Passbolt Mobile App Setup Guide with Cloudflare Tunnel
Hi all,
I’ve been testing the self-hosting feature for Passbolt and Cloudflare, and one of the issues I came across was what’s discussed in this post.
After some trial and error using Claude AI, I’ve managed to get the mobile app working using a Cloudflare tunnel. For this, I added Cloudflare to the docker-compose file included in this post.
Now I need to clarify: I don’t know if this limits the security or if this setup contains some “not done” elements. I’m just someone who likes to tinker until I get it working.
But using the steps provided by Claude AI, it worked for me.
Hopefully someone will be helped by this, and if I did something not done, feedback is always helpful.
My Full Docker File
services:
db:
image: mariadb:10.11
restart: unless-stopped
environment:
MYSQL_RANDOM_ROOT_PASSWORD: "true"
MYSQL_DATABASE: "passbolt"
MYSQL_USER: "passbolt"
MYSQL_PASSWORD: "P4ssb0lt"
volumes:
- database_volume:/var/lib/mysql
passbolt:
image: passbolt/passbolt:latest-ce
restart: unless-stopped
depends_on:
- db
environment:
APP_FULL_BASE_URL: https://your-server-URL.com
PASSBOLT_SSL_FORCE: 1
PASSBOLT_SECURITY_SET_HEADERS: 0
DATASOURCES_DEFAULT_HOST: "db"
DATASOURCES_DEFAULT_USERNAME: "passbolt"
DATASOURCES_DEFAULT_PASSWORD: "P4ssb0lt"
DATASOURCES_DEFAULT_DATABASE: "passbolt"
EMAIL_DEFAULT_FROM_NAME: "Passbolt"
EMAIL_DEFAULT_FROM: "Your Mail"
EMAIL_TRANSPORT_DEFAULT_HOST: "SMTP Host"
EMAIL_TRANSPORT_DEFAULT_PORT: "Port"
EMAIL_TRANSPORT_DEFAULT_USERNAME: "Your Mail Username"
EMAIL_TRANSPORT_DEFAULT_PASSWORD: "Your Mail Password"
volumes:
- gpg_volume:/etc/passbolt/gpg
- jwt_volume:/etc/passbolt/jwt
command:
[
"/usr/bin/wait-for.sh",
"-t",
"0",
"db:3306",
"--",
"/docker-entrypoint.sh",
]
ports:
- 80:80
- 443:443
#Alternatively for non-root images:
# - 80:8080
# - 443:4433
cloudflared:
image: cloudflare/cloudflared:latest
restart: unless-stopped
command: tunnel --no-autoupdate run --token <Insert Token>
volumes:
database_volume:
gpg_volume:
jwt_volume:
Prerequisites
-
Passbolt instance running in Docker
-
Cloudflare Tunnel configured and running
-
Access to Cloudflare Dashboard
-
Docker and docker-compose installed
Part 1: Generate JWT Authentication Keys
The mobile app requires JWT (JSON Web Token) authentication. You need to generate the required key pair.
Step 1: Enter the Passbolt Container
docker exec -it <passbolt-container-name> bash
Replace <span class="editor-theme-code"><passbolt-container-name></span> with your actual container name (find it using <span class="editor-theme-code">docker ps</span>).
Step 2: Create JWT Directory
mkdir -p /etc/passbolt/jwt
Step 3: Generate Private Key
openssl genpkey -out /etc/passbolt/jwt/jwt.key -algorithm RSA -pkeyopt rsa_keygen_bits:2048
Step 4: Generate Public Key
openssl rsa -in /etc/passbolt/jwt/jwt.key -pubout -out /etc/passbolt/jwt/jwt.pem
Step 5: Set Proper Permissions
chown www-data:www-data /etc/passbolt/jwt/jwt.key /etc/passbolt/jwt/jwt.pem
chmod 640 /etc/passbolt/jwt/jwt.key
chmod 644 /etc/passbolt/jwt/jwt.pem
Step 6: Exit Container
exit
Step 7: Verify Keys Were Created
docker exec <passbolt-container-name> ls -la /etc/passbolt/jwt/
You should see:
-
jwt.key private key
-
jwt.pem (public key)
Part 2: Update Docker Compose Configuration
Step 1: Add Volume Mounts for JWT Keys
Edit your docker-compose.yml file and add the JWT volume mount:
services:
passbolt:
image: passbolt/passbolt:latest
volumes:
- passbolt_data:/var/www/passbolt/data
- passbolt_jwt:/etc/passbolt/jwt # Add this line
environment:
- APP_FULL_BASE_URL=https://your-server-URL.com
- PASSBOLT_SSL_FORCE=true
- PASSBOLT_SECURITY_SET_HEADERS=false
# ... rest of your configuration
volumes:
passbolt_data:
passbolt_jwt:
Step 2: Restart Passbolt
docker-compose restart passbolt
Or if using standalone Docker:
docker restart <passbolt-container-name>
Part 3: Configure Cloudflare Tunnel Settings
Step 1: Access Cloudflare Dashboard
-
Go to Cloudflare Dashboard
-
Navigate to Zero Trust → Access → Tunnels
Step 2: Configure Your Tunnel
-
Find your tunnel in the list
-
Click Configure
-
Locate the Public Hostname for your server URL.com
Step 3: Update HTTP Settings
Under Additional application settings → HTTP Settings, configure:
-
No TLS Verify - Enable this if using self-signed certificates internally
-
HTTP Host Header - Set to your server URL .com
-
Origin Server Name - Set to your server URL .com
Also set the IP to that of the Passbolt docker container
Step 4: Save Changes
Click Save to apply the tunnel configuration changes.
Part 4: Security Recommendations
Rotate Your Cloudflare Tunnel Token
Important: If your tunnel token has been exposed, rotate it immediately:
-
In Cloudflare Dashboard, go to your tunnel settings
-
Click on your tunnel
-
Select Configure
-
Find the option to regenerate/rotate the token
-
Update your docker-compose.yml with the new token:
cloudflared:
image: cloudflare/cloudflared:latest
restart: unless-stopped
command: tunnel --no-autoupdate run --token <NEW_TOKEN_HERE>
- Restart the cloudflared container:
docker-compose restart cloudflared
Part 5: Testing
Step 1: Test Mobile App Connection
-
Open the Passbolt mobile app
-
Enter your server URL: https:// your server URL .com
-
Attempt to log in with your credentials
