Deploying a Secure Self-Hosted Password Manager with Psono and Docker

As the University of Calgary Cybersecurity Club, also known as CYBERSEC, continues to grow — now with around 30 members — the need for a more efficient and secure method to store credentials has become evident.

Previously, we stored all of our credentials in a shared Bitwarden vault. While this solution worked, it introduced several challenges. Most notably, compromising the master key would jeopardize the entire organization. Additionally, we aim to follow the principle of “least privilege” access, streamline the onboarding and offboarding of members, and have better forensic capabilities in case of a breach.

After some research, we decided to implement our own instance of Psono. We’ll primarily follow Psono’s official documentation, making modifications where necessary and highlighting important notes along the way.

Prerequisites

You must have Docker Engine installed. If you don’t already have it, follow the official Docker documentation.

Step 1: Set Up the PostgreSQL Database

We’ll start by running PostgreSQL in a Docker container:

First create a volume folder for your data:

sudo mkdir -p /opt/docker/psono/postgres

Second, run the database:

docker run --name psono-database \
 -v /opt/docker/psono/postgres:/var/lib/postgresql/data \
 -e POSTGRES_USER=$POSTGRES_USER \
 -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD \
 -d --restart=unless-stopped \
 -p 5432:5432 postgres:13-alpine

It’s recommended to store sensitive information like POSTGRES_USER and POSTGRES_PASSWORD in a .env file.

Step 2: Generate the Required Keys

docker run --rm -ti psono/psono-combo:latest python3 ./psono/manage.py generateserverkeys

Step 3: Configure settings.yaml

Start by copying the template provided in the Psono installation guide. Add them to /opt/docker/psono/settings.yaml.

3.1 Set the Host URL

1. Create a DNS record pointing to your server’s IP address. Example: using Cloudflare

2. Update the HOST_URL and WEB_CLIENT_URL in settings.yaml accordingly.

3.2 Configure SMTP for Email Registration

We will use Gmail for SMTP in this example:

1. Ensure you have a Gmail account.
2. Enable 2-Step Verification.
3. Create an App Password specifically for Psono.

Test your SMTP settings using GMass SMTP Test.

Then, configure settings.yaml:

1
EMAIL_FROM: 'user@gmail.com'
2
EMAIL_HOST: 'smtp.gmail.com'
3
EMAIL_HOST_USER: 'smtp.something@gmail.com'
4
EMAIL_HOST_PASSWORD: 'fake pass word yeah'
5
EMAIL_PORT: 465
6
EMAIL_SUBJECT_PREFIX: ''
7
EMAIL_USE_TLS: False
8
EMAIL_USE_SSL: True
9
EMAIL_SSL_CERTFILE:
10
EMAIL_SSL_KEYFILE:
11
EMAIL_TIMEOUT: 10

To verify the SMTP configuration:

docker run --rm \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -ti psono/psono-combo:latest python3 ./psono/manage.py sendtestmail something@something.com

3.3 Configure the Database Connection

Add the database configuration to your settings.yaml:

1
DATABASES:
2
  default:
3
    ENGINE: 'django.db.backends.postgresql_psycopg2'
4
    NAME: 'user'
5
    USER: 'user'
6
    PASSWORD: 'securepasswordforsure'
7
    HOST: 'psono-database'
8
    PORT: '5432'

Step 4: Prepare the Database

When running the default migration command provided in Psono’s documentation:

docker run --rm \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -ti psono/psono-combo:latest python3 ./psono/manage.py migrate

You may encounter connection issues because containers connected to the default bridge network cannot resolve each other’s names reliably.

Tip: Using Docker Compose makes this process much cleaner. Here’s a minimal example:

1
services:
2
  psono-database:
3
    image: postgres:13-alpine
4
    container_name: psono-database
5
    environment:
6
      POSTGRES_USER: psono
7
      POSTGRES_PASSWORD: password
8
    volumes:
9
      - /opt/docker/psono/postgres:/var/lib/postgresql/data
10
    networks:
11
      - psono-network
12

13
  psono:
14
    image: psono/psono-combo:latest
15
    container_name: psono
16
    volumes:
17
      - /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml
18
    networks:
19
      - psono-network
20
    depends_on:
21
      - psono-database
22

23
networks:
24
  psono-network:
25
    driver: bridge

Step 5: Set Up the Client

Create a config.json (e.g., /opt/docker/psono-client/config.json):

1
{
2
  "backend_servers": [{
3
    "title": "Psono.pw",
4
    "url": "https://psono.example.com/server"
5
  }],
6
  "base_url": "https://psono.example.com/",
7
  "allow_custom_server": true,
8
  "allow_registration": true,
9
  "allow_lost_password": true,
10
  "disable_download_bar": false,
11
  "remember_me_default": false,
12
  "trust_device_default": false,
13
  "authentication_methods": ["AUTHKEY", "LDAP"],
14
  "saml_provider": []
15
}

Make sure to replace psono.example.com with your domain name.

You can also add a "domain": "other.com" entry to specify an alternative login domain. If you do, make sure to also include it in the ALLOWED_DOMAINS: ['example.com'] section of your settings.yaml.

Step 6: Run the Server

Start the server manually for testing:

docker run --name psono-combo \
  --sysctl net.core.somaxconn=65535 \
  --network psono-network \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/config.json \
  -v /opt/docker/psono-client/config.json:/usr/share/nginx/html/portal/config.json \
  -d --restart=unless-stopped \
  -p 10200:80 \
  psono/psono-combo:latest

Visit http://your-ip:10200/server/info/ to verify that the server is running.

Step 7: Set Up a Reverse Proxy with SSL

Install Nginx

sudo apt install nginx

Install Certbot

sudo apt update
sudo apt install certbot
sudo apt install python3-certbot

Obtain the SSL Certificate

sudo certbot certonly --standalone -d psono.example.com

Provide an email address for renewal reminders.

Configure Nginx

Create /etc/nginx/sites-available/psono.example.com.conf:

1
server {
2
    listen 80;
3
    server_name psono.example.com;
4
    return 301 https://$host$request_uri;
5
}
6

7
server {
8
    listen 443 ssl http2;
9
    server_name psono.example.com;
10

11
    ssl_certificate /etc/letsencrypt/live/psono.example.com/fullchain.pem;
12
    ssl_certificate_key /etc/letsencrypt/live/psono.example.com/privkey.pem;
13

14
    proxy_redirect off;
15

16
    ssl_protocols TLSv1.2;
17
    ssl_prefer_server_ciphers on;
18
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:...';
19

20
    add_header Referrer-Policy same-origin;
21
    add_header X-Frame-Options DENY;
22
    add_header X-Content-Type-Options nosniff;
23
    add_header X-XSS-Protection "1; mode=block";
24

25
    add_header Content-Security-Policy "...";
26

27
    client_max_body_size 256m;
28

29
    gzip on;
30
    gzip_types text/plain text/css application/json application/javascript ...;
31

32
    root /var/www/html;
33

34
    location ~* \.(?:ico|css|js|gif|jpe?g|png|eot|woff|woff2|ttf|svg|otf)$ {
35
        expires 30d;
36
        proxy_pass http://localhost:10200;
37
        proxy_redirect http://localhost:10200 https://psono.example.com;
38
        proxy_set_header Host $host;
39
        proxy_set_header X-Real-IP $remote_addr;
40
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
41
        proxy_set_header X-Forwarded-Proto $scheme;
42
    }
43

44
    location / {
45
        proxy_pass http://localhost:10200;
46
        proxy_redirect http://localhost:10200 https://psono.example.com;
47
        proxy_set_header Host $host;
48
        proxy_set_header X-Real-IP $remote_addr;
49
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
50
        proxy_set_header X-Forwarded-Proto $scheme;
51
    }
52
}

Enable the configuration:

sudo ln -s /etc/nginx/sites-available/psono.example.com.conf /etc/nginx/sites-enabled/
sudo service nginx restart

Now your Psono server should be live at https://psono.example.com.

Step 8: Set Up Docker Compose

Stop any running containers:

docker stop psono-database
docker stop psono-combo

Create /opt/docker/psono/docker-compose.yml:

1
networks:
2
  psono-network:
3
    external: true
4

5
services:
6
  psono-database:
7
    image: postgres:13-alpine
8
    container_name: psono-database
9
    restart: unless-stopped
10
    environment:
11
      POSTGRES_USER: ${POSTGRES_USER}
12
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
13
    volumes:
14
      - /opt/docker/psono/postgres:/var/lib/postgresql/data
15
    ports:
16
      - "5432:5432"
17
    networks:
18
      - psono-network
19

20
  psono-server:
21
    image: psono/psono-combo:latest
22
    container_name: psono-combo
23
    restart: unless-stopped
24
    sysctls:
25
      net.core.somaxconn: 65535
26
    volumes:
27
      - /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml
28
      - /opt/docker/psono-client/config.json:/usr/share/nginx/html/config.json
29
      - /opt/docker/psono-client/config.json:/usr/share/nginx/html/portal/config.json
30
    ports:
31
      - "10200:80"
32
    depends_on:
33
      - psono-database
34
    networks:
35
      - psono-network

Bring up the stack:

docker compose up -d

Step 9: Schedule a Cron Job to Clear Tokens

Edit your crontab:

crontab -e

Add the following line:

1
30 2 * * * /usr/bin/docker exec psono-combo python3 ./psono/manage.py cleartoken >> /var/log/cron.log 2>&1

Step 10: Create and Promote an Admin User

1. Visit https://psono.example.com and register a new account.
2. Confirm your registration via the activation email.
3. To promote the user to admin:

docker run --rm \
  --network psono_default \
  -v /opt/docker/psono/settings.yaml:/root/.psono_server/settings.yaml \
  -ti psono/psono-combo:latest python3 ./psono/manage.py promoteuser mcveigth@psono.example.com superuser

🎉 E Voilà!

At this point, your Psono server should be fully operational — secured with SSL, backed by a persistent PostgreSQL database, and ready for user management.

Here’s a screenshot of everything running smoothly:

If you see something similar, congratulations — you now have a secure, self-hosted password management system tailored to your organization’s needs!

Final Notes

By deploying a secure, self-hosted Psono instance, we’ve taken a big step forward in protecting CYBERSEC’s credentials and improving operational security. This setup not only ensures better control over who can access sensitive information, but also allows us to enforce the principle of least privilege, streamline member onboarding and offboarding, and maintain forensic visibility in case of any issues.

Thanks to Docker, PostgreSQL, Nginx, and SSL encryption, our infrastructure is now production-ready and built to scale as the club continues to grow.

With the foundation in place, the next phase will focus on fine-tuning user and group policies to ensure that every member has exactly the access they need — no more, no less. This will further strengthen our security posture and support the club’s long-term success.

In a future article, we’ll cover how to create users, organize them into teams, configure permission sets, and enforce access control policies effectively.