mirror of
https://github.com/bitwarden/server.git
synced 2025-04-05 05:00:19 -05:00
Rework service user (#299)
* Use user primary group if not root * Do not run getent on MacOS * Simplify UID/GID management * Make uid.env backward compatible in run.sh * Merge install.sh with run.sh to avoid duplicating code Especially the UID/GID management one * Generate correct OS name * Be sure to keep old behavior for backward compatiblilty * Get the colors back from install.sh
This commit is contained in:
Mart124
Kyle Spearrin
parent
961c0c6749
commit
92b08e6cf1
@ -47,15 +47,6 @@ function downloadSelf() {
|
||||
chmod u+x $SCRIPT_PATH
|
||||
}
|
||||
|
||||
function downloadInstall() {
|
||||
if [ ! -d "$SCRIPTS_DIR" ]
|
||||
then
|
||||
mkdir $SCRIPTS_DIR
|
||||
fi
|
||||
curl -s -o $SCRIPTS_DIR/install.sh $GITHUB_BASE_URL/scripts/install.sh
|
||||
chmod u+x $SCRIPTS_DIR/install.sh
|
||||
}
|
||||
|
||||
function downloadRunFile() {
|
||||
if [ ! -d "$SCRIPTS_DIR" ]
|
||||
then
|
||||
@ -63,6 +54,7 @@ function downloadRunFile() {
|
||||
fi
|
||||
curl -s -o $SCRIPTS_DIR/run.sh $GITHUB_BASE_URL/scripts/run.sh
|
||||
chmod u+x $SCRIPTS_DIR/run.sh
|
||||
rm -f $SCRIPTS_DIR/install.sh
|
||||
}
|
||||
|
||||
function checkOutputDirExists() {
|
||||
@ -87,9 +79,8 @@ if [ "$1" == "install" ]
|
||||
then
|
||||
checkOutputDirNotExists
|
||||
mkdir $OUTPUT
|
||||
downloadInstall
|
||||
downloadRunFile
|
||||
$SCRIPTS_DIR/install.sh $OUTPUT $COREVERSION $WEBVERSION
|
||||
$SCRIPTS_DIR/run.sh install $OUTPUT $COREVERSION $WEBVERSION
|
||||
elif [ "$1" == "start" -o "$1" == "restart" ]
|
||||
then
|
||||
checkOutputDirExists
|
||||
|
||||
@ -1,78 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
OUTPUT_DIR="../."
|
||||
if [ $# -gt 0 ]
|
||||
then
|
||||
OUTPUT_DIR=$1
|
||||
fi
|
||||
|
||||
COREVERSION="latest"
|
||||
if [ $# -gt 1 ]
|
||||
then
|
||||
COREVERSION=$2
|
||||
fi
|
||||
|
||||
WEBVERSION="latest"
|
||||
if [ $# -gt 2 ]
|
||||
then
|
||||
WEBVERSION=$3
|
||||
fi
|
||||
|
||||
OS="lin"
|
||||
if [ "$(uname)" == "Darwin" ]
|
||||
then
|
||||
OS="mac"
|
||||
fi
|
||||
|
||||
LUID="LOCAL_UID=`id -u $USER`"
|
||||
LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
|
||||
|
||||
mkdir -p $OUTPUT_DIR
|
||||
|
||||
LETS_ENCRYPT="n"
|
||||
echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
|
||||
read DOMAIN
|
||||
echo ""
|
||||
|
||||
if [ "$DOMAIN" == "" ]
|
||||
then
|
||||
DOMAIN="localhost"
|
||||
fi
|
||||
|
||||
if [ "$DOMAIN" != "localhost" ]
|
||||
then
|
||||
echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
|
||||
read LETS_ENCRYPT
|
||||
echo ""
|
||||
|
||||
if [ "$LETS_ENCRYPT" == "y" ]
|
||||
then
|
||||
echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
|
||||
read EMAIL
|
||||
echo ""
|
||||
|
||||
mkdir -p $OUTPUT_DIR/letsencrypt
|
||||
docker pull certbot/certbot
|
||||
docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
|
||||
certonly --standalone --noninteractive --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
|
||||
--logs-dir /etc/letsencrypt/logs
|
||||
fi
|
||||
fi
|
||||
|
||||
docker pull bitwarden/setup:$COREVERSION
|
||||
if [ $OS == "lin" ]
|
||||
then
|
||||
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
else
|
||||
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Setup complete"
|
||||
echo ""
|
||||
115
scripts/run.sh
115
scripts/run.sh
@ -3,9 +3,12 @@ set -e
|
||||
|
||||
# Setup
|
||||
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
|
||||
OUTPUT_DIR="../."
|
||||
OUTPUT_DIR=".."
|
||||
if [ $# -gt 1 ]
|
||||
then
|
||||
OUTPUT_DIR=$2
|
||||
@ -24,18 +27,79 @@ then
|
||||
fi
|
||||
|
||||
OS="lin"
|
||||
if [ "$(uname)" == "Darwin" ]
|
||||
[ "$(uname)" == "Darwin" ] && OS="mac"
|
||||
ENV_DIR="$OUTPUT_DIR/env"
|
||||
DOCKER_DIR="$OUTPUT_DIR/docker"
|
||||
|
||||
# Initialize UID/GID which will be used to run services identically over all the OS...
|
||||
if ! grep -q "^LOCAL_UID=" $ENV_DIR/uid.env 2>/dev/null || ! grep -q "^LOCAL_GID=" $ENV_DIR/uid.env 2>/dev/null
|
||||
then
|
||||
OS="mac"
|
||||
LUID="LOCAL_UID=`id -u $USER`"
|
||||
[ "$LUID" == "LOCAL_UID=0" ] && LUID="LOCAL_UID=65534"
|
||||
LGID="LOCAL_GID=`id -g $USER`"
|
||||
[ "$LGID" == "LOCAL_GID=0" ] && LGID="LOCAL_GID=65534"
|
||||
mkdir -p $ENV_DIR
|
||||
echo $LUID >$ENV_DIR/uid.env
|
||||
echo $LGID >>$ENV_DIR/uid.env
|
||||
fi
|
||||
|
||||
DOCKER_DIR="$OUTPUT_DIR/docker"
|
||||
ENV_DIR="$OUTPUT_DIR/env"
|
||||
# ... but up to Core version 1.19.0, keep the old behavior for backward compatibility
|
||||
if [[ "$COREVERSION" == *.*.* ]] &&
|
||||
echo -e "1.19.0\n$COREVERSION" | sort -t '.' -k 1,1 -k 2,2 -k 3,3 -n | awk 'END {if($0!="1.19.0") {exit 1}}'
|
||||
then
|
||||
LUID="LOCAL_UID=`id -u $USER`"
|
||||
LGID="LOCAL_GID=`getent group docker | cut -d: -f3`"
|
||||
LGID="LOCAL_GID=`awk -F: '$1=="docker" {print $3}' /etc/group`"
|
||||
if [ "$OS" == "mac" ]
|
||||
then
|
||||
LUID="LOCAL_UID=999"
|
||||
LGID="LOCAL_GID=999"
|
||||
fi
|
||||
echo $LUID >$ENV_DIR/uid.env
|
||||
echo $LGID >>$ENV_DIR/uid.env
|
||||
fi
|
||||
|
||||
# Functions
|
||||
|
||||
function install() {
|
||||
LETS_ENCRYPT="n"
|
||||
echo -e -n "${CYAN}(!)${NC} Enter the domain name for your bitwarden instance (ex. bitwarden.company.com): "
|
||||
read DOMAIN
|
||||
echo ""
|
||||
|
||||
if [ "$DOMAIN" == "" ]
|
||||
then
|
||||
DOMAIN="localhost"
|
||||
fi
|
||||
|
||||
if [ "$DOMAIN" != "localhost" ]
|
||||
then
|
||||
echo -e -n "${CYAN}(!)${NC} Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): "
|
||||
read LETS_ENCRYPT
|
||||
echo ""
|
||||
|
||||
if [ "$LETS_ENCRYPT" == "y" ]
|
||||
then
|
||||
echo -e -n "${CYAN}(!)${NC} Enter your email address (Let's Encrypt will send you certificate expiration reminders): "
|
||||
read EMAIL
|
||||
echo ""
|
||||
|
||||
mkdir -p $OUTPUT_DIR/letsencrypt
|
||||
docker pull certbot/certbot
|
||||
docker run -it --rm --name certbot -p 80:80 -v $OUTPUT_DIR/letsencrypt:/etc/letsencrypt/ certbot/certbot \
|
||||
certonly --standalone --noninteractive --agree-tos --preferred-challenges http --email $EMAIL -d $DOMAIN \
|
||||
--logs-dir /etc/letsencrypt/logs
|
||||
fi
|
||||
fi
|
||||
|
||||
pullSetup
|
||||
docker run -it --rm --name setup -v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -install 1 -domain $DOMAIN -letsencrypt $LETS_ENCRYPT -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
|
||||
echo ""
|
||||
echo "Setup complete"
|
||||
echo ""
|
||||
}
|
||||
|
||||
function dockerComposeUp() {
|
||||
if [ -f "${DOCKER_DIR}/docker-compose.override.yml" ]
|
||||
then
|
||||
@ -79,58 +143,30 @@ function updateLetsEncrypt() {
|
||||
|
||||
function updateDatabase() {
|
||||
pullSetup
|
||||
if [ $OS == "lin" ]
|
||||
then
|
||||
docker run -i --rm --name setup --network container:bitwarden-mssql \
|
||||
-v $OUTPUT_DIR:/bitwarden -e $LUID -e $LGID bitwarden/setup:$COREVERSION \
|
||||
-v $OUTPUT_DIR:/bitwarden --env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
else
|
||||
docker run -i --rm --name setup --network container:bitwarden-mssql \
|
||||
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -update 1 -db 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
fi
|
||||
echo "Database update complete"
|
||||
}
|
||||
|
||||
function update() {
|
||||
pullSetup
|
||||
if [ $OS == "lin" ]
|
||||
then
|
||||
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
|
||||
-e $LUID -e $LGID bitwarden/setup:$COREVERSION \
|
||||
--env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
else
|
||||
docker run -i --rm --name setup \
|
||||
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -update 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
fi
|
||||
}
|
||||
|
||||
function printEnvironment() {
|
||||
pullSetup
|
||||
if [ $OS == "lin" ]
|
||||
then
|
||||
docker run -i --rm --name setup -v $OUTPUT_DIR:/bitwarden \
|
||||
-e $LUID -e $LGID bitwarden/setup:$COREVERSION \
|
||||
--env-file $ENV_DIR/uid.env bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
else
|
||||
docker run -i --rm --name setup \
|
||||
-v $OUTPUT_DIR:/bitwarden bitwarden/setup:$COREVERSION \
|
||||
dotnet Setup.dll -printenv 1 -os $OS -corev $COREVERSION -webv $WEBVERSION
|
||||
fi
|
||||
}
|
||||
|
||||
function restart() {
|
||||
dockerComposeDown
|
||||
dockerComposePull
|
||||
updateLetsEncrypt
|
||||
|
||||
if [ $OS == "lin" ]
|
||||
then
|
||||
mkdir -p $ENV_DIR
|
||||
(echo $LUID; echo $LGID) > $ENV_DIR/uid.env
|
||||
fi
|
||||
|
||||
dockerComposeUp
|
||||
dockerPrune
|
||||
printEnvironment
|
||||
@ -142,7 +178,10 @@ function pullSetup() {
|
||||
|
||||
# Commands
|
||||
|
||||
if [ "$1" == "start" -o "$1" == "restart" ]
|
||||
if [ "$1" == "install" ]
|
||||
then
|
||||
install
|
||||
elif [ "$1" == "start" -o "$1" == "restart" ]
|
||||
then
|
||||
restart
|
||||
elif [ "$1" == "pull" ]
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -63,4 +38,4 @@ chown -R $USERNAME:$GROUPNAME /etc/bitwarden
|
||||
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
|
||||
&& update-ca-certificates
|
||||
|
||||
gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
|
||||
exec gosu $USERNAME:$GROUPNAME dotnet /app/Admin.dll
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -63,10 +38,11 @@ mkdir -p /etc/bitwarden/logs
|
||||
mkdir -p /etc/bitwarden/ca-certificates
|
||||
chown -R $USERNAME:$GROUPNAME /etc/bitwarden
|
||||
|
||||
env >> /etc/environment
|
||||
# Sounds like gosu keeps env when switching, but of course cron does not
|
||||
env > /etc/environment
|
||||
cron
|
||||
|
||||
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
|
||||
&& update-ca-certificates
|
||||
|
||||
gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
|
||||
exec gosu $USERNAME:$GROUPNAME dotnet /app/Api.dll
|
||||
|
||||
@ -5,54 +5,30 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
chown -R $USERNAME:$GROUPNAME /app
|
||||
gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
|
||||
|
||||
exec gosu $USERNAME:$GROUPNAME dotnet /app/Icons.dll
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -66,4 +41,4 @@ chown -R $USERNAME:$GROUPNAME /app
|
||||
cp /etc/bitwarden/ca-certificates/*.crt /usr/local/share/ca-certificates/ \
|
||||
&& update-ca-certificates
|
||||
|
||||
gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
|
||||
exec gosu $USERNAME:$GROUPNAME dotnet /app/Identity.dll
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -58,5 +33,5 @@ chown -R $USERNAME:$GROUPNAME /bitwarden_server
|
||||
mkdir -p /etc/bitwarden/core/attachments
|
||||
chown -R $USERNAME:$GROUPNAME /etc/bitwarden
|
||||
|
||||
gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
|
||||
exec gosu $USERNAME:$GROUPNAME dotnet /bitwarden_server/Server.dll \
|
||||
/contentRoot=/etc/bitwarden/core/attachments /webRoot=. /serveUnknown=true
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -63,7 +38,8 @@ chown -R $USERNAME:$GROUPNAME /var/opt/mssql
|
||||
chown $USERNAME:$GROUPNAME /backup-db.sh
|
||||
chown $USERNAME:$GROUPNAME /backup-db.sql
|
||||
|
||||
env >> /etc/environment
|
||||
# Sounds like gosu keeps env when switching, but of course cron does not
|
||||
env > /etc/environment
|
||||
cron
|
||||
|
||||
gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
|
||||
exec gosu $USERNAME:$GROUPNAME /opt/mssql/bin/sqlservr
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
@ -65,4 +40,4 @@ chown -R $USERNAME:$GROUPNAME /var/run/nginx.pid
|
||||
chown -R $USERNAME:$GROUPNAME /var/cache/nginx
|
||||
chown -R $USERNAME:$GROUPNAME /var/log/nginx
|
||||
|
||||
gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
|
||||
exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
|
||||
|
||||
@ -172,7 +172,10 @@ SA_PASSWORD=SECRET
|
||||
Helpers.Exec("chmod 600 /bitwarden/env/mssql.override.env");
|
||||
|
||||
// Empty uid env file. Only used on Linux hosts.
|
||||
if(!File.Exists("/bitwarden/env/uid.env"))
|
||||
{
|
||||
using(var sw = File.CreateText("/bitwarden/env/uid.env")) { }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -5,52 +5,27 @@
|
||||
GROUPNAME="bitwarden"
|
||||
USERNAME="bitwarden"
|
||||
|
||||
CURRENTGID=`getent group $GROUPNAME | cut -d: -f3`
|
||||
LGID=${LOCAL_GID:-999}
|
||||
LUID=${LOCAL_UID:-0}
|
||||
LGID=${LOCAL_GID:-0}
|
||||
|
||||
NOUSER=`id -u $USERNAME > /dev/null 2>&1; echo $?`
|
||||
LUID=${LOCAL_UID:-999}
|
||||
# Step down from host root to well-known nobody/nogroup user
|
||||
|
||||
# Step down from host root
|
||||
|
||||
if [ $LGID == 0 ]
|
||||
if [ $LUID -eq 0 ]
|
||||
then
|
||||
LGID=999
|
||||
LUID=65534
|
||||
fi
|
||||
if [ $LGID -eq 0 ]
|
||||
then
|
||||
LGID=65534
|
||||
fi
|
||||
|
||||
if [ $LUID == 0 ]
|
||||
then
|
||||
LUID=999
|
||||
fi
|
||||
# Create user and group
|
||||
|
||||
# Create group
|
||||
|
||||
if [ $CURRENTGID ]
|
||||
then
|
||||
if [ "$CURRENTGID" != "$LGID" ]
|
||||
then
|
||||
groupmod -g $LGID $GROUPNAME
|
||||
fi
|
||||
else
|
||||
groupadd -g $LGID $GROUPNAME
|
||||
fi
|
||||
|
||||
# Create user and assign group
|
||||
|
||||
if [ $NOUSER == 0 ] && [ `id -u $USERNAME` != $LUID ]
|
||||
then
|
||||
usermod -u $LUID $USERNAME
|
||||
elif [ $NOUSER == 1 ]
|
||||
then
|
||||
useradd -r -u $LUID -g $GROUPNAME $USERNAME
|
||||
fi
|
||||
|
||||
# Make home directory for user
|
||||
|
||||
if [ ! -d "/home/$USERNAME" ]
|
||||
then
|
||||
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
||||
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
||||
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
||||
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
||||
mkhomedir_helper $USERNAME
|
||||
fi
|
||||
|
||||
# The rest...
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user