Deploying Passbolt Team Password Manager on Ubuntu 24.04

Passbolt CE is an open-source, end-to-end encrypted password manager built for teams, with browser extensions and a web interface for secure credential sharing. This guide deploys Passbolt with a MariaDB backend using Docker Compose, with Traefik handling automatic HTTPS, then registers the first administrator. By the end, you'll have Passbolt running securely at your domain with the first admin account ready.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/passbolt/{db,gpg,letsencrypt}
$ sudo chown -R 33:33 ~/passbolt/gpg
$ cd ~/passbolt

2. Create the environment file:

$ nano .env

DOMAIN=passbolt.example.com
LETSENCRYPT_EMAIL=admin@example.com

MYSQL_USER=passbolt
MYSQL_PASSWORD=STRONG_DB_PASSWORD
MYSQL_DATABASE=passbolt

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  db:
    image: mariadb:latest
    container_name: passbolt-db
    restart: unless-stopped
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    volumes:
      - ./db:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: passbolt
    restart: unless-stopped
    depends_on:
      - db
    environment:
      - APP_FULL_BASE_URL=https://${DOMAIN}
      - DATASOURCES_DEFAULT_HOST=db
      - DATASOURCES_DEFAULT_USERNAME=${MYSQL_USER}
      - DATASOURCES_DEFAULT_PASSWORD=${MYSQL_PASSWORD}
      - DATASOURCES_DEFAULT_DATABASE=${MYSQL_DATABASE}
    volumes:
      - ./gpg:/etc/passbolt/gpg
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passbolt.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.passbolt.entrypoints=websecure"
      - "traefik.http.routers.passbolt.tls=true"
      - "traefik.http.routers.passbolt.tls.certresolver=le"
      - "traefik.http.services.passbolt.loadbalancer.server.port=80"

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps

Create the First Administrator

$ docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user -u admin@example.com -f FIRSTNAME -l LASTNAME -r admin" -s /bin/sh www-data