add smtp_debug env var

Reviewed-on: #11

.drone.yml

@@ -34,7 +34,7 @@ steps:
         from_secret: drone_abra-bot_token
       fork: true
       repositories:
-        - coop-cloud/auto-recipes-catalogue-json
+        - toolshed/auto-recipes-catalogue-json
 
 trigger:
   event: tag

.env.sample

@@ -15,6 +15,8 @@ LOG_LEVEL=warn
 
 SECRET_ADMIN_TOKEN_VERSION=v1 # length=48
 
+TX="Europe/Berlin"
+
 ## DB settings
 #COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 #SECRET_DB_PASSWORD_VERSION=v1
@@ -23,8 +25,12 @@ SECRET_ADMIN_TOKEN_VERSION=v1 # length=48
 ## SMTP settings
 #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SECRET_SMTP_PASSWORD_VERSION=v1
+#SMTP_ENABLED=1
 #SMTP_FROM=noreply@example.com
 #SMTP_USERNAME=noreply@example.com
 #SMTP_HOST=mail.example.com
 #SMTP_PORT=587
 #SMTP_SECURITY=starttls
+# If SMTP isn't working, enable this line to debug
+#  remember to disable it after debugging
+#SMTP_DEBUG=true

abra.sh

@@ -1,9 +1,11 @@
-export APP_ENTRYPOINT_VERSION=v2
+export APP_ENTRYPOINT_VERSION=v4
 APP_DIR="app:/data"
 
 insert_vaultwarden_admin_token() {
   if ! command -v argon2 &> /dev/null; then
-    echo "argon2 could not be found, please install it to proceed."
+    echo "argon2 is required on your local machine to hash the admin token."
+    echo "It could not be found in your PATH, please install argon2 to proceed."
+    echo "For example: On a debian/ubuntu system, run `apt install argon2`"
     exit 1
   fi
   PASS=$(openssl rand 64 | openssl enc -A -base64)

compose.mariadb.yml

@@ -13,7 +13,7 @@ services:
       - db_password
 
   db:
-    image: "mariadb:10.6" # or "mysql"
+    image: "mariadb:10.11" # or "mysql"
     environment:
       - MYSQL_DATABASE=vaultwarden
       - MYSQL_USER=vaultwarden
@@ -29,9 +29,9 @@ services:
       - internal
     deploy:
       labels:
-        backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" $MYSQL_DATABASE > /var/lib/mysql/backup.sql'
+        backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" $${MYSQL_DATABASE} > /var/lib/mysql/backup.sql'
         backupbot.backup.volumes.mariadb.path: "backup.sql"
-        backupbot.restore.post-hook: 'mysql -u root -p"$$(cat /run/secrets/db_root_password)" $MYSQL_DATABASE < /var/lib/mysql/backup.sql'
+        backupbot.restore.post-hook: 'mysql -u root -p"$$(cat /run/secrets/db_root_password)" $${MYSQL_DATABASE} < /var/lib/mysql/backup.sql'
     healthcheck:
       test: ["CMD-SHELL", 'mysqladmin -p"$$(cat /run/secrets/db_root_password)"  ping']
       interval: 5s

compose.smtp.yml

@@ -6,12 +6,14 @@ services:
     secrets:
       - smtp_password
     environment:
+      - "SMTP_ENABLED"
       - "SMTP_PASSWORD_FILE=/run/secrets/smtp_password"
       - "SMTP_FROM"
       - "SMTP_USERNAME"
       - "SMTP_HOST"
       - "SMTP_PORT"
       - "SMTP_SECURITY"
+      - "SMTP_DEBUG"
 
 secrets:
   smtp_password:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: vaultwarden/server:1.32.5
+    image: vaultwarden/server:1.34.3
     networks:
       - proxy
       - internal
@@ -16,6 +16,7 @@ services:
       - "EXTENDED_LOGGING=$EXTENDED_LOGGING"
       - "LOG_FILE=$LOG_FILE"
       - "LOG_LEVEL=$LOG_LEVEL"
+      - "TX=${TX:-Europe/Berlin}"
     configs:
       - source: app_entrypoint
         target: /docker-entrypoint.sh
@@ -41,7 +42,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=1.0.2+1.32.5"
+        - "coop-cloud.${STACK_NAME}.version=2.1.1+1.34.3"
         - "backupbot.backup=true"
         - "backupbot.backup.path=/data"
 

entrypoint.sh.tmpl

@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -e
+umask 027
 
 # set DATABASE_URL with db_password
 set_db_url() {
@@ -46,7 +47,13 @@ if [ -n "${MYSQL_HOST}" ]; then
 fi
 
 file_env "ADMIN_TOKEN"
+
+{{ if eq (env "SMTP_ENABLED") "1" }}
 file_env "SMTP_PASSWORD"
+{{ end }}
+
+# remove world permissions on data
+chmod -R o= /data
 
 # upstream startup command
 # https://github.com/dani-garcia/vaultwarden/blob/60ed5ff99d15dec0b82c85987f9a3e244b8bde91/docker/Dockerfile.j2#L254

release/1.0.0+1.32.3

@@ -0,0 +1 @@
+ATTENTION: this version is not automatically upgradeable due to missing entrypoint version increase. Please upgrade to at least 1.0.4+1.32.7 directly.

release/1.0.1+1.32.5

@@ -0,0 +1 @@
+ATTENTION: this version is not automatically upgradeable due to missing entrypoint version increase. Please upgrade to at least 1.0.4+1.32.7 directly.

release/1.0.2+1.32.5

@@ -0,0 +1 @@
+ATTENTION: this version is not automatically upgradeable due to missing entrypoint version increase. Please upgrade to at least 1.0.4+1.32.7 directly.

release/1.0.3+1.32.5

@@ -0,0 +1 @@
+ATTENTION: this version is not automatically upgradeable due to missing entrypoint version increase. Please upgrade to at least 1.0.4+1.32.7 directly.

release/1.0.4+1.32.7

@@ -0,0 +1 @@
+bugfix release for missing increase of entrypoint version for the last 4 releases. Also upgraded vaultwarden bugfix release.

release/2.0.0+1.33.2

@@ -0,0 +1,15 @@
+=== SMTP SETTINGS ===
+This release contains a *breaking change* if you use SMTP with vaultwarden.
+
+See https://git.coopcloud.tech/coop-cloud/vaultwarden/pulls/9 for more.
+
+TLDR; Please add `SMTP_ENABLED=1` to your .env to continue using SMTP.
+
+=== PERMISSIONS ===
+
+Previously, the data directory including the main private key had read
+permissions enabled for all host users. This release fixes that. Please review
+your Vaultwarden keys if other users on your Co-op Cloud host may have had
+access to these files.
+
+See https://git.coopcloud.tech/coop-cloud/vaultwarden/pulls/7 for more.