Browse Source

Rework service user (#299)

* Use user primary group if not root

* Do not run getent on MacOS

* Simplify UID/GID management

* Make uid.env backward compatible in run.sh

* Merge install.sh with run.sh to avoid duplicating code

Especially the UID/GID management one

* Generate correct OS name

* Be sure to keep old behavior for backward compatiblilty

* Get the colors back from install.sh
pull/300/head
Mart124 8 years ago committed by Kyle Spearrin
parent
commit
92b08e6cf1
  1. 13
      scripts/bitwarden.sh
  2. 78
      scripts/install.sh
  3. 129
      scripts/run.sh
  4. 53
      src/Admin/entrypoint.sh
  5. 56
      src/Api/entrypoint.sh
  6. 54
      src/Icons/entrypoint.sh
  7. 53
      src/Identity/entrypoint.sh
  8. 53
      util/Attachments/entrypoint.sh
  9. 56
      util/MsSql/entrypoint.sh
  10. 53
      util/Nginx/entrypoint.sh
  11. 5
      util/Setup/EnvironmentFileBuilder.cs
  12. 51
      util/Setup/entrypoint.sh

13
scripts/bitwarden.sh

@ -47,15 +47,6 @@ function downloadSelf() { @@ -47,15 +47,6 @@ function downloadSelf() {
chmod u+x $SCRIPT_PATH
}
function downloadInstall() {
if [ ! -d "$SCRIPTS_DIR" ]
then
mkdir $SCRIPTS_DIR
fi
curl -s -o $SCRIPTS_DIR/install.sh $GITHUB_BASE_URL/scripts/install.sh
chmod u+x $SCRIPTS_DIR/install.sh
}
function downloadRunFile() {
if [ ! -d "$SCRIPTS_DIR" ]
then
@ -63,6 +54,7 @@ function downloadRunFile() { @@ -63,6 +54,7 @@ function downloadRunFile() {
fi
curl -s -o $SCRIPTS_DIR/run.sh $GITHUB_BASE_URL/scripts/run.sh
chmod u+x $SCRIPTS_DIR/run.sh
rm -f $SCRIPTS_DIR/install.sh
}
function checkOutputDirExists() {
@ -87,9 +79,8 @@ if [ "$1" == "install" ] @@ -87,9 +79,8 @@ if [ "$1" == "install" ]
then
checkOutputDirNotExists
mkdir $OUTPUT
downloadInstall
downloadRunFile
$SCRIPTS_DIR/install.sh $OUTPUT $COREVERSION $WEBVERSION
$SCRIPTS_DIR/run.sh install $OUTPUT $COREVERSION $WEBVERSION
elif [ "$1" == "start" -o "$1" == "restart" ]
then
checkOutputDirExists

78
scripts/install.sh

@ -1,78 +0,0 @@ @@ -1,78 +0,0 @@
#!/usr/bin/env bash
set -e
CYAN='\033[0;36m'
NC='\033[0m' # No Color
OUTPUT_DIR="../."
if [ $# -gt 0 ]
then
OUTPUT_DIR=$1
fi
COREVERSION="latest"
if [ $# -gt 1 ]
then
COREVERSION=$2
fi
WEBVERSION="latest"
if [ $# -gt 2 ]
then
WEBVERSION=$3
fi
OS="lin"
if [ "$(uname)" == "Darwin" ]
then
OS="mac"
fi
LUID="LOCAL_UID=`id -u $USER`"
LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
mkdir -p $OUTPUT_DIR
LETS_ENCRYPT="n"
echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
read DOMAIN
echo ""
if [ "$DOMAIN" == "" ]
then
DOMAIN="localhost"
fi
if [ "$DOMAIN" != "localhost" ]
then
echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
read LETS_ENCRYPT
echo ""
if [ "$LETS_ENCRYPT" == "y" ]
then
echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
read EMAIL
echo ""
mkdir -p $OUTPUT_DIR/letsencrypt
docker pull certbot/certbot
docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
certonly --standalone --noninteractive --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
--logs-dir /etc/letsencrypt/logs
fi
fi
docker pull bitwarden/setup:$COREVERSION
if [ $OS == "lin" ]
then
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
else
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
fi
echo ""
echo "Setup complete"
echo ""

129
scripts/run.sh

@ -3,9 +3,12 @@ set -e @@ -3,9 +3,12 @@ set -e
# Setup
CYAN='\033[0;36m'
NC='\033[0m' # No Color
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
OUTPUT_DIR="../."
OUTPUT_DIR=".."
if [ $# -gt 1 ]
then
OUTPUT_DIR=$2
@ -24,18 +27,79 @@ then @@ -24,18 +27,79 @@ then
fi
OS="lin"
if [ "$(uname)" == "Darwin" ]
[ "$(uname)" == "Darwin" ] && OS="mac"
ENV_DIR="$OUTPUT_DIR/env"
DOCKER_DIR="$OUTPUT_DIR/docker"
# Initialize UID/GID which will be used to run services identically over all the OS...
if ! grep -q "^LOCAL_UID=" $ENV_DIR/uid.env 2>/dev/null || ! grep -q "^LOCAL_GID=" $ENV_DIR/uid.env 2>/dev/null
then
OS="mac"
LUID="LOCAL_UID=`id -u $USER`"
[ "$LUID" == "LOCAL_UID=0" ] && LUID="LOCAL_UID=65534"
LGID="LOCAL_GID=`id -g $USER`"
[ "$LGID" == "LOCAL_GID=0" ] && LGID="LOCAL_GID=65534"
mkdir -p $ENV_DIR
echo $LUID >$ENV_DIR/uid.env
echo $LGID >>$ENV_DIR/uid.env
fi
DOCKER_DIR="$OUTPUT_DIR/docker"
ENV_DIR="$OUTPUT_DIR/env"
LUID="LOCAL_UID=`id -u $USER`"
LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
# ... but up to Core version 1.19.0, keep the old behavior for backward compatibility
if [[ "$COREVERSION" == *.*.* ]] &&
echo -e "1.19.0\n$COREVERSION" | sort -t '.' -k 1,1 -k 2,2 -k 3,3 -n | awk 'END {if($0!="1.19.0") {exit 1}}'
then
LUID="LOCAL_UID=`id -u $USER`"
LGID="LOCAL_GID=`awk -F: '$1=="docker" {print $3}' /etc/group`"
if [ "$OS" == "mac" ]
then
LUID="LOCAL_UID=999"
LGID="LOCAL_GID=999"
fi
echo $LUID >$ENV_DIR/uid.env
echo $LGID >>$ENV_DIR/uid.env
fi
# Functions
function install() {
LETS_ENCRYPT="n"
echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
read DOMAIN
echo ""
if [ "$DOMAIN" == "" ]
then
DOMAIN="localhost"
fi
if [ "$DOMAIN" != "localhost" ]
then
echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
read LETS_ENCRYPT
echo ""
if [ "$LETS_ENCRYPT" == "y" ]
then
echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
read EMAIL
echo ""
mkdir -p $OUTPUT_DIR/letsencrypt
docker pull certbot/certbot
docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
certonly --standalone --noninteractive --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
--logs-dir /etc/letsencrypt/logs
fi
fi
pullSetup
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
echo ""
echo "Setup complete"
echo ""
}
function dockerComposeUp() {
if [ -f "${DOCKER_DIR}/docker-compose.override.yml" ]
then
@ -79,58 +143,30 @@ function updateLetsEncrypt() { @@ -79,58 +143,30 @@ function updateLetsEncrypt() {
function updateDatabase() {
pullSetup
if [ $OS == "lin" ]
then
docker run -i --rm --name setup --network container:bitwarden-mssql \
-v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
else
docker run -i --rm --name setup --network container:bitwarden-mssql \
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
fi
docker run -i --rm --name setup --network container:bitwarden-mssql \
-v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
echo "Database update complete"
}
function update() {
pullSetup
if [ $OS == "lin" ]
then
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-e $LUID -e $LGID bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
else
docker run -i --rm --name setup \
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
fi
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
--env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
}
function printEnvironment() {
pullSetup
if [ $OS == "lin" ]
then
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
-e $LUID -e $LGID bitwarden/setup:$COREVERSION \
dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
else
docker run -i --rm --name setup \
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
fi
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
--env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
}
function restart() {
dockerComposeDown
dockerComposePull
updateLetsEncrypt
if [ $OS == "lin" ]
then
mkdir -p $ENV_DIR
(echo $LUID; echo $LGID) > $ENV_DIR/uid.env
fi
dockerComposeUp
dockerPrune
printEnvironment
@ -142,7 +178,10 @@ function pullSetup() { @@ -142,7 +178,10 @@ function pullSetup() {
# Commands
if [ "$1" == "start" -o "$1" == "restart" ]
if [ "$1" == "install" ]
then
install
elif [ "$1" == "start" -o "$1" == "restart" ]
then
restart
elif [ "$1" == "pull" ]

53
src/Admin/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -63,4 +38,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden @@ -63,4 +38,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
&& update-ca-certificates
gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
exec gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll

56
src/Api/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -63,10 +38,11 @@ mkdir -p /etc/bitwarden/logs @@ -63,10 +38,11 @@ mkdir -p /etc/bitwarden/logs
mkdir -p /etc/bitwarden/ca-certificates
chown -R $USERNAME:$GROUPNAME /etc/bitwarden
env >> /etc/environment
# Sounds like gosu keeps env when switching, but of course cron does not
env > /etc/environment
cron
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
&& update-ca-certificates
gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
exec gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll

54
src/Icons/entrypoint.sh

@ -5,54 +5,30 @@ @@ -5,54 +5,30 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
then
LGID=999
fi
if [ $LUID == 0 ]
then
LUID=999
fi
# Create group
if [ $CURRENTGID ]
if [ $LUID -eq 0 ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
LUID=65534
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
if [ $LGID -eq 0 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
LGID=65534
fi
# Make home directory for user
# Create user and group
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
chown -R $USERNAME:$GROUPNAME /app
gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
exec gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll

53
src/Identity/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -66,4 +41,4 @@ chown -R $USERNAME:$GROUPNAME /app @@ -66,4 +41,4 @@ chown -R $USERNAME:$GROUPNAME /app
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
&& update-ca-certificates
gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
exec gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll

53
util/Attachments/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -58,5 +33,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server @@ -58,5 +33,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server
mkdir -p /etc/bitwarden/core/attachments
chown -R $USERNAME:$GROUPNAME /etc/bitwarden
gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
exec gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
/contentRoot=/etc/bitwarden/core/attachments /webRoot=. /serveUnknown=true

56
util/MsSql/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -63,7 +38,8 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql @@ -63,7 +38,8 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql
chown $USERNAME:$GROUPNAME /backup-db.sh
chown $USERNAME:$GROUPNAME /backup-db.sql
env >> /etc/environment
# Sounds like gosu keeps env when switching, but of course cron does not
env > /etc/environment
cron
gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
exec gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr

53
util/Nginx/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...
@ -65,4 +40,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid @@ -65,4 +40,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid
chown -R $USERNAME:$GROUPNAME /var/cache/nginx
chown -R $USERNAME:$GROUPNAME /var/log/nginx
gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'

5
util/Setup/EnvironmentFileBuilder.cs

@ -172,7 +172,10 @@ SA_PASSWORD=SECRET @@ -172,7 +172,10 @@ SA_PASSWORD=SECRET
Helpers.Exec("chmod 600 /bitwarden/env/mssql.override.env");
// Empty uid env file. Only used on Linux hosts.
using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
if(!File.Exists("/bitwarden/env/uid.env"))
{
using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
}
}
}
}

51
util/Setup/entrypoint.sh

@ -5,52 +5,27 @@ @@ -5,52 +5,27 @@
GROUPNAME="bitwarden"
USERNAME="bitwarden"
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
LGID=${LOCAL_GID:-999}
LUID=${LOCAL_UID:-0}
LGID=${LOCAL_GID:-0}
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
LUID=${LOCAL_UID:-999}
# Step down from host root to well-known nobody/nogroup user
# Step down from host root
if [ $LGID == 0 ]
if [ $LUID -eq 0 ]
then
LGID=999
LUID=65534
fi
if [ $LUID == 0 ]
if [ $LGID -eq 0 ]
then
LUID=999
LGID=65534
fi
# Create group
# Create user and group
if [ $CURRENTGID ]
then
if [ "$CURRENTGID" != "$LGID" ]
then
groupmod -g $LGID $GROUPNAME
fi
else
groupadd -g $LGID $GROUPNAME
fi
# Create user and assign group
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
then
usermod -u $LUID $USERNAME
elif [ $NOUSER == 1 ]
then
useradd -r -u $LUID -g $GROUPNAME $USERNAME
fi
# Make home directory for user
if [ ! -d "/home/$USERNAME" ]
then
mkhomedir_helper $USERNAME
fi
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
mkhomedir_helper $USERNAME
# The rest...

Loading…
Cancel
Save