vaultwarden 密码管理

1. 创建隧道

在Cloudflare 控制面板 创建一条 Tunnel

记住 Tunnel Token (就是提示执行命令里面 后面一长串的)

2. docker-compose.yml

将 TUNNEL_TOKEN 填入

services:
  vaultwarden:
    image: vaultwarden/server:latest-alpine
    volumes:
      - ./data:/data
    restart: always
    environment:
      - IP_HEADER=CF-Connecting-IP
      #- SIGNUPS_ALLOWED=false
      
  tunnel:
    image: cloudflare/cloudflared
    restart: always
    command: tunnel run
    depends_on:
      - vaultwarden
    environment:
      - TUNNEL_TOKEN=xxx

docker compose up -d

到Cloudflare tunnels 里面，可以看到已经成功 tunnel 了, 将域名映射到 http vaultwarden:80

然后访问域名 , 创建 vaultwarden 账户

然后, 关闭容器

docker compose down

3. 自动备份到github

3.1 创建一个私人 github 仓库

创建完成后, github -> setting - > developer setting - > personal access tokens -> Fine-grained tokens

给 Commit statuses 和 Contents 的 read and write 权限

3.2 初始化仓库

在vps上, cd 到项目路径下

git init

git add .

git commit -m "first commit"

git branch -M main

git remote add origin https://github.com/账户名/项目名.git

git push -u origin main

看看能否正常推送

3.3 创建 backup.sh

docker-compose.yml 同目录创建一个 backup.sh 文件, 将下面的代码复制进去

#!/bin/bash

log() {
    current_time=$(date "+%Y-%m-%d %H:%M:%S")
    echo "$current_time: $*"
}

# 检查/root/.gitconfig是否存在
if [ ! -f "/root/.gitconfig" ]; then
    # 文件不存在，创建文件并写入配置
    cat > /root/.gitconfig << EOF
[user]
    email = github-actions[bot]@users.noreply.github.com
    name = AutoBackup
[credential]
    helper = store
[safe]
    directory = /app
EOF
    log "文件 /root/.gitconfig 已创建并写入配置。"
fi

# 检查环境变量 GITHUB_USER 和 GITHUB_TOKEN 是否已设置
if [[ -n "$GITHUB_USER" ]] && [[ -n "$GITHUB_TOKEN" ]]; then
    # 拼接要写入的凭据字符串
    credentials="https://${GITHUB_USER}:${GITHUB_TOKEN}@github.com"
    # 检查 .git-credentials 文件是否已经存在
    if [[ -f /root/.git-credentials ]]; then
        # 读取现有的 .git-credentials 文件内容
        existing_credentials=$(cat /root/.git-credentials)
        # 比较现有内容和即将写入的内容
        if [[ $existing_credentials == $credentials ]]; then
            :
        else
            echo "$credentials" > /root/.git-credentials
            log "凭据已更新到 /root/.git-credentials"
        fi
    else
        echo "$credentials" > /root/.git-credentials
        log "凭据已写入到 /root/.git-credentials"
    fi
else
    log "环境变量 GITHUB_USER 或 GITHUB_TOKEN 未设置。"
fi

# 切换到 /app 目录
cd /app || exit

# 添加所有更改到暂存区
git add .

# 检查是否有文件变化
if ! git diff --cached --quiet; then
    log "检测到文件变化，准备进行备份..."
    if ! git commit -m "AutoBackup"; then
        log "提交失败，检查是否有文件变化或其他错误。"
        exit 1
    fi
    git push
    log "备份成功"
else
    log "没有检测到变化，跳过推送。"
fi

3.4 配置最终 docker-compose.yml

将token 填入 docker-compose.yml 文件中

services:
  vaultwarden:
    image: vaultwarden/server:latest-alpine
    volumes:
      - ./data:/data
    restart: always
    environment:
      - IP_HEADER=CF-Connecting-IP
      - SIGNUPS_ALLOWED=false
      
  tunnel:
    image: cloudflare/cloudflared
    restart: always
    command: tunnel run
    depends_on:
      - vaultwarden
    environment:
      - TUNNEL_TOKEN=xxx

  backup:
    image: alpine:latest
    restart: always
    depends_on:
      - vaultwarden
    volumes:
      - ./:/app
    command: /bin/sh -c "apk add --no-cache git && chmod +x /app/backup.sh && echo '*/5 * * * * /bin/sh /app/backup.sh' | crontab - && crond -f"
    environment:
      - GITHUB_TOKEN=xxx
      - GITHUB_USER=xxx

docker compose up -d

3.5 观察日志,是否正常推送

docker compose logs -f backup