growilabs/vault-manager repository overview

⁠GROWI Vault Manager Official docker image

⁠Supported tags and respective Dockerfile links

• 1.1.0, 1.1, 1, latest (Dockerfile)⁠
• 1.0.0, 1.0 (Dockerfile)⁠

⁠What is GROWI Vault?

GROWI Vault turns a GROWI⁠ wiki into a git repository. Users git clone it and get their pages as a tree of Markdown files, so the wiki can be searched with grep, opened in an editor, and handed to AI agents that work on files. git pull brings the working copy up to date.

Each clone contains exactly the pages that user is allowed to read — pages they have no access to are not merely hidden, they leave no trace in the tree or in the refs. The vault is read-only: git push is rejected, and attachments, comments, likes and tags are not exported.

This image is the engine behind that feature. It is not a standalone application and it is not what users clone from: it runs beside the GROWI app container, maintains the bare git repository, and serves git upload-pack for clone traffic that the GROWI app proxies to it. All GROWI domain knowledge (access control, token authentication, group resolution) stays in the app — this container only knows about namespaces and the git protocol.

see: GROWI Docs: GROWI Vault⁠

⁠Requirements

• GROWI >= 8.0.0 (growilabs/growi:8), started with the Vault feature enabled
• MongoDB (>= 6.0) running as a replica set
  • The vault is kept up to date through a MongoDB change stream, which a standalone server does not provide. A single-node replica set is enough.
• A persistent filesystem for the bare repository, shared with the GROWI app container
  • This container starts as root only long enough to create and chown that directory, then drops to the node user (uid/gid 1000) — the same uid the GROWI app runs as — so both containers can use one volume.

⁠Usage

⁠docker-compose

Using docker-compose is the fastest and the most convenient way to boot GROWI Vault, because the app, MongoDB and this container have to be wired together.

see: growilabs/growi-docker-compose — examples/growi-vault⁠

⁠docker run

Start this container against a MongoDB replica set:

docker run -d \
    -e MONGO_URI=mongodb://MONGODB_HOST:MONGODB_PORT/growi?replicaSet=rs0 \
    -e VAULT_MANAGER_INTERNAL_SECRET=CHANGE_THIS \
    -e VAULT_REPO_PATH=/data/vault-repo.git \
    -v growi_data:/data \
    growilabs/vault-manager

and point the GROWI app at it, with the same secret:

docker run -d \
    -e MONGO_URI=mongodb://MONGODB_HOST:MONGODB_PORT/growi?replicaSet=rs0 \
    -e VAULT_ENABLED=true \
    -e VAULT_MANAGER_ENDPOINT=http://VAULT_MANAGER_HOST:3001 \
    -e VAULT_MANAGER_INTERNAL_SECRET=CHANGE_THIS \
    -v growi_data:/data \
    growilabs/growi:8

The vault starts out empty. Run the initial import once from the admin screen at /admin/vault; after that every page change is picked up automatically. Users then clone from the GROWI app, not from this container:

git clone https://your-growi.example.com/vault.git

see: GROWI Docs: Setting up GROWI Vault⁠

⁠Configuration

⁠Environment Variables

Read by this container:

Read by the GROWI app container, to reach this one:

The tuning variables for bootstrap retries, drift detection, reconcile and garbage collection are listed under "GROWI Vault options" in GROWI Docs: Environment Variables⁠.

Keep VAULT_MANAGER_INTERNAL_SECRET out of version control and out of your logs, and use a value that cannot be guessed.

⁠Health check

GET /health returns 200 {"status":"ok"} once MongoDB is connected and the bare repository is accessible, and 503 with the failing check otherwise. It requires no credentials, so it can be used as a Kubernetes liveness probe.

⁠Issues

If you have any issues or questions about this image, please contact us through GitHub issue⁠.