راه‌اندازی Vaultwarden با HTTPS، مدیریت محدود و بکاپ هماهنگ

ماشین اختصاصی Vaultwarden

sudo python3 - <<'PY'
import os,stat
from pathlib import Path
r=Path('/srv/academy-vaultwarden')
assert r.is_absolute() and '..' not in r.parts and str(r) not in ('/','/srv','/opt','/etc')
for p in reversed(r.parents):
    assert stat.S_ISDIR(p.lstat().st_mode) and not p.is_symlink(), 'Unsafe/missing parent'
    assert p.stat().st_uid==0 and not p.stat().st_mode & 0o022, 'Parent must be root-controlled'
r.mkdir(mode=0o750)
os.chown(r,0,23159);os.chmod(r,0o750)
for name in ('data','config','secrets','tls','backups'):
    p=r/name;p.mkdir(mode=0o700)
    os.chown(p,23159 if name=='data' else 0,23159)
    os.chmod(p,0o750 if name=='secrets' else 0o700)
for name in ('settings.env','nginx.conf'):
    fd=os.open(r/'config'/name,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
    os.close(fd)
print('New private tree created; existing paths are never replaced')
PY

ماشین اختصاصی Vaultwarden

sudo python3 - <<'PY'
import getpass,os,re,secrets,subprocess
from pathlib import Path
p=Path('/srv/academy-vaultwarden/secrets/admin.phc')
assert not p.exists() and not p.is_symlink(), 'Secret already exists'
with open('/dev/tty','r+') as tty:
    password=getpass.getpass('New admin passphrase: ',stream=tty)
    again=getpass.getpass('Repeat admin passphrase: ',stream=tty)
assert password==again and len(password)>=24, 'Mismatch or too short'
result=subprocess.run(['argon2',secrets.token_hex(16),'-id','-m','16','-t','3','-p','4','-e'],input=password.encode(),stdout=subprocess.PIPE,stderr=subprocess.PIPE,check=True)
phc=result.stdout.decode().strip()
assert re.fullmatch(r'\$argon2id\$v=19\$m=65536,t=3,p=4\$[A-Za-z0-9+/]+\$[A-Za-z0-9+/]+',phc), 'Unexpected hash format'
fd=os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o640)
with os.fdopen(fd,'w') as f: f.write(phc+'\n')
os.chown(p,0,23159);os.chmod(p,0o640)
del password,again,phc,result
print('Protected Argon2id file created; no secret was printed')
PY

ماشین اختصاصی Vaultwarden

sudo env HOME=/root nano --ignorercfiles --restricted --noread -- '/srv/academy-vaultwarden/config/settings.env'

ماشین اختصاصی Vaultwarden

set -eu
sudo docker pull 'docker.io/vaultwarden/server:1.37.4@sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055'
sudo docker run -d --name 'academy_vaultwarden' --restart unless-stopped \
  --user '23159:23159' --cap-drop ALL \
  --security-opt no-new-privileges:true --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  --env-file '/srv/academy-vaultwarden/config/settings.env' \
  --mount 'type=bind,src=/srv/academy-vaultwarden/data,dst=/data' \
  --mount 'type=bind,src=/srv/academy-vaultwarden/secrets/admin.phc,dst=/run/secrets/admin.phc,readonly' \
  -p '127.0.0.1:8159:8000' \
  --entrypoint /vaultwarden 'docker.io/vaultwarden/server:1.37.4@sha256:efb3cde962015fcc036b2ea625242248611943b27212ebf4392841fb30fad055'
ready=no
for attempt in $(seq 1 30); do
  status=$(curl --silent --max-time 2 --output /dev/null --write-out '%{http_code}' 'http://127.0.0.1:8159/alive' || true)
  if test "$status" = 200; then ready=yes; break; fi
  sleep 1
done
test "$ready" = yes
sudo ss -lntp 'sport = :8159'