Separate config and data import volumes (#129)

- Fixes some issues causing a Gradle deprecation warnings
- Adds user and group to the Docker image
- Adds new folder for external configuration
- Defines ownership and access control for the folders where import and config can be attached
- Updates Java version to 17 in preparation for the major update in Lowkey Vault
- Updates Lowkey Vault version to latest

Signed-off-by: Esta Nagy <nagyesta@gmail.com>

.github/workflows/gradle-ci.yml

@@ -24,18 +24,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
-      - name: Set up JDK 11
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Set up JDK 17
         uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
         with:
-          java-version: '11'
+          java-version: '17'
           distribution: 'temurin'
       - # Add support for more platforms with QEMU (optional)
         # https://github.com/docker/setup-qemu-action
         name: Set up QEMU
-        uses: docker/setup-qemu-action@61d34a9892a42ed0e88fb4bd0346c17742c45bf7
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2
+        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
       - name: Build with Gradle
         uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c # v2.7.0
         with:

.github/workflows/gradle.yml

@@ -24,18 +24,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
-      - name: Set up JDK 11
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Set up JDK 17
         uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
         with:
-          java-version: '11'
+          java-version: '17'
           distribution: 'temurin'
       - # Add support for more platforms with QEMU (optional)
         # https://github.com/docker/setup-qemu-action
         name: Set up QEMU
-        uses: docker/setup-qemu-action@61d34a9892a42ed0e88fb4bd0346c17742c45bf7
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2
+        uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
       - name: Build with Gradle
         uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c # v2.7.0
         with:

README.md

@@ -12,4 +12,3 @@ This is an auxiliary project for [Lowkey Vault](https://github.com/nagyesta/lowk
 different architectures.
 
 Please refer to the [Lowkey Vault](https://github.com/nagyesta/lowkey-vault) project for usage.
-

build.gradle

@@ -4,7 +4,6 @@ plugins {
 }
 
 group = 'com.github.nagyesta'
-sourceCompatibility = '11'
 
 project.ext {
     gitUser = project.hasProperty('githubUser') ? (project.property('githubUser') as String) : ''
@@ -58,6 +57,10 @@ dependencies {
     lowkey libs.lowkey.vault.app
 }
 
+java {
+    sourceCompatibility = JavaVersion.VERSION_17
+}
+
 tasks.register('copyDockerfile', Copy) {
     inputs.file("src/docker/Dockerfile")
     outputs.file("${buildDir}/docker/Dockerfile")

gradle/libs.versions.toml

@@ -1,6 +1,6 @@
 [versions]
 # Warning: this file is used as build trigger, do not add anything else here!
-lowkeyVault = "1.29.3"
+lowkeyVault = "1.30.0"
 
 [libraries]
 lowkey-vault-app = { module = "com.github.nagyesta.lowkey-vault:lowkey-vault-app", version.ref = "lowkeyVault" }

src/docker/Dockerfile

@@ -2,6 +2,16 @@ FROM eclipse-temurin:11.0.20_8-jre-jammy
 LABEL maintainer="nagyesta@gmail.com"
 EXPOSE 8443:8443
 ADD lowkey-vault.jar /lowkey-vault.jar
+RUN addgroup --system lowkey && adduser --system lowkey --ingroup lowkey
+RUN chown -R lowkey:lowkey "/lowkey-vault.jar"
+RUN chmod 555 "/lowkey-vault.jar"
 RUN mkdir "/import"
+RUN chown -R lowkey:lowkey "/import"
+RUN chmod 755 "/import"
+RUN mkdir "/config"
+RUN chown -R lowkey:lowkey "/config"
+RUN chmod 555 "/config"
+USER lowkey
+WORKDIR /
 CMD [ "sh", "-c", "ls /" ]
 ENTRYPOINT ["sh", "-c", "java ${JAVA_OPTS} -jar /lowkey-vault.jar ${LOWKEY_ARGS}"]