Overriding ENV values in a VaultWarden Dockerfile

1

I run the official vaultwarden/server:latest-alpine container, albeit quite customized. On top of the container I have my ENV variables, such as

---
# The following ENVs manage the app; yeah, it's a lot in a Dockerfile, but I'd rather have them here
# Than manage yet another file (.env)
ENV I_REALLY_WANT_VOLATILE_STORAGE=${volatile_storage}
ENV DATA_FOLDER=/data
ENV DATABASE_URL=*****
ENV ENABLE_WEBSOCKET=true
ENV PUSH_ENABLED=true
ENV PUSH_INSTALLATION_ID=****
ENV PUSH_INSTALLATION_KEY=****
---

For obvious reasons, having sensitive info in a Dockerfile ENV variable, or in an .env file, is suboptimal.

As I run an Hashicorp Vault container on the same network, I thought of pushing all of the Dockerfile secrets into HCP Vault, have a Vault client installed into my customized VW image, and from the image, inject all of what used to be ENV variables from Hashicorp Vault using its Vault client.

When and where should I do that ? Is that even allowed ?
If that helps, currently the Dockerfile ENTRYPOINT is:
ENTRYPOINT [ "/start.sh"]

Which basically amounts to exec /vaultwarden "${@}"

And NO, doing a “docker run” with multiple -e params is not an option for me, before anyone suggests it :slight_smile: the whole idea here is to make the container… well, self-contained

2

Load them as secrets. See Configuration overview · dani-garcia/vaultwarden Wiki · GitHub

1 Like
3

For various reasons, my best bet still remains the hashicorp vault way (at least short-term).

Please let me know if my understanding is correct, and if what I plan on is viable:

  • In my Dockerfile, I’ll have this line: ENV ENV_FILE=/.secrets
  • I copy a generic .secrets file in / . That file will have many placeholders such as __PGUSERNAME__, __PGPASSWD__, etc
  • I also copy a bash script that will fetch all the needed values from my HCP Vault, and then plug them (sed, etc) into /.secrets, replacing the above placeholders
  • I then start vaultwarden (/start.sh)

Is this something that can be done ?

4

That is an option to.
But in that case you could also place all env options into vault and extract it from there and use that all the time.

5

Yes, I’ll try it that way, thanks for the info !