fully integrated keepass conversion in docker compose

Author: Antonio Fragola

Dockerfile

@@ -55,11 +55,14 @@ RUN set -e; \
 # Copy the binary
 COPY --from=builder /src/build/lpass /usr/local/bin/lpass
 
-# Copy contrib folder with all scripts
-COPY contrib/ /usr/local/share/lastpass-cli/contrib/
+# Copy only the two needed scripts to /usr/local/bin and make them executable
+COPY contrib/lastpass-json-to-keepass.sh /usr/local/bin/lastpass-json-to-keepass.sh
+COPY contrib/lpass-att-export.sh /usr/local/bin/lpass-att-export.sh
+COPY keepass/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/*.sh
 
-# Make scripts executable
-RUN find /usr/local/share/lastpass-cli/contrib -name "*.sh" -exec chmod +x {} \;
+# Copy custom certificates and etc structure from root/etc to image root
+COPY keepass/root/etc /etc
 
 # Create directories for volume mounts
 RUN mkdir -p /backup /output /logs /data

contrib/lastpass-json-to-keepass.sh

@@ -342,20 +342,20 @@ EXPORT_ENTRY="Imported/EXPORT-LASTPASS"
 printf "%s\n" "$KP_PASS" | keepassxc-cli add "$KDBX_FILE" "$EXPORT_ENTRY" --notes "Backup LastPass export files (json, csv, attachments tgz)" >> "$DEBUG_LOG" 2>&1
 
 # Aggiungi il file JSON
-if [ -f "backup/lastpass-backup.json" ]; then
-  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "lastpass-backup.json" "backup/lastpass-backup.json" >> "$DEBUG_LOG" 2>&1
+if [ -f "/backup/lastpass-backup.json" ]; then
+  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "lastpass-backup.json" "/backup/lastpass-backup.json" >> "$DEBUG_LOG" 2>&1
 fi
 # Aggiungi il file CSV se esiste
-if [ -f "backup/lastpass-backup.csv" ]; then
-  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "lastpass-backup.csv" "backup/lastpass-backup.csv" >> "$DEBUG_LOG" 2>&1
+if [ -f "/backup/lastpass-backup.csv" ]; then
+  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "lastpass-backup.csv" "/backup/lastpass-backup.csv" >> "$DEBUG_LOG" 2>&1
 fi
 # Aggiungi il file LOG se esiste
-if [ -f "backup/backup-debug.log" ]; then
-  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "backup-debug.log" "backup/lbackup-debug.log" >> "$DEBUG_LOG" 2>&1
+if [ -f "/backup/backup-debug.log" ]; then
+  printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "backup-debug.log" "/backup/backup-debug.log" >> "$DEBUG_LOG" 2>&1
 fi
 # Crea tgz della cartella attachments escludendo file MacOS
-if [ -d "backup/attachments" ]; then
-  tar --exclude='._*' --exclude='.DS_Store' --exclude='.Trashes' --exclude='.Spotlight-V100' -czf "/tmp/attachments.tgz" -C "backup" attachments
+if [ -d "/backup/attachments" ]; then
+  tar --exclude='._*' --exclude='.DS_Store' --exclude='.Trashes' --exclude='.Spotlight-V100' -czf "/tmp/attachments.tgz" -C "/backup" attachments
   printf "%s\n" "$KP_PASS" | keepassxc-cli attachment-import "$KDBX_FILE" "$EXPORT_ENTRY" "attachments.tgz" "/tmp/attachments.tgz" >> "$DEBUG_LOG" 2>&1
   rm -f /tmp/attachments.tgz
 fi

docker-compose.yml

@@ -0,0 +1,2 @@
+backup/
+output/

keepass/.gitignore

@@ -0,0 +1,66 @@
+# KeePass + LastPass Docker Compose Usage
+
+This directory provides a ready-to-use Docker Compose setup for exporting your LastPass vault and converting it to a KeePass database, with all scripts and binaries included in the official image.
+
+## Quick Start
+
+1. **Enter the directory:**
+   ```sh
+   cd keepass
+   ```
+
+2. **Export your LastPass vault:**
+   - With interactive email prompt:
+     ```sh
+     docker compose run --rm lastpass-export
+     ```
+   - Or by passing your email as a parameter:
+     ```sh
+     docker compose run --rm lastpass-export your@email.com
+     ```
+   This will prompt for your LastPass password and export your vault to the `backup/` folder.
+
+3. **Convert the exported data to a KeePass database:**
+   ```sh
+   docker compose run --rm lastpass-processor
+   ```
+   By default, this will:
+   - Read the JSON export from `backup/lastpass-backup.json`
+   - Use attachments from `backup/attachments/`
+   - Write the KeePass database to `output/lastpass-export.kdbx`
+   - All logs will be saved in `output/logs/`
+
+   You can override the output file name by running the provided script `run_me.sh` and entering a custom name when prompted.
+
+4. **Manual/Debug Shell:**
+   ```sh
+   docker compose run --rm -it --entrypoint /bin/bash lastpass-cli
+   ```
+   This gives you a shell inside the container with all tools and volumes mounted for advanced/manual operations.
+
+## Options and Defaults
+
+- **lastpass-export**
+  - Argument: `[email@address.dom]` (optional)
+    - If not provided, you will be prompted interactively.
+  - Output: `backup/` directory (created if missing)
+
+- **lastpass-processor**
+  - No arguments needed by default.
+  - Reads: `backup/lastpass-backup.json` and `backup/attachments/`
+  - Writes: `output/lastpass-export.kdbx` (default)
+  - Logs: `output/logs/`
+  - To change the output file name, use the `run_me.sh` script and enter a custom name when prompted.
+
+- **lastpass-cli**
+  - Opens a bash shell for manual use. All volumes are mounted (`backup/`, `output/`).
+
+## Provided Script
+
+- `run_me.sh`: Interactive helper script to guide you through the full export and conversion process, allowing you to set the output KeePass file name (default: `lastpass-export.kdbx`).
+
+## Requirements
+- Docker and Docker Compose installed on your system.
+
+---
+For advanced usage, you can pass additional arguments to the scripts inside the container using the manual shell.

keepass/README.md

@@ -0,0 +1,39 @@
+services:
+  # Step 1: Export backup da LastPass (solo volume backup)
+  lastpass-export:
+    image: ghcr.io/fragolinux/lastpass-cli:latest
+    container_name: lastpass-export
+    volumes:
+      - ./backup:/backup
+    working_dir: /backup
+    entrypoint: ["/usr/local/bin/entrypoint.sh"]
+    stdin_open: true
+    tty: true
+
+  # Step 2: Conversione in KeePass (tutti i volumi)
+  lastpass-processor:
+    image: ghcr.io/fragolinux/lastpass-cli:latest
+    container_name: lastpass-processor
+    volumes:
+      - ./backup:/backup:ro
+      - ./output:/output
+    working_dir: /output
+    entrypoint: ["/usr/local/bin/lastpass-json-to-keepass.sh", "/backup/lastpass-backup.json", "/backup/attachments"]
+    command: ["/output/${KP_DB_NAME:-lastpass-export.kdbx}"]
+    stdin_open: true
+    tty: true
+
+  # Shell manuale opzionale
+  lastpass-cli:
+    image: ghcr.io/fragolinux/lastpass-cli:latest
+    container_name: lastpass-cli-manual
+    volumes:
+      - ./backup:/backup
+      - ./output:/output
+    working_dir: /output
+    entrypoint: ["/bin/bash"]
+    command: ["-c", "sleep infinity"]
+    profiles:
+      - manual
+    tty: true
+    stdin_open: true

keepass/docker-compose.yml

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -euo pipefail
+
+# Prende il primo parametro come username LastPass, se non presente lo chiede
+if [ $# -ge 1 ]; then
+  LPASS_USERNAME="$1"
+  shift
+else
+  read -p "Enter your LastPass email: " LPASS_USERNAME
+fi
+
+lpass login "$LPASS_USERNAME"
+
+# Se non viene passato un path di destinazione, usa /backup di default
+DEST_DIR="${1:-/backup}"
+
+lpass-att-export.sh -l "$LPASS_USERNAME" -o "$DEST_DIR"

keepass/entrypoint.sh

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID4DCCAsigAwIBAgIJAK2sPpFJkrXzMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNV
+BAYTAklMMREwDwYDVQQHEwhUZWwgQXZpdjEWMBQGA1UEChMNQ2F0byBOZXR3b3Jr
+czEZMBcGA1UEAxMQQ2F0byBOZXR3b3JrcyBDQTAeFw0xNTExMDEwOTMyMTJaFw0y
+NTEwMjkwOTMyMTJaMFMxCzAJBgNVBAYTAklMMREwDwYDVQQHEwhUZWwgQXZpdjEW
+MBQGA1UEChMNQ2F0byBOZXR3b3JrczEZMBcGA1UEAxMQQ2F0byBOZXR3b3JrcyBD
+QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMAeOxvEqN50ntoVI+Xq
+p4OLL+0faAfpTB3Y/RZFBFfFod/YsbWz9G5uzCHGygLZLqV2wFOtH7ay3avIL5rX
+ooyQrNH8e3f0APhmvkrjwkeQ3IQ5HQFCmvVYAMUAK4sINzG5Gn+GUQ8CJjFgpyIz
+TjXr3jjk06uCAH7FQx85yU+wAxTjSzD21pinnTVaHEssPJkRm7v/+JTrq+Uyt5yI
+JCySDSWgSmxi29Wkrlj4ZJ1P3jFnl2HUTAtCrwU0Oqhwas3nEXcjQai/OLztDiwf
+aow+HDxLcBWjjl0GQuiIL7mJ/+WPJ6QaLTWxjVXx9Ka0j26SNGh6Xu81ZonItegU
+GfUCAwEAAaOBtjCBszAdBgNVHQ4EFgQUq7DQAQTwudEj1sRi5ikbKBzCUQowgYMG
+A1UdIwR8MHqAFKuw0AEE8LnRI9bEYuYpGygcwlEKoVekVTBTMQswCQYDVQQGEwJJ
+TDERMA8GA1UEBxMIVGVsIEF2aXYxFjAUBgNVBAoTDUNhdG8gTmV0d29ya3MxGTAX
+BgNVBAMTEENhdG8gTmV0d29ya3MgQ0GCCQCtrD6RSZK18zAMBgNVHRMEBTADAQH/
+MA0GCSqGSIb3DQEBCwUAA4IBAQAvJolS/JgNtLXVpjetvzDe6tUTfuvgF8DE6inV
+0wpUyOVgfDmBCzOj6UZB0cZb6sSIHjiUI70JAeGTkhHiMmBfeF64fUe51JtFxVKP
+7l+oAzgHwa69xnn24nsgznsrUqg//mN/PEwPKZYnB4EoRUAYnrDMa1ujr8a8kkMp
+3m9Lp4J+L0b+IoQgLz0ImtydfTWD+y1csE1thrOssmRJ5miUnP2TBETJCez+oslc
+JrnAleHauy0yrfhC+aCZZK6gi4GYmZHm6Rdz07+M34ldhoynb3cR5xIYX5c5bXn0
+YPAoJ6F9uy02ne2dCLmrR2CG5TkeDSDeJvuyWWSLY1P6oEOb
+-----END CERTIFICATE-----

keepass/root/etc/ssl/certs/ca-certificates.crt

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -euo pipefail
+
+mkdir -p backup output
+
+# Step 1: export backup from LastPass
+read -p "Enter your LastPass username: " LPASS_USERNAME
+
+docker compose run --rm -e LPASS_USERNAME="$LPASS_USERNAME" lastpass-export
+
+echo "\nBackup exported to ./backup.\n"
+
+# Step 2: convert to KeePass
+read -p "Enter the name of the KeePass db file (without extension, default: lastpass-export): " KP_DB_NAME
+if [[ -z "$KP_DB_NAME" ]]; then
+  KP_DB_NAME="lastpass-export"
+fi
+KP_DB_NAME="${KP_DB_NAME}.kdbx"
+
+docker compose run --rm -e KP_DB_NAME="$KP_DB_NAME" lastpass-processor
+
+echo "\nConversion completed. KeePass file generated in ./output/$KP_DB_NAME\n"