ReactorcoremeltdownandClaude Opus 5.5
4ffc434b1b
Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
92 lines
3.7 KiB
Docker
92 lines
3.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# KeepOrg synchronization server.
|
|
#
|
|
# The server is a static binary with no cgo — its only third-party code is
|
|
# the two pure-Go database drivers — so the runtime image carries the
|
|
# binary, a certificate bundle for talking to an OIDC provider or a
|
|
# PostgreSQL server over TLS, and nothing else. There is no shell in it: the binary
|
|
# probes its own health.
|
|
#
|
|
# podman build --format docker -t keeporgd:<version> --build-arg VERSION=<version> .
|
|
# docker build -t keeporgd:<version> --build-arg VERSION=<version> .
|
|
#
|
|
# podman needs --format docker, because the OCI image format has no
|
|
# HEALTHCHECK field and drops it silently.
|
|
#
|
|
# or `make docker`, which takes the version from versions.mk.
|
|
|
|
FROM golang:1.26-alpine AS build
|
|
|
|
ARG VERSION=dev
|
|
WORKDIR /src
|
|
|
|
# Only what the server is built from, so a change to the clients, the
|
|
# Android app or the docs does not invalidate this layer.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY cmd/keeporgd ./cmd/keeporgd
|
|
COPY internal ./internal
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags "-s -w -X main.Version=${VERSION}" \
|
|
-o /out/keeporgd ./cmd/keeporgd
|
|
|
|
# Empty directories to copy into the scratch image with the right owner.
|
|
# There is no shell there to create them later.
|
|
RUN mkdir -p /out/var/lib/keeporg /out/etc/keeporg
|
|
|
|
|
|
FROM scratch
|
|
|
|
ARG VERSION=dev
|
|
LABEL org.opencontainers.image.title="KeepOrg server" \
|
|
org.opencontainers.image.description="Synchronization server for collaborative KeePass databases" \
|
|
org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.source="https://garage.rcmd.space/keeporg" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-or-later" \
|
|
cc.tiredsysadmin.application="cc.tiredsysadmin.linux.keeporgd"
|
|
|
|
# Needed to reach an OIDC provider, or PostgreSQL, over TLS. Nothing else from the builder
|
|
# comes along.
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
|
|
# The data directory holds the SQLite database, unless KEEPORG_DATABASE_URL
|
|
# points at PostgreSQL. Every row in it is sealed under the master key. The
|
|
# configuration directory holds server.json and, unless the key is supplied
|
|
# otherwise, that master key. They are separate on purpose: whoever holds
|
|
# both can read everything, and either alone is useless.
|
|
#
|
|
# Give the master key somewhere durable, one of these three ways:
|
|
#
|
|
# --secret keeporg_master_key -e KEEPORG_MASTER_KEY_FILE=/run/secrets/keeporg_master_key
|
|
# -e KEEPORG_MASTER_KEY="$(head -c 32 /dev/urandom | base64)"
|
|
# -v keeporg-config:/etc/keeporg
|
|
#
|
|
# The first is preferred: the key is never in the process environment and
|
|
# never on a disk this container can write. The file may hold base64 or 32
|
|
# raw bytes. Neither environment variable is ever created by the server, so
|
|
# a secret that failed to mount is reported instead of being replaced.
|
|
#
|
|
# With none of the three, the server mints a key into the container's own
|
|
# layer on first start and loses it on the next `run`, after which it
|
|
# refuses to start: the database does not open with a new key. Nothing is
|
|
# overwritten; mount the original key and it starts.
|
|
COPY --from=build --chown=65532:65532 /out/var/lib/keeporg /var/lib/keeporg
|
|
COPY --from=build --chown=65532:65532 /out/etc/keeporg /etc/keeporg
|
|
VOLUME ["/var/lib/keeporg", "/etc/keeporg"]
|
|
|
|
COPY --from=build /out/keeporgd /keeporgd
|
|
|
|
# A fixed unprivileged id, matching the convention used by distroless.
|
|
USER 65532:65532
|
|
EXPOSE 8765
|
|
|
|
# The image has no shell, so the binary checks itself.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD ["/keeporgd", "-healthcheck", "-addr", ":8765"]
|
|
|
|
ENTRYPOINT ["/keeporgd"]
|
|
CMD ["-addr", ":8765", "-data", "/var/lib/keeporg"]
|