DEV Community

Cover image for Deploying Passbolt Team Password Manager on Ubuntu 24.04
Vultr profile image Sanskriti Harmukh
Sanskriti Harmukh for Vultr

Posted on with Aashish Chaurasiya • Originally published at docs.vultr.com

Deploying Passbolt Team Password Manager on Ubuntu 24.04

#docker #security #selfhosted #devops

Passbolt CE is an open-source, end-to-end encrypted password manager built for teams, with browser extensions and a web interface for secure credential sharing. This guide deploys Passbolt with a MariaDB backend using Docker Compose, with Traefik handling automatic HTTPS, then registers the first administrator. By the end, you'll have Passbolt running securely at your domain with the first admin account ready.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/passbolt/{db,gpg,letsencrypt}
$ sudo chown -R 33:33 ~/passbolt/gpg
$ cd ~/passbolt
Enter fullscreen mode Exit fullscreen mode

2. Create the environment file:

$ nano .env
Enter fullscreen mode Exit fullscreen mode 
DOMAIN=passbolt.example.com
LETSENCRYPT_EMAIL=admin@example.com

MYSQL_USER=passbolt
MYSQL_PASSWORD=STRONG_DB_PASSWORD
MYSQL_DATABASE=passbolt
Enter fullscreen mode Exit fullscreen mode

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker
Enter fullscreen mode Exit fullscreen mode

2. Create the Docker Compose manifest:

$ nano docker-compose.yml
Enter fullscreen mode Exit fullscreen mode 
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  db:
    image: mariadb:latest
    container_name: passbolt-db
    restart: unless-stopped
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    volumes:
      - ./db:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: passbolt
    restart: unless-stopped
    depends_on:
      - db
    environment:
      - APP_FULL_BASE_URL=https://${DOMAIN}
      - DATASOURCES_DEFAULT_HOST=db
      - DATASOURCES_DEFAULT_USERNAME=${MYSQL_USER}
      - DATASOURCES_DEFAULT_PASSWORD=${MYSQL_PASSWORD}
      - DATASOURCES_DEFAULT_DATABASE=${MYSQL_DATABASE}
    volumes:
      - ./gpg:/etc/passbolt/gpg
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passbolt.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.passbolt.entrypoints=websecure"
      - "traefik.http.routers.passbolt.tls=true"
      - "traefik.http.routers.passbolt.tls.certresolver=le"
      - "traefik.http.services.passbolt.loadbalancer.server.port=80"
Enter fullscreen mode Exit fullscreen mode

3. Start the services:

$ docker compose up -d
Enter fullscreen mode Exit fullscreen mode

4. Verify the services are running:

$ docker compose ps
Enter fullscreen mode Exit fullscreen mode

Create the First Administrator

Register the first admin account using Passbolt's CLI inside the container:

$ docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user -u admin@example.com -f FIRSTNAME -l LASTNAME -r admin" -s /bin/sh www-data
Enter fullscreen mode Exit fullscreen mode

The command prints a one-time setup URL. Open it in a browser, install the Passbolt browser extension, and complete the account creation flow.

Next Steps

Passbolt is running and served securely over HTTPS. From here you can:

  • Invite team members and organize credentials into shared groups
  • Configure SMTP for invitation and notification emails
  • Enable MFA (TOTP, YubiKey, or DUO) for admin and team accounts

For the full guide with additional tips, visit the original article on Vultr Docs.

Top comments (0)