自建vaultwarden,实现自动同步与镜像更新 - 文档共建 - LINUX DO

/vaultwarden_backup/

├── admin_token_hash
├── backup  
│   ├── backup_2024-10-19.tar.gz.gpg
│   ├── backup_2024-10-20.tar.gz.gpg
│   ├── backup_2024-10-21.tar.gz.gpg
│   ├── backup_2024-10-22.tar.gz.gpg
│   └── backup_2024-10-24.tar.gz.gpg
├── backup.log
├── backup_update_script.sh
└── gpg_passphrase_file

sudo apt update
sudo apt install docker.io rclone gpg argon2 
sudo systemctl start docker 
sudo systemctl enable docker

# 使用 openssl 生成随机密码
openssl rand -base64 32 > /vaultwarden_backup/gpg_passphrase_file

# 确保文件权限是 600
chmod 600 /vaultwarden_backup/gpg_passphrase_file

sudo apt update
sudo apt install gnupg -y

# 读取生成的密码到变量
GPG_PASSPHRASE=$(< /vaultwarden_backup/gpg_passphrase_file)

# 创建一个测试文件
echo "This is a test backup file." > test_file.txt

# 使用 GPG 加密测试文件
gpg --batch --yes --symmetric --cipher-algo AES256 --passphrase "$GPG_PASSPHRASE" -o test_file.txt.gpg test_file.txt

# 检查是否生成了加密文件
ls test_file.txt.gpg

# 解密文件
gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -o decrypted_test_file.txt -d test_file.txt.gpg

# 检查解密结果
cat decrypted_test_file.txt

rm test_file.txt test_file.txt.gpg decrypted_test_file.txt

# 替换 "123456789" 为您实际的管理员密码
echo -n "123456789" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4 > /vaultwarden_backup/admin_token_hash

# 设置文件权限，确保只有授权用户可以读取
sudo chmod 600 /vaultwarden_backup/admin_token_hash

$argon2id$v=19$m=65540,t=3,p=4$bXBGMENBZUVzT3VUSFErTzQzK25Jck1BN2Z0amFuWjdSdVlIQVZqYzAzYz0$T9m73OdD2mz9+aJKLuOAdbvoARdaKxtOZ+jZcSL9/N0

sudo mkdir -p /vaultwarden_backup
sudo chmod -R 700 /vaultwarden_backup

#!/bin/bash

# ================== 配置部分 ==================

BACKUP_DIR="/vaultwarden_backup/backup"       # 本地备份存储路径
SOURCE_DIR="/VM_data"                         # 需要备份的源目录
REMOTE="onedrive:vaultwarden_backup"          # rclone 远程 OneDrive 目录
DATE=$(date +"%Y-%m-%d")                      # 当前日期
BACKUP_FILE="backup_$DATE.tar.gz"             # 备份文件名
GPG_FILE="$BACKUP_FILE.gpg"                   # 加密后的备份文件名
GPG_PASSPHRASE_FILE="/vaultwarden_backup/gpg_passphrase_file"   # GPG 加密密码文件
RETENTION_DAYS=90                             # 保留的天数
LOG_FILE="/vaultwarden_backup/backup_update_script.log"         # 日志文件

# Docker 配置
IMAGE_NAME="vaultwarden/server:latest"        # 镜像名称
CONTAINER_NAME="vaultwarden"                  # 容器名称

# 日志函数
log() {
    echo "$(date +"%Y-%m-%d %H:%M:%S") - $1" | tee -a $LOG_FILE
}

# 检查 GPG 密码文件是否存在
if [ ! -f "$GPG_PASSPHRASE_FILE" ]; then
    log "GPG 密码文件不存在，备份终止"
    exit 1
fi

# 读取 GPG 密码
GPG_PASSPHRASE=$(< "$GPG_PASSPHRASE_FILE")

# 创建备份
log "开始备份"
if tar -czf "$BACKUP_DIR/$BACKUP_FILE" -C "$SOURCE_DIR" .; then
    log "备份文件已创建: $BACKUP_FILE"
else
    log "备份失败"
    exit 1
fi

# GPG 加密
if gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -c "$BACKUP_DIR/$BACKUP_FILE"; then
    log "备份文件已加密: $GPG_FILE"
else
    log "加密失败，备份终止"
    exit 1
fi

# 删除未加密的文件
rm "$BACKUP_DIR/$BACKUP_FILE"
log "未加密的备份文件已删除"

# 同步到 OneDrive
if rclone copy "$BACKUP_DIR/$GPG_FILE" "$REMOTE"; then
    log "已同步到 OneDrive: $GPG_FILE"
else
    log "同步到 OneDrive 失败"
    exit 1
fi

# 清理本地和远程超过保留期的备份
find "$BACKUP_DIR" -name "backup_*.tar.gz.gpg" -type f -mtime +$RETENTION_DAYS -delete
rclone delete --min-age ${RETENTION_DAYS}d "$REMOTE"
log "超过 $RETENTION_DAYS 天的旧备份已删除"

log "备份完成"


# ================== Docker 镜像更新 ==================

log "开始检查 Docker 镜像更新"

# 拉取最新镜像
if docker pull $IMAGE_NAME; then
    log "拉取最新镜像成功: $IMAGE_NAME"
else
    log "拉取镜像失败"
    exit 1
fi

# 获取最新镜像的 ID
LATEST_IMAGE_ID=$(docker inspect --format='{{.Id}}' $IMAGE_NAME)

# 获取当前运行容器的镜像 ID
CURRENT_IMAGE_I

D=$(docker inspect --format='{{.Image}}' $CONTAINER_NAME)

# 检查是否有更新
if [ "$LATEST_IMAGE_ID" != "$CURRENT_IMAGE_ID" ]; then
    log "有新镜像，更新容器..."

    # 停止并移除旧容器
    if docker stop $CONTAINER_NAME && docker rm $CONTAINER_NAME; then
        log "旧容器已停止并移除"
    else
        log "停止或移除旧容器失败"
        exit 1
    fi

    # 重新启动容器
    if docker run -d --name $CONTAINER_NAME \
        -v /VM_data:/data \
        -e ADMIN_TOKEN="$(cat /vaultwarden_backup/admin_token_hash)" \
        -e INVITATIONS_ALLOWED=false \
        -p 80:80 \
        --restart unless-stopped \
        $IMAGE_NAME; then
        log "容器已更新并重新启动"
    else
        log "容器启动失败"
        exit 1
    fi
else
    log "镜像没有更新，不执行操作"
fi

log "Docker 镜像检查完成"

sudo chmod +x /vaultwarden_backup/backup_update_script.sh
sudo chown your_backup_user:your_backup_group /vaultwarden_backup/backup_update_script.sh

sudo /vaultwarden_backup/backup_update_script.sh

services:

  vault:
    image: vaultwarden/server:alpine
    container_name: vault
    network_mode: host
    restart: always
    volumes: [ "./data/:/data" ]
    environment:
      # Vault
      - DOMAIN=https://vault.xxx.com
      - SIGNUPS_ALLOWED=false
      - SIGNUPS_VERIFY=true
      - INVITATIONS_ALLOWED=false
      # Rocket
      - ROCKET_ADDRESS=127.0.0.1
      - ROCKET_PORT=3018
      # Websocket
      - WEBSOCKET_ENABLED=true
      - WEBSOCKET_ADDRESS=127.0.0.1
      - WEBSOCKET_PORT=3019
      # SMTP
      - SMTP_HOST=smtp.gmail.com
      - SMTP_PORT=587
      - SMTP_SECURITY=starttls
      - SMTP_FROM=xxx@gmail.com
      - SMTP_USERNAME=xxx@gmail.com
      - SMTP_PASSWORD=xxx