免费解锁Bitwarden所有功能,自建Vaultwarden过程

Bitwarden 浏览器扩展 / 手机 App
                │
                │ HTTPS
                ▼
        Nginx（宿主机 443）
                │
                │ HTTP 0.0.0.0:7443
                ▼
       Podman 端口映射与独立网络
                │
                ▼
 Vaultwarden 1.37.3（容器内 8080）
                │
                ▼
      /anmiao/vaultwarden/data

FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@sha256:ba8bab66d4330ab9dbafa8f245bcbe99cf6ee3f2c8ce9b5fbb10e9c49658451c AS web

FROM registry.suse.com/bci/gcc:15 AS Build

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN set -eux; \
    zypper --gpg-auto-import-keys -vv refresh --force; \
    zypper --non-interactive install --no-recommends -y \
      rust1.98 cargo1.98 perl pkgconf-pkg-config ca-certificates

ENV CARGO_INCREMENTAL=0 

WORKDIR /anmiao/build

COPY ./vaultwarden/ .

WORKDIR /anmiao/build/vaultwarden

ARG VW_VERSION=1.37.3
ENV VW_VERSION=${VW_VERSION}

RUN echo "===== Vaultwarden build =====" && \
    echo "Version: ${VW_VERSION}" && \
    echo "CPU jobs: ${CARGO_BUILD_JOBS}" && \
    echo && \
    cat /anmiao/build/rust-toolchain.toml && \
    echo && \
    rustc --version && \
    cargo --version

RUN cargo build \
        --release \
        --locked \
        --no-default-features \
        --features sqlite,vendored_openssl && \
    mkdir -p /output && \
    install \
        -m 0755 \
        /anmiao/build/target/release/vaultwarden \
        /output/vaultwarden

RUN echo "===== Binary validation =====" && \
    test -x /output/vaultwarden && \
    /output/vaultwarden --help >/dev/null && \
    ls -lh /output/vaultwarden


FROM registry.suse.com/bci/bci-minimal:16.0
LABEL maintainer="闇喵 <anmiao@am.moe>"

ENV LANG='en_US.UTF-8' LANGUAGE='en_US:en'

RUN mkdir -p /anmiao/{data,web-vault}

COPY --from=Build --chown=0:0 --chmod=0755 /output/vaultwarden /anmiao/vaultwarden
COPY --from=web --chown=0:0 /web-vault/ /anmiao/web-vault/

ENV ROCKET_PROFILE=release \
    ROCKET_ADDRESS=0.0.0.0 \
    ROCKET_PORT=8080 \
    DATA_FOLDER=/anmiao/data \
    WEB_VAULT_FOLDER=/anmiao/web-vault \
    WEB_VAULT_ENABLED=true

WORKDIR /anmiao

EXPOSE 8080
ENTRYPOINT ["/anmiao/vaultwarden"]

---
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: anmiao-vaultwarden
  name: anmiao-vaultwarden
spec:
  restartPolicy: Always
  securityContext: 
    seccompProfile: 
      type: RuntimeDefault
  containers: 
  - env:
    - name: UMASK
      value: '022'
    - name: TZ
      value: Asia/Hong_Kong
    - name: DOMAIN
      value: 'https://passwd.anmiao.moe'
    - name: ROCKET_ADDRESS
      value: 0.0.0.0
    - name: ROCKET_PORT
      value: 8080
    - name: DATA_FOLDER
      value: /anmiao/data
    - name: WEB_VAULT_FOLDER
      value: /anmiao/web-vault
## 第一次使用时,临时改为: true,先注册一个专属自己账号
    - name: SIGNUPS_ALLOWED
      value: false
    - name: INVITATIONS_ALLOWED
      value: false
    - name: WEB_VAULT_ENABLED
      value: true
## 禁止 Vaultwarden 后端主动下载网站图标
    - name: DISABLE_ICON_DOWNLOAD
      value: true
    - name: PUSH_ENABLED  ##你目前计划不使用 Bitwarden Push
      value: false
#    - name: ADMIN_TOKEN
#      value: 
    image: swr.cn-southwest-2.myhuaweicloud.com/anmiao/vaultwarden:v1.37.3-amd64
    name: poi
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
    ports:
    - name: http
      containerPort: 8080
      hostPort: 7443
      protocol: TCP
    volumeMounts:
    - mountPath: /anmiao/data
      name: vaultwarden-data
    - mountPath: /tmp
      name: vaultwarden-tmp
    readinessProbe:
      httpGet:
        path: /alive
        port: 8080
        scheme: HTTP
      initialDelaySeconds: 11
      periodSeconds: 30
      timeoutSeconds: 5
      failureThreshold: 3
    livenessProbe:
      httpGet:
        path: /alive
        port: 8080
        scheme: HTTP
      initialDelaySeconds: 21
      periodSeconds: 60
      timeoutSeconds: 5
  dnsConfig:
    nameservers:
    - 100.96.0.3
    - 100.96.0.2
  volumes:
  - hostPath:
      path: /anmiao/vaultwarden/data
      type: Directory
    name: vaultwarden-data
  - emptyDir:
      sizeLimit: 256Mi
    name: vaultwarden-tmp

    server {
        listen                10.8.8.1:443 ssl;
        listen                [fd00::1]:443 ssl;  ##开启IPv6
        http2                 on;

        server_name           xxxxxx.anmiao.moe;

        charset               utf-8;

        ssl_trusted_certificate   /ssl/anmiao_moe.crt;  ##证书信任

        ssl_certificate        /ssl/anmiao_moe.pem;
        ssl_certificate_key    /ssl/anmiao_moe.key;

        ssl_session_cache    shared:SSL:10m;
        ssl_session_timeout  5m;
        ssl_buffer_size 4k;  # 防御BEAST攻击
        ssl_session_tickets  off;

        ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

        ssl_prefer_server_ciphers  on;
        ssl_protocols  TLSv1.2 TLSv1.3;

        location / {
            # rewrite ^/i(.*) /$1 break;
            add_header         X-Served-By         $host;
            proxy_set_header   Host                $host;
            proxy_set_header   X-Forwarded-Scheme  $scheme;
            proxy_set_header   X-Forwarded-Proto   $scheme;
            proxy_set_header   X-Forwarded-Host    $http_host;
            proxy_set_header   X-Forwarded-For     $proxy_add_x_forwarded_for;
            proxy_set_header   X-Real-IP           $remote_addr;
            # proxy_method       POST;               # 确保 POST 方法被正确转发
            proxy_method       $request_method;    # 请求方式移交后端处理
            proxy_set_header   If-Range            $http_if_range;
            proxy_set_header   Upgrade             $connection_upgrade;
            proxy_set_header   Connection          $http_connection;
            proxy_pass_request_headers             on;    ## 确保所有请求头部都被转发

            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
            proxy_set_header    X-Content-Type-Options    "nosniff";
            proxy_set_header   X-Frame-Options   "SAMEORIGIN";
            proxy_ssl_verify off;

            proxy_buffering off;  ## 关闭缓冲意味着Nginx会直接将从后端服务器接收到的数据流式传输给客户端，而不进行缓存。这对于处理大文件或需要实时传输的场景非常有用
            proxy_redirect off;  ## 对发送给客户端的URL进行修改
            proxy_buffers 8 16k;
            proxy_buffer_size 8k;
            proxy_headers_hash_max_size  51200;
            proxy_headers_hash_bucket_size  6400;
            proxy_pass http://vaultwarden/;
            proxy_http_version 1.1;
        }
    }

    server {
        listen                80;
        listen                [::]:80;  ##开启IPv6

        server_name           xxxxxx.anmiao.moe;

        rewrite ^(.*)$ https://$host$1;

        location / {
            index index.html index.htm;
        }
    }

table inet filter {
    chain forward {
        type filter hook forward priority filter;
        policy accept;

        # 放在任何“允许整个 Podman 子网出网”的宽泛 accept 规则之前。
        ip saddr 10.89.50.0/24 oifname "eth0" counter drop comment "Block Vaultwarden egress"
    }
}

短暂停止 Vaultwarden
        ↓
完整打包 /anmiao/vaultwarden/data
        ↓
启动 Vaultwarden
        ↓
校验备份
        ↓
通过 SSH/rsync 发送到异地服务器

#! /bin/bash
set -Eeuo pipefail
umask 077

## 停止Vaultwarden服务
podman kube play --down /anmiao/vaultwarden/vaultwarden.yaml 
sleep 2s

## 打包并加密加密码
7z a -t7z -mx=9 -mhe=on -p123456 ~/vaultwarden-backup-$(date '+%Y-%m-%d_%H-%M').7z /anmiao/vaultwarden 
sleep 2s

## 启动Vaultwarden服务
podman kube play --network nat /anmiao/vaultwarden/vaultwarden.yaml
sleep 2s

## 找出超过30天的备份文件并删掉
find /anmiao/vaultwarden -type f -name "vaultwarden-backup*.7z" -mtime +30 -delete