How To: Password Pusher Complete Setup with Docker

Password Pusher (https://pwpush.com) is a free and open source password sharing website. The concept is simple – enter in a password, choose your expiration options, and click ‘Push It!’

A secure link and QR code are then generated for you to securely share the password with friends/family/coworkers/customers/etc.

This is much more secure than sending passwords in clear text through text messages, emails, or instant messaging applications. And, it expires, so it’s not living out there in the world forever. We use Password Pusher all the time for secure password sharing in our business, and we even built Password Pusher into Rogue Support so that we can send and receive passwords securely.

And you may be thinking – “Hey – why the heck would I put my password into some random website – isn’t that inherently insecure??”

I mean…it could be insecure – but first of all, you’re just sharing a password. You’re not sharing a username, nor are you sharing which website, application, or service the password belongs to.

Password Pusher also gives you the option of setting up a passphrase when you create the link to secure it down even further.

And on top of all of that, it’s open source – you can review all of the source code HERE.

Now – if all of that STILL doesn’t convince you that Password Pusher is a quick, easy and secure way of sharing passwords, then you can also host your own instance of Password Pusher in a Docker container, and that’s what we’re going to cover in this article. Let’s get started!

You’ll need a few things for this project:

• A bare metal or cloud hosted server running Docker
• A Fully Qualified Domain Name (FQDN) for your Password Pusher instance

That’s it! I’ll be using Vultr to create my server in the cloud since they have a very easy 1-click Docker server. But you could also use any cloud hosted service provider where you can spin up a server and install Docker such as Digital Ocean or one of the many other options. You could even install this on your own local server, or on a NAS device that supports Docker – but keep in mind you’ll have to port forward the necessary ports through your firewall, which is something I’m not going to be covering in this article.

I’m going to be using the FQDN ‘pwpush.crosstalknetworking.com’ – you’ll need access to modify the DNS (A-record) of your domain for this tutorial. That should be pretty straight forward with any DNS hosting provider.

Logging into Vultr, first click ‘Deploy –> Deploy New Server’ in the upper right-hand corner. Password Pusher is extremely light on resources, so we can pick the cheapest server type which is ‘Cloud Compute – Shared CPU.’

Next pick a server location – typically you’d want one geographically close to you:

Under ‘Choose Image,’ click on ‘Marketplace Apps’ and search for Docker. Click on the Docker app when it appears.

Under ‘Choose Plan,’ ‘Regular Cloud Compute’ and the 25 GB SSD option is cheapest at $5.00/mo. Or you can do ‘AMD High Performance’ 25 GB NVMe for $6.00/mo. You shouldn’t need more power than that for this application.

Under ‘Additional Features’ you can optionally turn off Auto Backups. This server doesn’t retain any data, so if it dies, crashes, or if you lose everything – you’ve really lost nothing. Just go through these directions again and spin up a new server.

And considering that last setting just saved you $12.00 or more per year, feel free to buy me a beer for writing this tutorial!

Under ‘Server Settings,’ choose an SSH Key for secure authentication, or create one if you don’t already have one in Vultr.

Finally, enter in your FQDN for ‘Server Hostname’ and ‘Server Label’ at the bottom of the screen and click ‘Deploy Now.’

The server should only take a moment to deploy, and then you’ll see your server’s IP address. Copy the server’s IP address and let’s take this time to go create our DNS A-Record.

Log into your DNS hosting provider – in my case, I’m using Cloudflare, but this process should be similar for any DNS hosting provider. You just need to find where you can create an A record for your domain.

In my case, the domain is ‘crosstalknetworking.com’ and the A-Record I’m creating is pwpush.crosstalknetworking.com which points to my IP address of 66.42.76.149.

Save your DNS record and by the time we’re ready to browse to our Password Push server, it should be good to go.

Next, log into your newly created Docker server via SSH. You’ll need to use your SSH private key for authentication and you’ll want to log in as user ‘root’ when prompted.

Once you’re in, let’s start by making sure our server is fully up to date with this command:

apt update && apt update -y

This shouldn’t take too long, and if you’re prompted with any messages, read what they say and follow the instructions:

Once updated, let’s create a folder for pwpush and download the necessary files.

mkdir pwpush
cd pwpush
wget https://docs.pwpush.com/assets/files/docker-compose-pwpush.yml
wget https://docs.pwpush.com/assets/files/Caddyfile

The full documentation for installing Password Pusher on your own server is HERE.

The two files that we downloaded are our Docker Compose file – or the configuration file which tells Docker about the two containers we’re downloading as part of this server, and the second file is the Caddyfile which contains our configuration info for our Let’s Encrypt cert so that we can access our Password Push server securely with HTTPS and a valid certificate.

We’ll start by editing the Caddyfile:

nano Caddyfile

I have outlined in red the two items you need to change in this file. The first is your email address, and the second is your FQDN. Change those two items and then save and exit the file with CTRL+X followed by Y.

Now we can fire up our Docker container!

docker compose -f docker-compose-pwpush.yml up -d

That command should take a moment to run – it takes longer the first time since it’ll have to download the containers. But give it about a minute, and then you should be able to browse to your Password Pusher server in a browser.

At this point, you can play around with Password Pusher to get a feel for how it works – BUT – we’re not done quite yet.

Let’s secure down our server with the ufw firewall. I’m going to add 2 rules to the firewall before I turn it on. I need to allow through HTTPS port 443 and I also want to lock down my SSH port so that only my WAN IP can access it. You may have additional rules you want to add if you’re planning on running other services on this server, or if you need to access it via SSH from multiple locations.

First, let’s check what ufw has already:

ufw status

What this is telling us is that currently, ufw has firewall rules allowing SSH port 22 from anywhere in the world – we’ll lock that down a bit (but of course, customize this to your own level of comfort).

ufw allow from x.x.x.x/32 to any port 22

Replace the x.x.x.x/32 with your WAN IP address information. You can check your own WAN IP address by browsing to https://whatismyip.com.

Now add a rule for HTTPS port 443:

ufw allow https

Let’s check status again with ‘ufw status’:

So notice here that we have SSH port 22 open to anywhere AND open to our WAN IP address – we can now remove the 2 rules opening up SSH port 22 to anywhere.

ufw status numbered

This shows us our rules again, but numbered for easy removal.

Now run these commands, but replace the numbers I use with the numbers show on your own server. HINT: if you remove the numbers from the bottom up, it prevents them from re-arranging.

ufw delete 4
ufw delete 1

You’ll have to confirm each of these commands as you run them. Once you’re done with that, run ‘ufw status’ again to ensure the rules look good, and then enable the firewall:

ufw enable

Currently, if we reboot the server, our Docker containers won’t restart when the server comes back up – let’s fix that.

nano docker-compose-pwpush.yml

OPTIONAL: You can comment out (add a # in front of) the very first line ‘version: ‘2.1” – this is a deprecated setting that causes a warning when you restart Docker.

Scroll down to the first Docker container in the list ‘pwpush’ and add ‘restart: always’ right below the ‘image’ line – keep in mind that YML files are VERY picky about syntax, so ensure that the ‘restart: always’ lines up perfectly with ‘image.’

Scroll down and do the same thing for the ‘ssl_proxy’ container:

Once you’ve made these changes, do CTRL+X followed by Y to save and exit.

Now reload these changes into Docker:

docker compose -f docker-compose-pwpush.yml up -d

Next, reboot the server with a ‘reboot’ and your Password Pusher services should come back up automatically!

Congrats! You’re all done!

Remember you can buy me a beer (or a coffee) here: