Passbolt

Stack

Passbolt is a free and open source password manager designed for collaboration. With Passbolt you can securely generate, store, manage and monitor your team credentials. Get access to all of your logins and passwords from multiple browsers or even your mobile phone.

Configuration

Type

Compose

Platform

linux

Env vars

PUID=1000PGID=1000TZ=Europe/ZurichMYSQL_ROOT_PASSWORD=MYSQL_DATABASE=passboltMYSQL_USER=passboltMYSQL_PASSWORD=PASSBOLT_PORT=443PASSBOLT_URL=https://passbolt.localEMAIL_FROM_NAME=PassboltEMAIL_FROM_ADDRESS=EMAIL_SMTP_SERVER=smtp.gmail.comEMAIL_SMTP_PORT=587EMAIL_USERNAME=EMAIL_PASSWORD=EMAIL_TLS=true

Restart

unless-stopped

Source

Repo

Template by novaspirit·Source

Notes

Template created by Pi-Hosted Series
Check our Github page: https://github.com/pi-hosted/pi-hosted

Official Webpage: https://github.com/pi-hosted/pi-hosted/blob/master/docs/passbolt.md
Official Docker Documentation: https://github.com/pi-hosted/pi-hosted/blob/master/docs/passbolt.md

Pi-Hosted dedicated documentation: passbolt.md

Services

passbolt-db

Configuration

Image

linuxserver/mariadb:arm64v8-latest

Volumes

/config : /portainer/Files/AppData/Config/passbolt/db

Env vars

PUID=${PUID}PGID=${PGID}MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}MYSQL_DATABASE=${MYSQL_DATABASE}MYSQL_USER=${MYSQL_USER}MYSQL_PASSWORD=${MYSQL_PASSWORD}

Restart

unless-stopped

Image details

Pulls: 417.9M

User: linuxserver

Created: Oct 13, 2015

Updated: 11 days ago

Status: active

passbolt

Configuration

Image

passbolt/passbolt:latest-ce

Command

/usr/bin/wait-for.sh,-t,0,passbolt-db:3306,--,/docker-entrypoint.sh

Ports

${PASSBOLT_PORT}:443

Volumes

/etc/ssl/certs/certificate.crt : /portainer/Files/AppData/Config/passbolt/certs/cert.pem/etc/ssl/certs/certificate.key : /portainer/Files/AppData/Config/passbolt/certs/key.pem/etc/passbolt/gpg : gpg/etc/passbolt/jwt : jwt

Env vars

APP_FULL_BASE_URL=${PASSBOLT_URL}DATASOURCES_DEFAULT_HOST=passbolt-dbDATASOURCES_DEFAULT_USERNAME=${MYSQL_USER}DATASOURCES_DEFAULT_PASSWORD=${MYSQL_PASSWORD}DATASOURCES_DEFAULT_DATABASE=${MYSQL_DATABASE}EMAIL_DEFAULT_FROM_NAME=${EMAIL_FROM_NAME}EMAIL_DEFAULT_FROM=${EMAIL_FROM_ADDRESS}EMAIL_TRANSPORT_DEFAULT_HOST=${EMAIL_SMTP_SERVER}EMAIL_TRANSPORT_DEFAULT_PORT=${EMAIL_SMTP_PORT}EMAIL_TRANSPORT_DEFAULT_USERNAME=${EMAIL_USERNAME}EMAIL_TRANSPORT_DEFAULT_PASSWORD=${EMAIL_PASSWORD}EMAIL_TRANSPORT_DEFAULT_TLS=${EMAIL_TLS}

Restart

unless-stopped

Image details

Pulls: 27.4M

User: passbolt

Created: Jun 05, 2017

Updated: 9 days ago

Status: active

Standalone Install

Select an install method, to see config/commands for deploying Passbolt

Installation method

Docker Run

Docker Compose

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

Ensure both Docker and Portainer are installed, and up-to-date
Log into your Portainer web UI
Under Settings → App Templates, paste the below URL
Head to Home → App Templates, and the list of apps will show up
Select Passbolt, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json

Show Me

Original stackfile

The compose file this template deploys, straight from its repo:

version: "3.9"
services:
  passbolt-db:
    container_name: passbolt-db
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
    hostname: passbolt-db
    image: linuxserver/mariadb:arm64v8-latest
    networks:
      - passbolt_default
    restart: unless-stopped
    volumes:
      - /portainer/Files/AppData/Config/passbolt/db:/config

  passbolt:
    container_name: passbolt
    command:
      [
        "/usr/bin/wait-for.sh",
        "-t",
        "0",
        "passbolt-db:3306",
        "--",
        "/docker-entrypoint.sh",
      ]
    depends_on:
      - passbolt-db
    environment:
      APP_FULL_BASE_URL: ${PASSBOLT_URL}
      DATASOURCES_DEFAULT_HOST: passbolt-db
      DATASOURCES_DEFAULT_USERNAME: ${MYSQL_USER}
      DATASOURCES_DEFAULT_PASSWORD: ${MYSQL_PASSWORD}
      DATASOURCES_DEFAULT_DATABASE: ${MYSQL_DATABASE}
      EMAIL_DEFAULT_FROM_NAME: ${EMAIL_FROM_NAME}
      EMAIL_DEFAULT_FROM: ${EMAIL_FROM_ADDRESS}
      EMAIL_TRANSPORT_DEFAULT_HOST: ${EMAIL_SMTP_SERVER}
      EMAIL_TRANSPORT_DEFAULT_PORT: ${EMAIL_SMTP_PORT}
      EMAIL_TRANSPORT_DEFAULT_USERNAME: ${EMAIL_USERNAME}
      EMAIL_TRANSPORT_DEFAULT_PASSWORD: ${EMAIL_PASSWORD}
      EMAIL_TRANSPORT_DEFAULT_TLS: ${EMAIL_TLS}
    hostname: passbolt
    image: passbolt/passbolt:latest-ce
    networks:
      - passbolt_default
    ports:
    #  - 80:80
      - ${PASSBOLT_PORT}:443
    restart: unless-stopped
    volumes:
      - /portainer/Files/AppData/Config/passbolt/certs/cert.pem:/etc/ssl/certs/certificate.crt:ro
      - /portainer/Files/AppData/Config/passbolt/certs/key.pem:/etc/ssl/certs/certificate.key:ro
      - gpg:/etc/passbolt/gpg
      - jwt:/etc/passbolt/jwt

networks:
  passbolt_default:
      name: passbolt
      driver: bridge
  
volumes:
  gpg:
  jwt:

Or deploy it directly from the source:

git clone https://github.com/pi-hosted/pi-hosted
cd pi-hosted
docker compose -f stack/passbolt.yml up -d

More install options in our documentation.

Container Documentation

passbolt-db Documentation

A Mariadb container, brought to you by LinuxServer.io.

passbolt Documentation

passbolt, password manager for teams

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

In Portainer, go to Containers, click the container, then Logs. Or run docker logs <container>
Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

Fix the ownership: sudo chown -R ${PUID}:${PGID} /portainer/Files/AppData/Config/passbolt/db (and the same for the other mapped folders)
Or set the PUID and PGID variables (defaults ${PUID}:${PGID}) to match your own user, found with id $USER

Image won't pull

Test the pull directly on the host: docker pull linuxserver/mariadb:arm64v8-latest

"manifest unknown" means the tag no longer exists.
"toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
"no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

Check the logs right after a restart, the last few lines before it died are the useful ones.
Get the exit code with docker inspect <container> --format '{{.State.ExitCode}}'
Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Stack won't deploy

Compose stacks fail fast on small mistakes, and Portainer shows the reason just above the editor.

YAML only accepts spaces for indentation, a single tab breaks the whole file.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

Bug within the app: Open an issue within Passbolt's repo
Template not working: Open an issue on novaspirit/pi-hosted
This website not working: Open an issue on lissy93/portainer-templates

A Compose stack

Passbolt is a Compose stack, a set of containers (2 of them) defined in one file and brought up together by Portainer, then started and stopped as a single app.

The services

This stack is built from 2 containers that run side by side. Here's each one, with the image it runs and anything it waits for first:

passbolt-db runs linuxserver/mariadb:arm64v8-latest
passbolt runs passbolt/passbolt:latest-ce, starts after passbolt-db

Volumes

A volume is where Passbolt keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

/config from /portainer/Files/AppData/Config/passbolt/db on the host
/etc/ssl/certs/certificate.crt from /portainer/Files/AppData/Config/passbolt/certs/cert.pem on the host
/etc/ssl/certs/certificate.key from /portainer/Files/AppData/Config/passbolt/certs/key.pem on the host
/etc/passbolt/gpg kept in the gpg volume Docker manages
/etc/passbolt/jwt kept in the jwt volume Docker manages

Environment variables

Environment variables are the settings you hand over when you deploy, things like a password or a timezone. Passbolt takes 18 of them, all with defaults you can leave alone or tweak:

PUID, pulled from your own environment
PGID, pulled from your own environment
MYSQL_ROOT_PASSWORD, pulled from your own environment
MYSQL_DATABASE, pulled from your own environment
MYSQL_USER, pulled from your own environment
MYSQL_PASSWORD, pulled from your own environment
APP_FULL_BASE_URL, pulled from your own environment
DATASOURCES_DEFAULT_HOST, defaults to passbolt-db
DATASOURCES_DEFAULT_USERNAME, pulled from your own environment
DATASOURCES_DEFAULT_PASSWORD, pulled from your own environment
DATASOURCES_DEFAULT_DATABASE, pulled from your own environment
EMAIL_DEFAULT_FROM_NAME, pulled from your own environment
EMAIL_DEFAULT_FROM, pulled from your own environment
EMAIL_TRANSPORT_DEFAULT_HOST, pulled from your own environment
EMAIL_TRANSPORT_DEFAULT_PORT, pulled from your own environment
EMAIL_TRANSPORT_DEFAULT_USERNAME, pulled from your own environment
EMAIL_TRANSPORT_DEFAULT_PASSWORD, pulled from your own environment
EMAIL_TRANSPORT_DEFAULT_TLS, pulled from your own environment

Restart policy

The restart policy here is unless-stopped, so Docker restarts Passbolt after a crash or reboot, but leaves it off when you stop it on purpose. You can change this on the deploy screen. The choices are no (never restart), on-failure (only after a crash), unless-stopped (restart unless you stop it), and always (bring it back no matter what).

Users and permissions

The PUID and PGID settings tell it which user and group to act as on your host. Point them at your own account (find yours with id $USER) so the files it writes into your mounted folders come out owned by you rather than root.

Networking

Portainer puts these services on one shared private network, so they can find each other by name (like passbolt-db) while only the ports above are open to you.

Platform

The platform is linux, the kind of system the container is built to run on. Docker and Portainer handle this on a normal Linux server.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set Passbolt up. Add the template list to Portainer once, then deploying Passbolt is a click rather than a wall of config.

Passbolt

Configuration

Notes

Pi-Hosted dedicated documentation: passbolt.md

Services

passbolt-db

Configuration

Image details

passbolt

Configuration

Image details

Standalone Install

Install on Portainer

Template Import URL

Container Documentation

passbolt-db Documentation

passbolt Documentation

Troubleshooting

Check the logs first

Permission denied on volumes

Image won't pull

"exec format error"

Container keeps restarting

Stack won't deploy

Raise an issue

Config glossary

A Compose stack

The services

Volumes

Environment variables

Restart policy

Users and permissions

Networking

Platform

Portainer app templates

Similar apps