root
dacfe20494
Why: the server is a single static binary with no dependencies, so its container should be nothing but that binary. Shipping one also makes the master key easy to lose, which needed handling rather than documenting. What: - Dockerfile: two stages, runtime is scratch plus the binary and a CA bundle for reaching an OIDC provider, running as uid 65532. About 9 MB. The build stage copies only go.mod, cmd/keeporgd and internal, so client or docs changes do not invalidate it. - The image has no shell, so HEALTHCHECK runs `keeporgd -healthcheck`, a new flag that probes /healthz on the configured address and exits non-zero with a reason. podman needs --format docker to keep the healthcheck at all, which the Makefile passes when it picks podman. - New -master-key-file flag, so a mounted secret works without a config file. - The server now checks at startup whether the master key still opens the stored vault keys, and says so. Without it, a container restarted without its key discovers the problem one failed merge at a time. - make docker, docker-run and docker-save; a compose example with read_only, cap_drop ALL and no-new-privileges. - The client and the server now version independently, so their Debian changelogs are split per package and `make changelog` takes PKG=. Server 0.3.0; the clients stay at 0.2.0. Proved: built with podman and run. The container serves /healthz and /web, its own healthcheck reports healthy, and a vault created through it was edited from the same base by keepassxc-cli twice, merged by the server into version 3, and read back with both entries intact. Restarted without the master key it warns "1 of 1 stored vault keys do not open with this master key" and answers a merging push with 409 merge_failed, leaving the vault untouched; restored, it logs "1 vault keys available for merging" and merges again. The same key supplied through -master-key-file from a mounted file works identically. Both .deb packages build with their own changelog, and make check is clean.
82 lines
3.1 KiB
Docker
82 lines
3.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# KeepOrg synchronization server.
|
|
#
|
|
# The server is a static binary with no third-party dependencies and no cgo,
|
|
# so the runtime image carries the binary, a certificate bundle for talking
|
|
# to an OIDC provider, and nothing else. There is no shell in it: the binary
|
|
# probes its own health.
|
|
#
|
|
# podman build --format docker -t keeporgd:0.3.0 --build-arg VERSION=0.3.0 .
|
|
# docker build -t keeporgd:0.3.0 --build-arg VERSION=0.3.0 .
|
|
#
|
|
# podman needs --format docker, because the OCI image format has no
|
|
# HEALTHCHECK field and drops it silently.
|
|
#
|
|
# or `make docker`, which takes the version from versions.mk.
|
|
|
|
FROM golang:1.24-alpine AS build
|
|
|
|
ARG VERSION=dev
|
|
WORKDIR /src
|
|
|
|
# Only what the server is built from, so a change to the clients, the
|
|
# Android app or the docs does not invalidate this layer.
|
|
COPY go.mod ./
|
|
COPY cmd/keeporgd ./cmd/keeporgd
|
|
COPY internal ./internal
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build \
|
|
-trimpath \
|
|
-ldflags "-s -w -X main.Version=${VERSION}" \
|
|
-o /out/keeporgd ./cmd/keeporgd
|
|
|
|
# Empty directories to copy into the scratch image with the right owner.
|
|
# There is no shell there to create them later.
|
|
RUN mkdir -p /out/var/lib/keeporg /out/etc/keeporg
|
|
|
|
|
|
FROM scratch
|
|
|
|
ARG VERSION=dev
|
|
LABEL org.opencontainers.image.title="KeepOrg server" \
|
|
org.opencontainers.image.description="Synchronization server for collaborative KeePass databases" \
|
|
org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.source="https://garage.rcmd.space/keeporg" \
|
|
org.opencontainers.image.licenses="AGPL-3.0-or-later" \
|
|
cc.tiredsysadmin.application="cc.tiredsysadmin.linux.keeporgd"
|
|
|
|
# Needed to reach an OIDC provider over TLS. Nothing else from the builder
|
|
# comes along.
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
|
|
# The data directory holds state.json and the KDBX blobs. The configuration
|
|
# directory holds server.json and, unless the key is supplied through
|
|
# KEEPORG_MASTER_KEY, the master key that unwraps the vault keys. They are
|
|
# separate on purpose: whoever holds both can read every merge vault.
|
|
#
|
|
# Give the master key somewhere durable, one of these two ways:
|
|
#
|
|
# -e KEEPORG_MASTER_KEY="$(head -c 32 /dev/urandom | base64)" (preferred)
|
|
# -v keeporg-config:/etc/keeporg
|
|
#
|
|
# With neither, the server mints a key into the container's own layer on
|
|
# first start and loses it on the next `run`. It says so loudly at startup,
|
|
# and merging is all that stops working: clients still open their vaults.
|
|
COPY --from=build --chown=65532:65532 /out/var/lib/keeporg /var/lib/keeporg
|
|
COPY --from=build --chown=65532:65532 /out/etc/keeporg /etc/keeporg
|
|
VOLUME ["/var/lib/keeporg", "/etc/keeporg"]
|
|
|
|
COPY --from=build /out/keeporgd /keeporgd
|
|
|
|
# A fixed unprivileged id, matching the convention used by distroless.
|
|
USER 65532:65532
|
|
EXPOSE 8765
|
|
|
|
# The image has no shell, so the binary checks itself.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD ["/keeporgd", "-healthcheck", "-addr", ":8765"]
|
|
|
|
ENTRYPOINT ["/keeporgd"]
|
|
CMD ["-addr", ":8765", "-data", "/var/lib/keeporg"]
|