diff --git a/vaultwarden_dev/README.md b/vaultwarden_dev/README.md index 8458cd1..2f26856 100644 --- a/vaultwarden_dev/README.md +++ b/vaultwarden_dev/README.md @@ -1,15 +1,82 @@ # Vaultwarden -Dockerhub: https://hub.docker.com/r/vaultwarden/server -Github: https://github.com/dani-garcia/vaultwarden -Wiki: https://github.com/dani-garcia/vaultwarden/wiki +## Overview -Reverse Proxy Port: 80 +Vaultwarden is a lightweight, Bitwarden-compatible password manager +server written in Rust. It works with the official Bitwarden browser +extensions and mobile apps. -## Usage +## Project Details -[Disable new users](https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-registration-of-new-users). +- **Project Repository:** [github.com/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden) +- **Container Image:** [Docker Hub](https://hub.docker.com/r/vaultwarden/server) +- **Documentation:** [Vaultwarden Wiki](https://github.com/dani-garcia/vaultwarden/wiki) +- **Reverse Proxy Port:** `80` -[SMTP](https://github.com/dani-garcia/bitwarden_rs/wiki/SMTP-configuration) +## Getting Started -To enable the admin page, you need to set an authentication token. This token can be anything, but it's recommended to use a long, randomly generated string of characters, for example running openssl rand -base64 48. \ No newline at end of file +1. Copy `sample.env`, set `VAULT_DOMAIN` and a random + `VAULT_ADMIN_TOKEN` (`openssl rand -base64 48`) +2. Start the container: `docker compose up -d` +3. Open http://localhost:8083/admin, sign in with the admin token, and + invite your users (signups are disabled by default) + +## Environment Variable Notes + + VAULT_DOMAIN – public base URL; Bitwarden clients require https, + so point this at your reverse-proxy domain for real use + VAULT_SIGNUPS_ALLOWED – open registration (default false; invite + users from the admin page instead) + VAULT_ADMIN_TOKEN – token for the /admin page; leave unset to + disable the admin page entirely + SMTP_* – optional mail settings for invitations and password-hint + emails; set all or none + VAULT_PORT – host port for the web UI (default 8083) + +See the [wiki](https://github.com/dani-garcia/vaultwarden/wiki) for +the full configuration reference. + +## Volume Notes + +- `/data` — SQLite database, attachments, icon cache, and RSA keys; + stored at `${VOL_PATH:-/data}/vaultwarden` on the host. Back this + up — it is the entire vault. + +## Network Notes + +Requires proxy network + +## Docker Run + +```bash +docker run -d \ + --name=vaultwarden \ + -e DOMAIN=https://vault.example.com \ + -e SIGNUPS_ALLOWED=false \ + -e ADMIN_TOKEN=changeme-to-a-long-random-string \ + -p 8083:80 \ + -v /data/vaultwarden:/data \ + vaultwarden/server:latest +``` + +## Additional Notes / Gotchas + +- This is a `_dev` stack — experimental, not yet production-ready. +- Bitwarden clients refuse to connect over plain http (except to + localhost) — serve it through the reverse proxy with TLS. +- WebSocket notifications are served on the main port since + Vaultwarden 1.29; no separate `WEBSOCKET_ENABLED` setting or port + 3012 proxying is needed anymore. +- [Disable registration of new users](https://github.com/dani-garcia/vaultwarden/wiki/Disable-registration-of-new-users) +- [SMTP configuration](https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration) + +## Dockhand Stack, Deploy from Git + +- Cookbooks Repository +- stackname: vaultwarden_dev +- Compose file path: vaultwarden_dev/compose.yaml +- Additional env file (optional): vaultwarden_dev/sample.env + +Then "Load" vaultwarden_dev/sample.env into the Environment variables in dockhand. + +Create the Stack diff --git a/vaultwarden_dev/compose.yaml b/vaultwarden_dev/compose.yaml new file mode 100644 index 0000000..469bf15 --- /dev/null +++ b/vaultwarden_dev/compose.yaml @@ -0,0 +1,30 @@ +# Vaultwarden Password Manager + +services: + vaultwarden: + image: ${VAULT_IMAGE:-vaultwarden/server:latest} + restart: ${VAULT_RESTART:-unless-stopped} + + volumes: + - ${VOL_PATH:-/data}/vaultwarden:/data + + environment: + - DOMAIN=${VAULT_DOMAIN:-http://localhost:8083} + - SIGNUPS_ALLOWED=${VAULT_SIGNUPS_ALLOWED:-false} + - ADMIN_TOKEN=${VAULT_ADMIN_TOKEN} + - SMTP_HOST=${SMTP_HOST} + - SMTP_FROM=${SMTP_FROM} + - SMTP_PORT=${SMTP_PORT:-587} + - SMTP_SECURITY=${SMTP_SECURITY:-starttls} + - SMTP_USERNAME=${SMTP_USERNAME} + - SMTP_PASSWORD=${SMTP_PASSWORD} + + ports: + - "${VAULT_PORT:-8083}:80" + + networks: + - proxy + +networks: + proxy: + external: true diff --git a/vaultwarden_dev/docker-compose.yml b/vaultwarden_dev/docker-compose.yml deleted file mode 100644 index 1e57288..0000000 --- a/vaultwarden_dev/docker-compose.yml +++ /dev/null @@ -1,17 +0,0 @@ -services: - vaultwarden: - image: ${VAULT_IMAGE:-vaultwarden/server:latest} - restart: unless-stopped - environment: - WEBSOCKET_ENABLED: "${VAULT_WEBSOCKET_ENABLED:-true}" # Enable WebSocket notifications - SIGNUPS_ALLOWED: "${VAULT_SIGNUPS_ALLOWED:-false}" # Disable new user signups - DOMAIN: ${VAULT_DOMAIN:-example.com} - ADMIN_TOKEN: "${VAULT_ADMIN_TOKEN:-changeme}" - SMTP_HOST: ${SMTP_HOST:-smtp.example.com} - SMTP_FROM: ${SMTP_FROM:-no-reply@example.com} - SMTP_PORT: ${SMTP_PORT:-587} - SMTP_SECURITY: ${SMTP_SECURITY:-tls} - SMTP_USERNAME: ${SMTP_USERNAME:-smtp_user@example.com} - SMTP_PASSWORD: ${SMTP_PASSWORD:-SuperSecretPassword123} - volumes: - - "${VOL_PATH:-./data}/vault-data:/data" diff --git a/vaultwarden_dev/sample.env b/vaultwarden_dev/sample.env index 86d7e56..a9802ed 100644 --- a/vaultwarden_dev/sample.env +++ b/vaultwarden_dev/sample.env @@ -1,17 +1,22 @@ -# VaultWarden -PRODDIR=/var/www/stashdomain-com/ #HELP: project_path -COOKBOOK=/home/user/git/docker-compose-cookbooks #HELP: cookbooks -VOL_PATH=/project-dir/project-name/data #HELP: volpath -# VaultWarden Container -VAULT_DOMAIN_NAME=www.YourDomain.com -VAULT_IMAGE=vaultwarden/server:1.31.0 -WEBSOCKET_ENABLED=true # Enable WebSocket notifications -SIGNUPS_ALLOWED=false # Disable new user signups -VAULT_ADMIN_TOKEN=01234567890123456790123456790123456789012345678 #HELP: gen32 -# SMTP -SMTP_HOST=smtp.domain.tld -SMTP_FROM=vaultwarden@domain.tld -SMTP_PORT=587 -SMTP_SECURITY=starttls -SMTP_USERNAME=username -SMTP_PASSWORD=password \ No newline at end of file +VAULT_IMAGE=vaultwarden/server:latest +VAULT_RESTART=unless-stopped +VOL_PATH=/data +VAULT_PORT=8083 + +# Public URL (set to your proxy domain; clients require https) +VAULT_DOMAIN=http://localhost:8083 + +# Keep signups disabled; invite users via the admin page instead +VAULT_SIGNUPS_ALLOWED=false + +# Admin page token — generate with: openssl rand -base64 48 +# Leave unset to disable the /admin page entirely +VAULT_ADMIN_TOKEN=changeme-to-a-long-random-string + +# SMTP (optional — set all of these or none) +# SMTP_HOST=smtp.domain.tld +# SMTP_FROM=vaultwarden@domain.tld +# SMTP_PORT=587 +# SMTP_SECURITY=starttls +# SMTP_USERNAME=username +# SMTP_PASSWORD=password