Thijs Herman
9f8ebf2408
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely. ## What changed - New native HTTP client talks directly to Vaultwarden API - Bitwarden-compatible crypto in pure Go: - AES-256-CBC + HMAC-SHA256 decryption - PBKDF2-SHA256 and Argon2id key derivation - HKDF key stretching (with legacy fallback) - Auto token refresh (never expires) - Background vault sync (configurable interval, default 5min) - Docker image: ~233MB → ~15MB (pure Alpine, no Node.js) ## New env vars - VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET) - SYNC_INTERVAL (default: 5m) ## Removed - internal/vaultwarden/client_cli.go (CLI interaction) - Bitwarden CLI dependency (Node.js + npm package) - VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars ## Added - internal/vaultwarden/crypto.go (encryption/decryption) - internal/vaultwarden/crypto_test.go (11 unit tests) - internal/vaultwarden/api_client.go (HTTP client) ## Unchanged - External API surface (GET /secret/:name, POST /refresh, GET /health) - All security middleware (auth, IP whitelist, rate limiting)
51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
services:
|
|
vaultwarden-api:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: vaultwarden-api
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
environment:
|
|
- API_PORT=8080
|
|
- ENVIRONMENT=production
|
|
- API_KEY=${API_KEY}
|
|
- VAULTWARDEN_URL=${VAULTWARDEN_URL}
|
|
- VAULTWARDEN_EMAIL=${VAULTWARDEN_EMAIL}
|
|
- VAULTWARDEN_PASSWORD=${VAULTWARDEN_PASSWORD}
|
|
- ALLOWED_IPS=${ALLOWED_IPS}
|
|
- ENABLE_GITHUB_IP_RANGES=${ENABLE_GITHUB_IP_RANGES:-false}
|
|
- TRUSTED_PROXY_IP=${TRUSTED_PROXY_IP}
|
|
- CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-http://localhost:3000}
|
|
- SYNC_INTERVAL=${SYNC_INTERVAL:-5m}
|
|
- CACHE_TTL=5m
|
|
- READ_TIMEOUT=10s
|
|
- WRITE_TIMEOUT=10s
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 128M
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 10s
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|