Skip to content

Commit 64595b0

Browse files
tremor021tremor021
authored
Vaultwarden: Enable HTTPS by default (#4197)
1 parent 43d67cf commit 64595b0

File tree

3 files changed

+69
-66
lines changed

3 files changed

+69
-66
lines changed

‎frontend/public/json/vaultwarden.json‎

Lines changed: 52 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,55 @@
11
{
2-
"name": "Vaultwarden",
3-
"slug": "vaultwarden",
4-
"categories": [
5-
6
6-
],
7-
"date_created": "2024-05-02",
8-
"type": "ct",
9-
"updateable": true,
10-
"privileged": false,
11-
"interface_port": 8000,
12-
"documentation": null,
13-
"website": "https://github.com/dani-garcia/vaultwarden/",
14-
"logo": "https://raw.githubusercontent.com/dani-garcia/vaultwarden/main/resources/vaultwarden-icon-white.svg",
15-
"config_path": "/opt/vaultwarden/.env",
16-
"description": "Vaultwarden is a self-hosted password manager which provides secure and encrypted password storage. It uses client-side encryption and provides access to passwords through a web interface and mobile apps.",
17-
"install_methods": [
18-
{
19-
"type": "default",
20-
"script": "ct/vaultwarden.sh",
21-
"resources": {
22-
"cpu": 4,
23-
"ram": 6144,
24-
"hdd": 6,
25-
"os": "debian",
26-
"version": "12"
27-
}
28-
},
29-
{
30-
"type": "alpine",
31-
"script": "ct/alpine-vaultwarden.sh",
32-
"resources": {
33-
"cpu": 1,
34-
"ram": 256,
35-
"hdd": 0.5,
36-
"os": "alpine",
37-
"version": "3.21"
38-
}
39-
}
40-
],
41-
"default_credentials": {
42-
"username": null,
43-
"password": null
2+
"name": "Vaultwarden",
3+
"slug": "vaultwarden",
4+
"categories": [
5+
6
6+
],
7+
"date_created": "2024-05-02",
8+
"type": "ct",
9+
"updateable": true,
10+
"privileged": false,
11+
"interface_port": 8000,
12+
"documentation": "https://github.com/dani-garcia/vaultwarden/wiki",
13+
"website": "https://github.com/dani-garcia/vaultwarden/",
14+
"logo": "https://raw.githubusercontent.com/dani-garcia/vaultwarden/main/resources/vaultwarden-icon-white.svg",
15+
"config_path": "/opt/vaultwarden/.env",
16+
"description": "Vaultwarden is a self-hosted password manager which provides secure and encrypted password storage. It uses client-side encryption and provides access to passwords through a web interface and mobile apps.",
17+
"install_methods": [
18+
{
19+
"type": "default",
20+
"script": "ct/vaultwarden.sh",
21+
"resources": {
22+
"cpu": 4,
23+
"ram": 6144,
24+
"hdd": 6,
25+
"os": "debian",
26+
"version": "12"
27+
}
4428
},
45-
"notes": [
46-
{
47-
"text": "Vaultwarden needs to be behind a proxy (Nginx Proxy Manager, Caddy, etc) to obtain HTTPS and to allow clients to connect. If you try to open the web page directly on the new container, the web site will not load",
48-
"type": "warning"
49-
},
50-
{
51-
"text": "To set the Admin Token, run the command below (or type update) in the LXC Console.",
52-
"type": "info"
53-
}
54-
]
29+
{
30+
"type": "alpine",
31+
"script": "ct/alpine-vaultwarden.sh",
32+
"resources": {
33+
"cpu": 1,
34+
"ram": 256,
35+
"hdd": 0.5,
36+
"os": "alpine",
37+
"version": "3.21"
38+
}
39+
}
40+
],
41+
"default_credentials": {
42+
"username": null,
43+
"password": null
44+
},
45+
"notes": [
46+
{
47+
"text": "Application uses self-signed certificate for HTTPS to work and is enabled by default. If you need a different setup, please read the documentation.",
48+
"type": "warning"
49+
},
50+
{
51+
"text": "To set the Admin Token, run the command below (or type update) in the LXC Console.",
52+
"type": "info"
53+
}
54+
]
5555
}
56-

‎install/alpine-vaultwarden-install.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ $STD apk add vaultwarden
2828
sed -i -e 's|export WEB_VAULT_ENABLED=.*|export WEB_VAULT_ENABLED=true|' /etc/conf.d/vaultwarden
2929
echo -e "export ADMIN_TOKEN=''" >>/etc/conf.d/vaultwarden
3030
echo -e "export ROCKET_ADDRESS=0.0.0.0" >>/etc/conf.d/vaultwarden
31+
echo -e "export ROCKET_TLS='{certs=\"/etc/ssl/certs/vaultwarden-selfsigned.crt\",key=\"/etc/ssl/private/vaultwarden-selfsigned.key\"}'"
32+
$STD openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/vaultwarden-selfsigned.key -out /etc/ssl/certs/vaultwarden-selfsigned.crt -subj "/C=US/O=Vaultwarden/O
33+
U=Domain Control Validated/CN=localhost"
34+
chown vaultwarden:vaultwarden /etc/ssl/certs/vaultwarden-selfsigned.crt
35+
chown vaultwarden:vaultwarden /etc/ssl/private/vaultwarden-selfsigned.key
3136
msg_ok "Installed Alpine-Vaultwarden"
3237

3338
msg_info "Installing Web-Vault"

‎install/vaultwarden-install.sh‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,28 +15,23 @@ update_os
1515

1616
msg_info "Installing Dependencies"
1717
$STD apt-get update
18-
$STD apt-get -qqy install \
19-
git \
18+
$STD apt-get install -y git \
2019
build-essential \
2120
pkgconf \
2221
libssl-dev \
2322
libmariadb-dev-compat \
2423
libpq-dev \
25-
argon2
24+
argon2 \
25+
ssl-cert
2626
msg_ok "Installed Dependencies"
2727

28-
WEBVAULT=$(curl -fsSL https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest |
29-
grep "tag_name" |
30-
awk '{print substr($2, 2, length($2)-3) }')
31-
32-
VAULT=$(curl -fsSL https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest |
33-
grep "tag_name" |
34-
awk '{print substr($2, 2, length($2)-3) }')
28+
WEBVAULT=$(curl -fsSL https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
29+
VAULT=$(curl -fsSL https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
3530

3631
msg_info "Installing Rust"
3732
curl -fsSL https://sh.rustup.rs -o rustup-init.sh
3833
$STD bash rustup-init.sh -y --profile minimal
39-
echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc
34+
echo 'export PATH="$HOME/.cargo/bin:$PATH"' >>~/.bashrc
4035
export PATH="$HOME/.cargo/bin:$PATH"
4136
rm rustup-init.sh
4237
msg_ok "Installed Rust"
@@ -54,19 +49,23 @@ mkdir -p /opt/vaultwarden/data
5449
cp target/release/vaultwarden /opt/vaultwarden/bin/
5550

5651
msg_info "Downloading Web-Vault ${WEBVAULT}"
57-
$STD curl -fsSLO https://github.com/dani-garcia/bw_web_builds/releases/download/$WEBVAULT/bw_web_$WEBVAULT.tar.gz
58-
$STD tar -xzf bw_web_$WEBVAULT.tar.gz -C /opt/vaultwarden/
52+
$STD curl -fsSLO https://github.com/dani-garcia/bw_web_builds/releases/download/"$WEBVAULT"/bw_web_"$WEBVAULT".tar.gz
53+
$STD tar -xzf bw_web_"$WEBVAULT".tar.gz -C /opt/vaultwarden/
5954
msg_ok "Downloaded Web-Vault ${WEBVAULT}"
6055

6156
cat <<EOF >/opt/vaultwarden/.env
6257
ADMIN_TOKEN=''
6358
ROCKET_ADDRESS=0.0.0.0
59+
ROCKET_TLS='{certs="/opt/vaultwarden/ssl-cert-snakeoil.pem",key="/opt/vaultwarden/ssl-cert-snakeoil.key"}'
6460
DATA_FOLDER=/opt/vaultwarden/data
6561
DATABASE_MAX_CONNS=10
6662
WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault
6763
WEB_VAULT_ENABLED=true
6864
EOF
6965

66+
mv /etc/ssl/certs/ssl-cert-snakeoil.pem /opt/vaultwarden/
67+
mv /etc/ssl/private/ssl-cert-snakeoil.key /opt/vaultwarden/
68+
7069
msg_info "Creating Service"
7170
chown -R vaultwarden:vaultwarden /opt/vaultwarden/
7271
chown root:root /opt/vaultwarden/bin/vaultwarden

0 commit comments

Comments
 (0)