chore: use ubuntu image to reduce image size (#142)

* chore: use ubuntu image to reduce image size

* fix(lint): hadolint issues

.github/workflows/cargo.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Build
         run: cargo build --verbose
@@ -24,12 +24,12 @@ jobs:
       - name: Run tests
         run: cargo test --verbose
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v4
 
       - name: Run pre-commit hooks
-        uses: pre-commit/action@v2.0.3
+        uses: pre-commit/action@v3.0.0
         env:
           SKIP: hadolint
 
       - name: Run hadolint
-        uses: hadolint/hadolint-action@v1.6.0
+        uses: hadolint/hadolint-action@v3.1.0

.github/workflows/docker.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@v4
         with:
           images: vividboarder/vaultwarden_ldap
           flavor: |
@@ -42,12 +42,12 @@ jobs:
 
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           file: ${{ matrix.dockerfile }}

Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "vaultwarden_ldap"
-version = "0.6.2"
+version = "1.0.0"
 authors = ["ViViDboarder <vividboarder@gmail.com>"]
 edition = "2018"
 
 [dependencies]
-ldap3 = "0.9"
+ldap3 = "0.11"
 serde = { version = "1.0", features = ["derive"] }
 toml = "0.5"
 reqwest = { version = "0.11", features = ["json", "blocking"] }
@@ -13,3 +13,5 @@ serde_json = "1.0"
 thiserror = "1.0"
 anyhow = "1.0"
 envy = "0.4.1"
+pledge = "0.4.2"
+unveil = "0.3.2"

Dockerfile

@@ -1,4 +1,4 @@
-ARG BUILD_TAG=1.56.1
+ARG BUILD_TAG=1.57.0
 ARG RUN_TAG=$BUILD_TAG
 
 FROM rust:$BUILD_TAG as builder
@@ -18,8 +18,9 @@ RUN rm ./target/release/deps/vaultwarden_ldap*
 COPY src ./src
 RUN cargo build --release
 
-FROM rust:$RUN_TAG
+FROM ubuntu:focal
 WORKDIR /app
+RUN apt-get update -y && apt-get install -y libssl-dev=1.1.1f-1ubuntu2.20 --no-install-recommends && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /usr/src/vaultwarden_ldap/target/release/vaultwarden_ldap /usr/local/bin/
 
 CMD ["/usr/local/bin/vaultwarden_ldap"]

Dockerfile.alpine

@@ -1,4 +1,4 @@
-FROM ekidd/rust-musl-builder:1.51.0 AS builder
+FROM ekidd/rust-musl-builder:1.57.0 AS builder
 
 WORKDIR /home/rust/src
 
@@ -14,7 +14,8 @@ RUN USER=rust touch ./src/main.rs
 RUN cargo build --release
 
 FROM alpine:3
-RUN apk --no-cache add ca-certificates=20211220-r0
+# hadolint ignore=DL3018
+RUN apk --no-cache add ca-certificates
 COPY --from=builder \
     /home/rust/src/target/x86_64-unknown-linux-musl/release/vaultwarden_ldap \
     /usr/local/bin/

Makefile

@@ -38,14 +38,28 @@ test:
 itest:
 	docker-compose -f docker-compose.yml \
 		-f itest/docker-compose.itest.yml \
-		up --build
+		build
+	docker-compose -f docker-compose.yml \
+		-f itest/docker-compose.itest.yml \
+		up -d vaultwarden ldap
+	docker-compose -f docker-compose.yml \
+		-f itest/docker-compose.itest.yml \
+		run ldap_sync
+	docker-compose stop
 
 # Run bootstrapped integration test using env for config
 .PHONY: itest-env
 itest-env:
 	docker-compose -f docker-compose.yml \
 		-f itest/docker-compose.itest-env.yml \
-		up --build
+		build
+	docker-compose -f docker-compose.yml \
+		-f itest/docker-compose.itest-env.yml \
+		up -d vaultwarden ldap
+	docker-compose -f docker-compose.yml \
+		-f itest/docker-compose.itest-env.yml \
+		run ldap_sync
+	docker-compose stop
 
 .PHONY: clean-itest
 clean-itest:

README.md

@@ -1,7 +1,7 @@
 # vaultwarden_ldap
-An LDAP connector for [vaultwarden](https://github.com/dani-garcia/vaultwarden)
+LDAP user invites for [vaultwarden](https://github.com/dani-garcia/vaultwarden)
 
-After configuring, run `vaultwarden_ldap` and it will invite any users it finds in LDAP to your `vaultwarden` instance.
+After configuring, run `vaultwarden_ldap` and it will invite any users it finds in LDAP to your `vaultwarden` instance. This is NOT a sync tool like the [Bitwarden Directory Connector](https://bitwarden.com/help/directory-sync/).
 
 ## Deploying
 
@@ -44,7 +44,18 @@ For those less familiar with `cargo`, you can use the `make` targets that have b
 
 ## Testing
 
-All testing is manual right now. First step is to set up Bitwarden and the LDAP server.
+There are no unit tests, but there are integration tests that require manual verification.
+
+### Integration tests
+
+Running `make itest` will spin up an ldap server with a test user, a Vaultwarden server, and then run the sync. If successful the log should show an invitation sent to the test user. If you run `make itest` again, it should show no invites sent because the user already has been invited. If you'd like to reset the testing, `make clean-itest` will clear out the Vaultwarden database and start fresh.
+
+It's also possible to test passing configs via enviornment variables by running `make itest-env`. The validation steps are the same.
+
+
+### Steps for manual testing
+
+The first step is to set up Bitwarden and the LDAP server.
 
 ```bash
 docker-compose up -d vaultwarden ldap ldap_admin
@@ -74,8 +85,3 @@ docker-compose up ldap_sync
 Alternately, you can bootstrap some of this by running:
 
     docker-compose -f docker-compose.yml -f itest/docker-compose.itest.yml up --build
-
-## Future
-
-* Any kind of proper logging
-* Tests

docker-compose.yml

@@ -24,6 +24,7 @@ services:
       ADMIN_TOKEN: admin
       SIGNUPS_ALLOWED: 'false'
       INVITATIONS_ALLOWED: 'true'
+      I_REALLY_WANT_VOLATILE_STORAGE: 'true'
 
   ldap:
     image: osixia/openldap

itest/docker-compose.itest-env.yml

@@ -11,9 +11,9 @@ services:
       APP_LDAP_BIND_PASSWORD: "admin"
       APP_LDAP_SEARCH_BASE_DN: "dc=example,dc=org"
       APP_LDAP_SEARCH_FILTER: "(&(objectClass=*)(uid=*))"
-      APP_LDAP_SYNC_INTERVAL_SECONDS: 10
+      APP_LDAP_SYNC_LOOP: "false"
 
-  vaultwarden:
+  vaultwarden: {}
 
   ldap:
     command: ["--copy-service"]

itest/docker-compose.itest.yml

@@ -2,8 +2,10 @@
 version: '3'
 services:
   ldap_sync:
+    volumes:
+      - ./itest/config.toml:/config.toml:ro
 
-  vaultwarden:
+  vaultwarden: {}
 
   ldap:
     command: ["--copy-service"]

src/main.rs

@@ -1,5 +1,7 @@
 extern crate anyhow;
 extern crate ldap3;
+extern crate pledge;
+extern crate unveil;
 
 use std::collections::HashSet;
 use std::thread::sleep;
@@ -9,6 +11,8 @@ use anyhow::Context as _;
 use anyhow::Error as AnyError;
 use anyhow::Result;
 use ldap3::{DerefAliases, LdapConn, LdapConnSettings, Scope, SearchEntry, SearchOptions};
+use pledge::pledge;
+use unveil::unveil;
 
 mod config;
 mod vw_admin;
@@ -21,6 +25,16 @@ fn main() {
         config.get_vaultwarden_root_cert_file(),
     );
 
+    unveil(config::get_config_path(), "r")
+        .or_else(unveil::Error::ignore_platform)
+        .expect("Could not unveil config file");
+    unveil("", "")
+        .or_else(unveil::Error::ignore_platform)
+        .expect("Could not disable further unveils");
+    pledge("dns flock inet rpath stdio tty", "")
+        .or_else(pledge::Error::ignore_platform)
+        .expect("Could not pledge permissions");
+
     invite_users(&config, &mut client, config.get_ldap_sync_loop())
 }