su -s /bin/bash -c "bin/cake passbolt healthcheck" www-data

 JWT Authentication

 [PASS] The JWT Authentication plugin is enabled.
 [PASS] The /etc/passbolt/jwt/ directory is not writable.
 [PASS] A valid JWT key pair was found.

 GPG Configuration

 [PASS] PHP GPG Module is installed and loaded.
 [PASS] The environment variable GNUPGHOME is set to /var/lib/passbolt/.gnupg.
 [PASS] The directory /var/lib/passbolt/.gnupg containing the keyring is writable by the webserver user.
 [PASS] The server OpenPGP key is not the default one.
 [PASS] The public key file is defined in /etc/passbolt/passbolt.php and readable.
 [PASS] The private key file is defined in /etc/passbolt/passbolt.php and readable.
 [PASS] The server key fingerprint matches the one defined in /etc/passbolt/passbolt.php.
 [PASS] The server public key defined in the /etc/passbolt/passbolt.php (or environment variables) is in the keyring.
 [PASS] There is a valid email id defined for the server key.
 [PASS] The public key can be used to encrypt a message.
 [PASS] The private key can be used to sign a message.
 [PASS] The public and private keys can be used to encrypt and sign a message.
 [PASS] The private key can be used to decrypt a message.
 [PASS] The private key can be used to decrypt and verify a message.
 [PASS] The public key can be used to verify a signature.
 [PASS] The server public key format is Gopengpg compatible.
 [PASS] The server private key format is Gopengpg compatible.

 Application configuration

 [PASS] Using latest passbolt version (5.16.0).
 [PASS] Passbolt is configured to force SSL use.
 [PASS] App.fullBaseUrl is set to HTTPS.
 [PASS] Selenium API endpoints are disabled.
 [PASS] Search engine robots are told not to index content.
 [INFO] The Self Registration plugin is enabled.
 [INFO] Registration is closed, only administrators can add users.
 [PASS] The deprecated self registration public setting was not found in /etc/passbolt/passbolt.php.
 [WARN] Host availability checking is disabled.
 [HELP] Make sure this instance is not publicly available on the internet.
 [HELP] Or set the PASSBOLT_EMAIL_VALIDATE_MX environment variable to true.
 [HELP] Or set passbolt.email.validate.mx to true in /etc/passbolt/passbolt.php.
 [PASS] Serving the compiled version of the javascript app.
 [WARN] Some email notifications are disabled by the administrator.
 [PASS] The session provider is php.
 [PASS] The database schema is up to date.
 [PASS] The edition served is CE.

 Database

 [PASS] The application is able to connect to the database
 [PASS] 55 tables found.
 [PASS] Some default content is present.
 [PASS] The database version is supported.
 [PASS] The model schema cache shows no discrepancies with the database schema.

 [PASS] No error found. Nice one, sparky!

grep -n "PASSBOLT_SSL_FORCE" /etc/passbolt/default.php

429:            'force' => filter_var(env('PASSBOLT_SSL_FORCE', false), FILTER_VALIDATE_BOOLEAN)

'Datasources' => [
    'default' => [
        'host' => env('DATASOURCES_DEFAULT_HOST', 'localhost'),
        'port' => env('DATASOURCES_DEFAULT_PORT', 3306),
        'username' => env('DATASOURCES_DEFAULT_USERNAME', 'user'),
        'password' => env('DATASOURCES_DEFAULT_PASSWORD', 'secret'),
        'database' => env('DATASOURCES_DEFAULT_DATABASE', 'passbolt'),
    ],
],

strict-transport-security: max-age=31536000; includeSubDomains

x-gpgauth-version: 1.3.0
x-gpgauth-login-url: /auth/login
x-gpgauth-logout-url: /auth/logout
x-gpgauth-verify-url: /auth/verify
x-gpgauth-pubkey-url: /auth/verify.json

'serverKey' => [
    'fingerprint' => env('PASSBOLT_GPG_SERVER_KEY_FINGERPRINT', ''),
    'public' => env('PASSBOLT_GPG_SERVER_KEY_PUBLIC', CONFIG . 'gpg' . DS . 'serverkey.asc'),
    'private' => env('PASSBOLT_GPG_SERVER_KEY_PRIVATE', CONFIG . 'gpg' . DS . 'serverkey_private.asc'),
],

gpg --homedir /var/lib/passbolt/.gnupg --fingerprint 226CD536A314A96C54E0EBCBA5968499BA1A4E66

pub   rsa3072 2026-10-19 [SC]
      226C D536 A314 A96C 54E0  EBCB A596 8499 BA1A 4E66
uid           [ unknown] Passbolt default user <passbolt@yourdomain.com>
sub   rsa3072 2026-10-19 [E]

su -s /bin/bash -c "bin/cake passbolt send_test_email -r admin@passbolt.local" www-data

[250] queued
 QUIT
The message has been successfully sent!

curl -kfs -b <管理员会话Cookie> https://192.168.146.128:8113/self-registration/settings.json

{"body":{"provider":null,"data":null}}

{"body":{"provider":{"inList":"The provider should be part of the supported list: email_domains."}}}

{"body":{"data":{"allowed_domains":{"_empty":"The list of allowed domains should not be empty."}}}}

curl -kfs -b <管理员会话Cookie> -X PUT -H "Content-Type: application/json" \
  -d '{"provider":"email_domains","data":{"allowed_domains":["passbolt.local"]}}' \
  https://192.168.146.128:8113/self-registration/settings.json

{"body":{"id":"762c718a-d0f9-442f-b010-18b5ecd51595","provider":"email_domains","data":{"allowed_domains":["passbolt.local"]},"created":"2026-10-19T06:39:53+00:00","modified":"2026-10-19T06:39:53+00:00","created_by":"2372c161-abcf-46e3-8d1e-c0fdecaa6a16","modified_by":"2372c161-abcf-46e3-8d1e-c0fdecaa6a16"}}

curl -kfs -b <管理员会话Cookie> https://192.168.146.128:8113/users.json

admin@passbolt.local → admin
bob@passbolt.local → user
charlie@passbolt.local → admin

'passwordPolicies' => [
    'enabled' => filter_var(env('PASSBOLT_PLUGINS_PASSWORD_POLICIES_ENABLED', true), FILTER_VALIDATE_BOOLEAN),
],

<?php
return [
    'App' => [
        'fullBaseUrl' => env('APP_FULL_BASE_URL', 'https://192.168.146.128:8113'),
    ],
    'Datasources' => [
        'default' => [
            'host' => env('DATASOURCES_DEFAULT_HOST', 'db'),
            'port' => env('DATASOURCES_DEFAULT_PORT', 3306),
            'username' => env('DATASOURCES_DEFAULT_USERNAME', 'passbolt'),
            'password' => env('DATASOURCES_DEFAULT_PASSWORD', 'P4ssb0lt'),
            'database' => env('DATASOURCES_DEFAULT_DATABASE', 'passbolt'),
        ],
    ],
    'EmailTransport' => [
        'default' => [
            'host' => env('EMAIL_TRANSPORT_DEFAULT_HOST', '192.168.146.128'),
            'port' => env('EMAIL_TRANSPORT_DEFAULT_PORT', 1025),
            'timeout' => env('EMAIL_TRANSPORT_DEFAULT_TIMEOUT', 30),
            'username' => env('EMAIL_TRANSPORT_DEFAULT_USERNAME', null),
            'password' => env('EMAIL_TRANSPORT_DEFAULT_PASSWORD', null),
            'tls' => env('EMAIL_TRANSPORT_DEFAULT_TLS', false),
        ],
    ],
    'Email' => [
        'default' => [
            'transport' => 'default',
            'from' => [
                env('EMAIL_DEFAULT_FROM', 'passbolt@passbolt.local') => env('EMAIL_DEFAULT_FROM_NAME', 'Passbolt')
            ],
        ],
    ],
    'passbolt' => [
        'ssl' => [
            'force' => true,
        ],
        'gpg' => [
            'serverKey' => [
                'fingerprint' => '226CD536A314A96C54E0EBCBA5968499BA1A4E66',
                'public' => CONFIG . 'gpg' . DS . 'serverkey.asc',
                'private' => CONFIG . 'gpg' . DS . 'serverkey_private.asc',
            ],
        ],
    ],
];