Skip to content

Commit

Permalink
7 add some documentation about setting up systemd creds (#8)
Browse files Browse the repository at this point in the history
* Update the title for the systemd part

* Add a page about the systemd-creds password registration

* Add some missing links
  • Loading branch information
Peltoche authored Mar 7, 2024
1 parent 5a24a4a commit 5d1cadf
Show file tree
Hide file tree
Showing 4 changed files with 71 additions and 2 deletions.
5 changes: 5 additions & 0 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,3 +33,8 @@ open-source developer a product ensure itself a more stable and perennial suppor

At home on your own hardware or in the cloud you trust, DuckCloud have an easy installation and its maintenance
process.


[1]: https://en.wikipedia.org/wiki/Dropbox
[2]: https://en.wikipedia.org/wiki/Microsoft_365
[3]: https://en.wikipedia.org/wiki/Google_Drive
3 changes: 2 additions & 1 deletion docs/installation-guide/introduction.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ The installation process require several steps:

- [Install the binary](./packages/package-managers.md)
- [Setup a reverse proxy](./proxies/why-use-a-proxy.md)
- [Setup Systemd](./systemd.md)
- [Start/Enable the systemd service](./systemd.md)
- [Register your password to allow an automatic restart](./password.md) (optional)


!!! example ""
Expand Down
63 changes: 63 additions & 0 deletions docs/installation-guide/password.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# Register your password


You can let [systemd](https://systemd.io/CREDENTIALS/) and [systemd-creds](https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.html)
handle your master password.

### Why ?

All the files handled by Duckcloud are encrypted with a master password provided by you. Without it Duckcloud can't function
properly as it can't read your files. For security reasons the master password is only kept encrypted in memory. So if the
server stops or your machine restarts the memory is lost and so is the ability to Duckcloud to read your files. That's why
you needs to give your password after each restart.

This manual step can be very tedious as it make your service unoperable after each restart until an admin have put the password. That's why we
propose a secure way to do it automatically.


!!! danger "Security note"
You should register your password only if you trust your machine and the people on it. Everyone one with root access can easily seen your password in clear.


### How ?


#### Stop the service

First you needs to stop the service:

!!! Run
```
sudo systemctl stop duckcloud.service
```

#### Generate the credentials:

The credentials are handled by [systemd](https://systemd.io/CREDENTIALS/) and the [systemd-creds](https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.html) command.
This tooling allows to keep your password encrypted by using the [Trusted Platform Module](https://en.wikipedia.org/wiki/Trusted_Platform_Module) if available.

This command needs to be run with the root permissions:

!!! Run
```bash
systemd-ask-password -n | systemd-creds encrypt --name=password - /etc/duckcloud/password.cred
```

#### Enable the credentials:

You need to indicate to systemd that it needs to load the credentials previously generated. For that you needs
to uncomment a line inside `/usr/lib/systemd/system/duckcloud.service`:

!!! Run
```bash
```


#### Restart the service

Finally you can to start again the service:

!!! Run
```
sudo systemctl start duckcloud.service
```
2 changes: 1 addition & 1 deletion docs/installation-guide/systemd.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Systemd configuration
# Start/Enable the systemd service


Duckcloud lifecycle is managed by [Systemd service manager](https://systemd.io/) this bring several advantages:
Expand Down

0 comments on commit 5d1cadf

Please sign in to comment.