【玩转Lighthouse】部署Bitwarden密码管理及备份教程

curl -sSL https://get.daocloud.io/docker | sh

docker run --rm -v /usr/local/bin:/dist gists/docker-compose-bin:latest && docker rmi gists/docker-compose-bin:latest

mkdir /root/.config/bitwarden
cd /root/.config/bitwarden

version: '3'
 
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: bitwarden
    restart: always
    environment:
      - WEBSOCKET_ENABLED=true  # 启用 WebSocket 通知
    volumes:
      - /root/.config/bitwarden:/data
 
  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80  #  ACME HTTP-01 验证需要
      - 443:443
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data
    environment:
      - DOMAIN=http(s)://example.com  # 您的域名，以 http 或 https 作为前缀
      - EMAIL=admin@example.com       # 用于 ACME 注册的电子邮件地址
      - LOG_FILE=/data/access.log

{$DOMAIN}:443 {
  log {
    level INFO
    output file {$LOG_FILE} {
      roll_size 10MB
      roll_keep 10
    }
  }
 
  # 使用 ACME HTTP-01 验证方式为已配置的域名获取证书
  tls {$EMAIL}
 
  # 此设置可能会在某些浏览器上出现兼容性问题（例如，在 Firefox 上下载附件）
  # 如果遇到问题，请尝试禁用此功能
  encode gzip
 
  # Notifications 重定向到 WebSocket 服务器
  reverse_proxy /notifications/hub vaultwarden:3012
 
  # 将任何其他东西代理到 Rocket
  reverse_proxy vaultwarden:80 {
       # 把真实的远程 IP 发送给 Rocket，让 Vaultwarden 把其放在日志中
       # 这样 fail2ban 就可以阻止正确的 IP 了
       header_up X-Real-IP {remote_host}
  }
}

docker-compose up -d

curl https://rclone.org/install.sh | bash

nano /root/.config/sh/backup.sh

#!/bin/bash
/usr/bin/tar -czvPf /root/.config/up/bitwarden_`date +%Y%m%d%H%M%S`.tar.gz /root/.config/bitwarden
/usr/bin/rclone copy /root/.config/up  a:data/bitwarden
/usr/bin/find /root/.config/up -mtime +30 -name "*.tar.gz" -exec rm -rf {} \;
echo "BACKUP DATE:" $(date +"%Y-%m-%d %H:%M:%S") >> /var/log/backup.log

crontab -e

0 1 * * * sh /root/.config/sh/backup.sh