mirror of
https://github.com/bitwarden/server
synced 2025-12-06 00:03:34 +00:00
5dfed7623b
If user cleanly follow install instructions Setup app will create nginx `default.conf` (and other files) with `644` permission owned by `bitwarden:bitwarden`. During Nginx entrypoint script it copies generated `default.conf` to `/etc/nginx/conf.d/` but without `-p` flag new file permissions would be `root:root 644`. Then during startup Nginx will start as `bitwarden` user, which will not cause any issues by itself as `default.conf` is still readable by the world. The issue is that for some reason some users have their Nginx config file (or sometimes even entire `bwdata` recursively) have `600` or `700` permissions. In this case Nginx will fail to start due to `default.conf` not readable by `bitwarden` user. I assume that root cause is that some users mistakenly run `sudo chmod -R 700 /opt/bitwarden` from Linux installation guide after they have run `./bitwarden.sh install`. Or maybe some older version of Setup app where creating `default.conf` with `600` permissions and users are using very legacy installations. Whatever may be the case I do not see any harm with copying with `-p` it even looks to me that this was the intended behavior. This will both fix the issue for mentioned users and preserve permission structure aligned with other files.
48 lines
1.2 KiB
Bash
48 lines
1.2 KiB
Bash
#!/bin/sh
|
|
|
|
# Setup
|
|
|
|
GROUPNAME="bitwarden"
|
|
USERNAME="bitwarden"
|
|
|
|
LUID=${LOCAL_UID:-0}
|
|
LGID=${LOCAL_GID:-0}
|
|
|
|
# Step down from host root to well-known nobody/nogroup user
|
|
|
|
if [ $LUID -eq 0 ]
|
|
then
|
|
LUID=65534
|
|
fi
|
|
if [ $LGID -eq 0 ]
|
|
then
|
|
LGID=65534
|
|
fi
|
|
|
|
# Create user and group
|
|
|
|
groupadd -o -g $LGID $GROUPNAME >/dev/null 2>&1 ||
|
|
groupmod -o -g $LGID $GROUPNAME >/dev/null 2>&1
|
|
useradd -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1 ||
|
|
usermod -o -u $LUID -g $GROUPNAME -s /bin/false $USERNAME >/dev/null 2>&1
|
|
mkhomedir_helper $USERNAME
|
|
|
|
# The rest...
|
|
|
|
chown -R $USERNAME:$GROUPNAME /etc/bitwarden
|
|
cp -p /etc/bitwarden/nginx/*.conf /etc/nginx/conf.d/
|
|
mkdir -p /etc/letsencrypt
|
|
chown -R $USERNAME:$GROUPNAME /etc/letsencrypt
|
|
mkdir -p /etc/ssl
|
|
chown -R $USERNAME:$GROUPNAME /etc/ssl
|
|
mkdir -p /var/run/nginx
|
|
touch /var/run/nginx/nginx.pid
|
|
chown -R $USERNAME:$GROUPNAME /var/run/nginx
|
|
chown -R $USERNAME:$GROUPNAME /var/cache/nginx
|
|
chown -R $USERNAME:$GROUPNAME /var/log/nginx
|
|
|
|
# Launch a loop to rotate nginx logs on a daily basis
|
|
gosu $USERNAME:$GROUPNAME /bin/sh -c "/logrotate.sh loop >/dev/null 2>&1 &"
|
|
|
|
exec gosu $USERNAME:$GROUPNAME nginx -g 'daemon off;'
|