - 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
     when:
       - event: [tag]
       - event: [push, manual]
         branch:
           - ${CI_REPO_DEFAULT_BRANCH}
 
-  publish-quay:
+  - name: publish-quay
+    image: quay.io/thegeeklab/wp-docker-buildx:4
     group: container
-    image: quay.io/thegeeklab/wp-docker-buildx:1
     settings:
       auto_tag: true
       containerfile: Containerfile
@@ -69,6 +59,8 @@ steps:
       repo: quay.io/thegeeklab/${CI_REPO_NAME}
       username:
         from_secret: quay_username
+      cache_from:
+        - 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
     when:
       - event: [tag]
       - event: [push, manual]

.woodpecker/build-package.yml

@@ -6,22 +6,20 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  changelog:
+  - name: changelog
     image: quay.io/thegeeklab/git-sv
     commands:
-      - git fetch --depth=2147483647
       - git sv current-version
       - git sv release-notes -t ${CI_COMMIT_TAG:-next} -o CHANGELOG.md
       - cat CHANGELOG.md
 
-  publish-gitea:
-    image: plugins/gitea-release
+  - name: publish-gitea
+    image: quay.io/thegeeklab/wp-gitea-release
     settings:
       api_key:
         from_secret: gitea_token
       base_url: https://gitea.rknet.org
       note: CHANGELOG.md
-      overwrite: true
       title: ${CI_COMMIT_TAG}
     when:
       - event: [tag]

.woodpecker/docs.yml

@@ -6,26 +6,27 @@ when:
       - ${CI_REPO_DEFAULT_BRANCH}
 
 steps:
-  markdownlint:
+  - name: markdownlint
     image: quay.io/thegeeklab/markdownlint-cli
+    group: test
     commands:
       - markdownlint 'README.md'
 
-  spellcheck:
+  - name: spellcheck
     image: quay.io/thegeeklab/alpine-tools
+    group: test
     commands:
       - spellchecker --files '_docs/**/*.md' 'README.md' -d .dictionary -p spell indefinite-article syntax-urls
     environment:
       FORCE_COLOR: "true"
-      NPM_CONFIG_LOGLEVEL: "error"
 
-  link-validation:
+  - name: link-validation
     image: docker.io/lycheeverse/lychee
     group: test
     commands:
       - lychee --no-progress --format detailed README.md
 
-  pushrm-dockerhub:
+  - name: pushrm-dockerhub
     image: docker.io/chko/docker-pushrm:1
     secrets:
       - source: docker_password
@@ -42,7 +43,7 @@ steps:
           - ${CI_REPO_DEFAULT_BRANCH}
         status: [success]
 
-  pushrm-quay:
+  - name: pushrm-quay
     image: docker.io/chko/docker-pushrm:1
     secrets:
       - source: quay_token

.woodpecker/notify.yml

@@ -8,7 +8,7 @@ when:
 runs_on: [success, failure]
 
 steps:
-  matrix:
+  - name: matrix
     image: quay.io/thegeeklab/wp-matrix
     settings:
       homeserver:

Containerfile

@@ -1,42 +1,73 @@
-FROM docker.io/thegeeklab/alpine:latest@sha256:881dac782c1de3466e2ab092847aebd34e187157c20701e40f51b7a6adf15076
+FROM docker.io/clux/muslrust:1.78.0-stable@sha256:0814a983fcb23ed8e5d34e6a5d0ec1d1a6314b50e654962432f962128ca97864 as build
+
+ARG WEBVAULT_VERSION
+ARG VAULTWARDEN_VERSION
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG LANG=C.UTF-8
+ARG TZ=UTC
+ARG RUSTFLAGS="-C link-arg=-s"
+ARG DB=sqlite,postgresql
+
+ARG TARGETPLATFORM
+
+# renovate: datasource=github-releases depName=dani-garcia/bw_web_builds versioning=loose
+ENV WEBVAULT_VERSION="${WEBVAULT_VERSION:-v2024.3.1}"
+# renovate: datasource=github-releases depName=dani-garcia/vaultwarden
+ENV VAULTWARDEN_VERSION="${VAULTWARDEN_VERSION:-1.30.5}"
+
+WORKDIR /src
+
+RUN apt-get update && apt-get install -y --no-install-recommends && \
+    mkdir -p /release/web-vault && \
+    mkdir -p /data
+
+RUN echo "Using Vaultwarden version '${VAULTWARDEN_VERSION##v}'" && \
+    curl -sSL "https://github.com/dani-garcia/vaultwarden/archive/${VAULTWARDEN_VERSION##v}.tar.gz" | \
+      tar xz --strip-components=1 && \
+    echo "Using Web Vault version '${WEBVAULT_VERSION##v}'" && \
+    curl -SsfL "https://github.com/dani-garcia/bw_web_builds/releases/download/${WEBVAULT_VERSION}/bw_web_${WEBVAULT_VERSION}.tar.gz" | \
+      tar xz -C /release
+
+RUN echo "Building for platform '$TARGETPLATFORM'" && \
+  case "$TARGETPLATFORM" in \
+  "linux/amd64") echo x86_64-unknown-linux-musl > rust_target ;; \
+  "linux/arm64") echo aarch64-unknown-linux-musl > rust_target ;; \
+  *) exit 1 ;; \
+esac
+
+RUN rustup set profile minimal && \
+    rustup target add $(cat rust_target) && \
+    VW_VERSION="${VAULTWARDEN_VERSION##v}" cargo build -j 4 --features "$DB" --target $(cat rust_target) --release
+
+RUN ldd target/$(cat rust_target)/release/vaultwarden && \
+    target/$(cat rust_target)/release/vaultwarden --help && \
+    target/$(cat rust_target)/release/vaultwarden --version
+
+FROM docker.io/alpine:3.19@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b
 
 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.title="vaultwarden"
+LABEL org.opencontainers.image.title="Vaultwarden"
 LABEL org.opencontainers.image.url="https://gitea.rknet.org/container/vaultwarden"
 LABEL org.opencontainers.image.source="https://gitea.rknet.org/container/vaultwarden"
 LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/container/vaultwarden"
 
-ARG WEBVAULT_VERSION
+ENV DATA_FOLDER=/data
+ENV ROCKET_ADDRESS=0.0.0.0
+ENV ROCKET_PORT=8000
+ENV WEBSOCKET_ADDRESS=0.0.0.0
+ENV WEBSOCKET_PORT=3012
 
-# renovate: datasource=github-releases depName=dani-garcia/bw_web_builds versioning=loose
-ENV WEBVAULT_VERSION="${WEBVAULT_VERSION:-v2023.10.0}"
+COPY --from=build --chown=65532:65532 /data /data
+COPY --from=build /release/web-vault /web-vault
+COPY --from=build /src/target/**/release/vaultwarden /bin/vaultwarden
 
-ADD overlay/ /
-
-RUN apk --update add --virtual .build-deps tar curl && \
-    apk --update add openssl postgresql-libs sqlite ca-certificates && \
-    mkdir -p /app/web-vault /app/data && \
-    echo "Using Web Vault version '${WEBVAULT_VERSION##v}' ..." && \
-    curl -SsfL "https://github.com/dani-garcia/bw_web_builds/releases/download/${WEBVAULT_VERSION}/bw_web_${WEBVAULT_VERSION}.tar.gz" | \
-      tar xz -C /app && \
-    apk del .build-deps && \
-    rm -rf /var/cache/apk/* && \
-    rm -rf /tmp/* && \
-    chown -R app:app /app
-
-ADD src/target/x86_64-unknown-linux-musl/release/vaultwarden /app
-
-VOLUME /app/data
-
-EXPOSE 8080
+EXPOSE 8000
 EXPOSE 3012
 
-USER app
-
 STOPSIGNAL SIGTERM
 
-ENTRYPOINT ["/usr/local/bin/entrypoint"]
-HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD /usr/local/bin/healthcheck
-WORKDIR /app
-CMD []
+USER 65532
+
+CMD ["/bin/vaultwarden"]

Makefile

@@ -1,31 +0,0 @@
-# renovate: datasource=github-releases depName=dani-garcia/vaultwarden
-export BUILD_VERSION ?= 1.30.1
-export DEBIAN_FRONTEND ?= noninteractive
-export LANG ?= C.UTF-8
-export TZ ?= UTC
-export RUSTFLAGS ?= -C link-arg=-s
-
-DB ?= sqlite,postgresql
-SRC := src
-
-.PHONY: all
-all: build
-
-.PHONY: build
-build: build-src build-bin
-
-.PHONY: build-src
-build-src:
-	mkdir -p $(SRC); \
-	curl -sSL "https://github.com/dani-garcia/vaultwarden/archive/$${BUILD_VERSION##v}.tar.gz" | tar xz -C $(SRC) --strip-components=1
-
-.PHONY: build-bin
-build-bin:
-	rustup set profile minimal && \
-	cd $(SRC) && \
-	rustup target add x86_64-unknown-linux-musl && \
-	BWRS_VERSION="$${BUILD_VERSION##v}" cargo build -j 8 --features $(DB) --release
-
-.PHONY: clean
-clean:
-	rm -rf $(SRC)

README.md

@@ -12,65 +12,13 @@ Custom image for Vaultwarden password manager
 
 <!-- spellchecker-enable -->
 
-Custom rootless container image for [vaultwarden](https://github.com/dani-garcia/vaultwarden). Vaultwarden is a Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.
+Custom rootless container image for [Vaultwarden](https://github.com/dani-garcia/vaultwarden). Vaultwarden is a Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients.
 
 > **WARNING**: This version only supports SQLite and PostgreSQL databases.
 
 ## Configuration
 
-```Shell
-VAULTWARDEN_DATABASE_URL=
-
-VAULTWARDEN_TEMPLATES_FOLDER=
-VAULTWARDEN_RELOAD_TEMPLATES=False
-
-VAULTWARDEN_IP_HEADER=X-Forwarded-For
-
-VAULTWARDEN_ICON_CACHE_TTL=2592000
-VAULTWARDEN_ICON_CACHE_NEGTTL=259200
-
-VAULTWARDEN_WEB_VAULT_ENABLED=True
-VAULTWARDEN_WEBSOCKET_ENABLED=False
-
-VAULTWARDEN_EXTENDED_LOGGING=True
-VAULTWARDEN_LOG_LEVEL=Info
-
-VAULTWARDEN_DISABLE_ICON_DOWNLOAD=False
-VAULTWARDEN_ICON_DOWNLOAD_TIMEOUT=10
-VAULTWARDEN_ICON_BLACKLIST_REGEXL=
-VAULTWARDEN_ICON_BLACKLIST_NON_GLOBAL_IPS=True
-
-VAULTWARDEN_DISABLE_2FA_REMEMBER=False
-VAULTWARDEN_SIGNUPS_ALLOWED=True
-VAULTWARDEN_SIGNUPS_VERIFY=False
-VAULTWARDEN_SIGNUPS_VERIFY_RESEND_TIME=3600
-VAULTWARDEN_SIGNUPS_VERIFY_RESEND_LIMIT=6
-VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST=
-
-VAULTWARDEN_INVITATIONS_ALLOWED=True
-
-# Set an indicidual admin token to enable the admin UI
-VAULTWARDEN_ADMIN_TOKEN=
-
-VAULTWARDEN_PASSWORD_ITERATIONS=100000
-VAULTWARDEN_SHOW_PASSWORD_HINT=True
-VAULTWARDEN_DOMAIN=http://localhost/
-
-VAULTWARDEN_AUTHENTICATOR_DISABLE_TIME_DRIFT=False
-
-# If you dont set a smtp host, all other smpt settings will be ignored
-VAULTWARDEN_SMTP_HOST=
-VAULTWARDEN_SMTP_FROM=
-VAULTWARDEN_SMTP_FROM_NAME=vaultwarden
-VAULTWARDEN_SMTP_PORT=465
-VAULTWARDEN_SMTP_SECURITY=force_tls
-VAULTWARDEN_SMTP_USERNAME=
-VAULTWARDEN_SMTP_PASSWORD=
-VAULTWARDEN_SMTP_AUTH_MECHANISM=Plain
-VAULTWARDEN_SMTP_TIMEOUT=15
-
-VAULTWARDEN_ROCKET_WORKERS=
-```
+In Vaultwarden the configuration can be done either via environment variables or the admin page. A complete list of all environment variables can be found in the [Vaultwarden Repository](https://github.com/dani-garcia/vaultwarden/blob/main/.env.template).
 
 ## License
 

overlay/etc/templates/env.tmpl

@@ -1,85 +0,0 @@
-## Vaultwarden Configuration File
-DATA_FOLDER=/app/data
-RSA_KEY_FILENAME=/app/data/rsa_key
-ICON_CACHE_FOLDER=/app/data/icon_cache
-ATTACHMENTS_FOLDER=/app/data/attachments
-
-{{ if (getenv "VAULTWARDEN_DATABASE_URL") -}}
-DATABASE_URL={{ getenv "VAULTWARDEN_DATABASE_URL" }}
-{{ end -}}
-
-USER_ATTACHMENT_LIMIT={{ getenv "VAULTWARDEN_USER_ATTACHMENT_LIMIT" "1024" }}
-ORG_ATTACHMENT_LIMIT={{ getenv "VAULTWARDEN_ORG_ATTACHMENT_LIMIT" "1024" }}
-
-{{ if (getenv "VAULTWARDEN_TEMPLATES_FOLDER") -}}
-TEMPLATES_FOLDER={{ getenv "VAULTWARDEN_TEMPLATES_FOLDER" }}
-{{ end -}}
-RELOAD_TEMPLATES={{ getenv "VAULTWARDEN_RELOAD_TEMPLATES" "false" | conv.ToBool }}
-
-IP_HEADER={{ getenv "VAULTWARDEN_IP_HEADER" "X-Forwarded-For" }}
-
-ICON_CACHE_TTL={{ getenv "VAULTWARDEN_ICON_CACHE_TTL" "2592000" }}
-ICON_CACHE_NEGTTL={{ getenv "VAULTWARDEN_ICON_CACHE_NEGTTL" "259200" }}
-
-WEB_VAULT_FOLDER=/app/web-vault/
-WEB_VAULT_ENABLED={{ getenv "VAULTWARDEN_WEB_VAULT_ENABLED" "true" | conv.ToBool }}
-
-WEBSOCKET_ENABLED={{ getenv "VAULTWARDEN_WEBSOCKET_ENABLED" "false" | conv.ToBool }}
-WEBSOCKET_ADDRESS=0.0.0.0
-WEBSOCKET_PORT=3012
-
-EXTENDED_LOGGING={{ getenv "VAULTWARDEN_EXTENDED_LOGGING" "true" | conv.ToBool }}
-LOG_LEVEL={{ getenv "VAULTWARDEN_LOG_LEVEL" "Info" }}
-
-ENABLE_DB_WAL=true
-
-DISABLE_ICON_DOWNLOAD={{ getenv "VAULTWARDEN_DISABLE_ICON_DOWNLOAD" "false" | conv.ToBool }}
-ICON_DOWNLOAD_TIMEOUT={{ getenv "VAULTWARDEN_ICON_DOWNLOAD_TIMEOUT" "10" }}
-{{ if (getenv "VAULTWARDEN_ICON_BLACKLIST_REGEXL") -}}
-ICON_BLACKLIST_REGEX={{ getenv "VAULTWARDEN_ICON_BLACKLIST_REGEXL" }}
-{{ end -}}
-ICON_BLACKLIST_NON_GLOBAL_IPS={{ getenv "VAULTWARDEN_ICON_BLACKLIST_NON_GLOBAL_IPS" "true" | conv.ToBool }}
-
-DISABLE_2FA_REMEMBER={{ getenv "VAULTWARDEN_DISABLE_2FA_REMEMBER" "false" | conv.ToBool }}
-
-SIGNUPS_ALLOWED={{ getenv "VAULTWARDEN_SIGNUPS_ALLOWED" "true" | conv.ToBool }}
-SIGNUPS_VERIFY={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY" "false" | conv.ToBool }}
-SIGNUPS_VERIFY_RESEND_TIME={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY_RESEND_TIME" "3600" }}
-SIGNUPS_VERIFY_RESEND_LIMIT={{ getenv "VAULTWARDEN_SIGNUPS_VERIFY_RESEND_LIMIT" "6" }}
-{{ if (getenv "VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST") -}}
-SIGNUPS_DOMAINS_WHITELIST={{ getenv "VAULTWARDEN_SIGNUPS_DOMAINS_WHITELIST" }}
-{{ end -}}
-
-INVITATIONS_ALLOWED={{ getenv "VAULTWARDEN_INVITATIONS_ALLOWED" "true" | conv.ToBool }}
-INVITATION_ORG_NAME={{ getenv "VAULTWARDEN_INVITATION_ORG_NAME" "Vaultwarden" }}
-
-{{ if (getenv "VAULTWARDEN_ADMIN_TOKEN") -}}
-ADMIN_TOKEN={{ getenv "VAULTWARDEN_ADMIN_TOKEN" }}
-{{ end -}}
-DISABLE_ADMIN_TOKEN=false
-
-PASSWORD_ITERATIONS={{ getenv "VAULTWARDEN_PASSWORD_ITERATIONS" "100000" }}
-SHOW_PASSWORD_HINT={{ getenv "VAULTWARDEN_SHOW_PASSWORD_HINT" "true" | conv.ToBool }}
-DOMAIN={{ getenv "VAULTWARDEN_DOMAIN" "http://localhost/" }}
-
-AUTHENTICATOR_DISABLE_TIME_DRIFT={{ getenv "VAULTWARDEN_AUTHENTICATOR_DISABLE_TIME_DRIFT" "false" | conv.ToBool }}
-
-ROCKET_ADDRESS=0.0.0.0
-ROCKET_PORT=8080
-{{ if (getenv "VAULTWARDEN_ROCKET_WORKERS") -}}
-ROCKET_WORKERS={{ getenv "VAULTWARDEN_ROCKET_WORKERS" }}
-{{ end -}}
-
-{{ if (getenv "VAULTWARDEN_SMTP_HOST") -}}
-SMTP_HOST={{ getenv "VAULTWARDEN_SMTP_HOST" }}
-SMTP_FROM={{ getenv "VAULTWARDEN_SMTP_FROM" }}
-SMTP_FROM_NAME={{ getenv "VAULTWARDEN_SMTP_FROM_NAME" "Vaultwarden" }}
-SMTP_PORT={{ getenv "VAULTWARDEN_SMTP_PORT" "465" }}
-SMTP_SECURITY={{ getenv "VAULTWARDEN_SMTP_SECURITY" "force_tls" }}
-{{ if (getenv "VAULTWARDEN_SMTP_USERNAME") -}}
-SMTP_USERNAME={{ getenv "VAULTWARDEN_SMTP_USERNAME" }}
-SMTP_PASSWORD={{ getenv "VAULTWARDEN_SMTP_PASSWORD" }}
-{{ end -}}
-SMTP_AUTH_MECHANISM={{ getenv "VAULTWARDEN_SMTP_AUTH_MECHANISM" "Plain" }}
-SMTP_TIMEOUT={{ getenv "VAULTWARDEN_SMTP_TIMEOUT" "15" }}
-{{ end -}}

overlay/usr/local/bin/entrypoint

@@ -1,20 +0,0 @@
-#!/usr/bin/env sh
-
-# shellcheck disable=SC3040
-set -eo pipefail
-
-# shellcheck disable=SC1091
-. /usr/local/lib/log.sh
-
-/usr/local/bin/gomplate -o /app/.env -f /etc/templates/env.tmpl
-
-if [ -n "$VAULTWARDEN_DATABASE_URL" ]; then
-  WAITFOR_HOST=$(/usr/local/bin/url-parser --url "$VAULTWARDEN_DATABASE_URL" host)
-  WAITFOR_PORT=$(/usr/local/bin/url-parser --url "$VAULTWARDEN_DATABASE_URL" port)
-
-  log_info "Wait for database server on '${WAITFOR_HOST}:${WAITFOR_PORT:-5432}'"
-  /usr/local/bin/wait-for "${WAITFOR_HOST}":"${WAITFOR_PORT:-5432}"
-fi
-
-log_info "Start Vaultwarden Server\n"
-exec /app/vaultwarden

overlay/usr/local/bin/healthcheck

@@ -1,10 +0,0 @@
-#!/usr/bin/env sh
-
-# shellcheck disable=SC3040
-set -eo pipefail
-
-URL=http://127.0.0.1:8080/alive
-
-wget --quiet --tries=1 --spider ${URL} || exit 1
-
-exit 0