Thijs Herman
e320f95d9f
* security: redact secret names from logs, bind port to localhost - handlers: replace secret names in Warn/Error logs with client IP (prevents information disclosure via log access/injection) - client: downgrade secret name logs from Info to Debug level (Debug is discarded in production via io.Discard) - docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080 (prevents direct access bypassing reverse proxy) Found during security pen test of vault.turboot.com * Enhance logging for secret retrieval and cache access
82 lines
1.9 KiB
YAML
82 lines
1.9 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
vaultwarden-api:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
container_name: vaultwarden-api
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
environment:
|
|
# Server configuration
|
|
- API_PORT=8080
|
|
- ENVIRONMENT=production
|
|
|
|
# Security - REQUIRED
|
|
# IMPORTANT: Change these values before deploying!
|
|
- API_KEY=${API_KEY}
|
|
|
|
# Vaultwarden configuration
|
|
- VAULTWARDEN_URL=${VAULTWARDEN_URL}
|
|
- VAULTWARDEN_ACCESS_TOKEN=${VAULTWARDEN_ACCESS_TOKEN}
|
|
|
|
# Performance
|
|
- CACHE_TTL=5m
|
|
- READ_TIMEOUT=10s
|
|
- WRITE_TIMEOUT=10s
|
|
|
|
# Security: read-only filesystem (except for tmp)
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
|
|
# Security: drop all capabilities
|
|
cap_drop:
|
|
- ALL
|
|
|
|
# Security: prevent privilege escalation
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
|
|
# Resource limits (adjust based on your needs)
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '0.5'
|
|
memory: 128M
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
|
|
# Health check
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 5s
|
|
|
|
# Logging configuration
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
# Network configuration
|
|
networks:
|
|
- vaultwarden-network
|
|
|
|
networks:
|
|
vaultwarden-network:
|
|
driver: bridge
|
|
|
|
# For production deployment with Portainer Stack:
|
|
# 1. Copy this file to your Portainer environment
|
|
# 2. Set environment variables in Portainer's stack configuration
|
|
# 3. Or create a .env file (but NEVER commit it to git!)
|
|
# 4. Deploy behind a reverse proxy (Nginx Proxy Manager, Traefik, etc.)
|
|
# 5. Ensure HTTPS is enabled on the reverse proxy
|