diff --git a/vaultwarden-container.spec b/vaultwarden-container.spec index 7bd3ee4..8bb5b23 100644 --- a/vaultwarden-container.spec +++ b/vaultwarden-container.spec @@ -1,6 +1,6 @@ Name: vaultwarden-container Version: 1.36.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Vaultwarden - Bitwarden compatible server (container) License: AGPL-3.0 Group: System Environment/Base @@ -16,6 +16,8 @@ BuildRequires: systemd-rpm-macros Requires: podman Requires: containers-common Requires: systemd-container +# Same user, config, unit name and data dir as the native package +Conflicts: vaultwarden %description Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. @@ -32,7 +34,11 @@ install -m 640 %{SOURCE1} %{buildroot}%{_sysconfdir}/vaultwarden/vaultwarden.cfg install -p -D -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf -install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden-container +# Matches the native vaultwarden layout: data in /var/lib/vaultwarden/data +# (WorkingDirectory + relative DATA_FOLDER=data). The parent dir is HOME of +# the quadlet service (rootless podman storage); only data/ is mounted into +# the container, since podman refuses :Z relabeling of $HOME itself. +install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden/data %pre %sysusers_create_package vaultwarden %{SOURCE2} @@ -68,8 +74,17 @@ fi %config(noreplace) %attr(0640,root,vaultwarden) %{_sysconfdir}/vaultwarden/vaultwarden.cfg %dir %{_sysconfdir}/containers/systemd/vaultwarden.container.d %config(noreplace) %{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf -%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden-container +%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden +%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data %changelog +* Mon Jul 13 2026 Zoran Pericic - 1.36.0-2 +- Match native vaultwarden layout: data in /var/lib/vaultwarden/data +- Use /var/lib/vaultwarden as service HOME (rootless podman storage); + podman refuses :Z relabeling of a volume that equals $HOME +- Restore :Z relabel on the data volume +- Sync vaultwarden.cfg with the native 1.36.0 template +- Add Conflicts: vaultwarden + * Tue May 06 2026 Zoran Pericic - 1.36.0-1 - Initial package diff --git a/vaultwarden.cfg b/vaultwarden.cfg index 7a121cd..05b51d7 100644 --- a/vaultwarden.cfg +++ b/vaultwarden.cfg @@ -4,12 +4,25 @@ ## ## Be aware that most of these settings will be overridden if they were changed ## in the admin interface. Those overrides are stored within DATA_FOLDER/config.json . +## +## By default, Vaultwarden expects for this file to be named ".env" and located +## in the current working directory. If this is not the case, the environment +## variable ENV_FILE can be set to the location of this file prior to starting +## Vaultwarden. #################### ### Data folders ### #################### ## Main data folder +## This can be a path to local folder or a path to an external location +## depending on features enabled at build time. Possible external locations: +## +## - AWS S3 Bucket (via `s3` feature): s3://bucket-name/path/to/folder +## +## When using an external location, make sure to set TMP_FOLDER, +## TEMPLATES_FOLDER, and DATABASE_URL to local paths and/or a remote database +## location. # DATA_FOLDER=/var/lib/vaultwarden ## Individual folders, these override %DATA_FOLDER% @@ -17,10 +30,13 @@ # ICON_CACHE_FOLDER=data/icon_cache # ATTACHMENTS_FOLDER=data/attachments # SENDS_FOLDER=data/sends + +## Temporary folder used for storing temporary file uploads +## Must be a local path. # TMP_FOLDER=data/tmp -## Templates data folder, by default uses embedded templates -## Check source code to see the format +## HTML template overrides data folder +## Must be a local path. # TEMPLATES_FOLDER=data/templates ## Automatically reload the templates for every request, slow, use only for development # RELOAD_TEMPLATES=false @@ -34,7 +50,9 @@ ######################### ## Database URL -## When using SQLite, this is the path to the DB file, default to %DATA_FOLDER%/db.sqlite3 +## When using SQLite, this is the path to the DB file, and it defaults to +## %DATA_FOLDER%/db.sqlite3. If DATA_FOLDER is set to an external location, this +## must be set to a local sqlite3 file path. # DATABASE_URL=data/db.sqlite3 ## When using MySQL, specify an appropriate connection URI. ## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html @@ -62,8 +80,16 @@ ## Timeout when acquiring database connection # DATABASE_TIMEOUT=30 +## Database idle timeout +## Timeout in seconds before idle connections to the database are closed. +# DATABASE_IDLE_TIMEOUT=600 + +## Database min connections +## Define the minimum size of the connection pool used for connecting to the database. +# DATABASE_MIN_CONNS=2 + ## Database max connections -## Define the size of the connection pool used for connecting to the database. +## Define the maximum size of the connection pool used for connecting to the database. # DATABASE_MAX_CONNS=10 ## Database connection initialization @@ -87,15 +113,20 @@ ########################## ## Enables push notifications (requires key and id from https://bitwarden.com/host) -## If you choose "European Union" Data Region, uncomment PUSH_RELAY_URI and PUSH_IDENTITY_URI then replace .com by .eu ## Details about mobile client push notification: ## - https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification # PUSH_ENABLED=false # PUSH_INSTALLATION_ID=CHANGEME # PUSH_INSTALLATION_KEY=CHANGEME -## Don't change this unless you know what you're doing. + +# WARNING: Do not modify the following settings unless you fully understand their implications! +# Default Push Relay and Identity URIs # PUSH_RELAY_URI=https://push.bitwarden.com # PUSH_IDENTITY_URI=https://identity.bitwarden.com +# European Union Data Region Settings +# If you have selected "European Union" as your data region, use the following URIs instead. +# PUSH_RELAY_URI=https://api.bitwarden.eu +# PUSH_IDENTITY_URI=https://identity.bitwarden.eu ##################### ### Schedule jobs ### @@ -107,7 +138,7 @@ ## and are always in terms of UTC time (regardless of your local time zone settings). ## ## The schedule format is a bit different from crontab as crontab does not contains seconds. -## You can test the the format here: https://crontab.guru, but remove the first digit! +## You can test the format here: https://crontab.guru, but remove the first digit! ## SEC MIN HOUR DAY OF MONTH MONTH DAY OF WEEK ## "0 30 9,12,15 1,15 May-Aug Mon,Wed,Fri" ## "0 30 * * * * " @@ -147,6 +178,14 @@ ## Cron schedule of the job that cleans old auth requests from the auth request. ## Defaults to every minute. Set blank to disable this job. # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *" +## +## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt. +## Defaults to every minute. Set blank to disable this job. +# DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *" +# +## Cron schedule of the job that cleans sso auth from incomplete flow +## Defaults to daily (20 minutes after midnight). Set blank to disable this job. +# PURGE_INCOMPLETE_SSO_AUTH="0 20 0 * * *" ######################## ### General settings ### @@ -215,7 +254,8 @@ # SIGNUPS_ALLOWED=true ## Controls if new users need to verify their email address upon registration -## Note that setting this option to true prevents logins until the email address has been verified! +## On new client versions, this will require the user to verify their email at signup time. +## On older clients, it will require the user to verify their email before they can log in. ## The welcome email will include a verification link, and login attempts will periodically ## trigger another verification email to be sent. # SIGNUPS_VERIFY=false @@ -245,7 +285,7 @@ ## A comma-separated list means only those users can create orgs: # ORG_CREATION_USERS=admin1@example.com,admin2@example.com -## Invitations org admins to invite users, even when signups are disabled +## Allows org admins to invite users, even when signups are disabled # INVITATIONS_ALLOWED=true ## Name shown in the invitation emails that don't come from a specific organization # INVITATION_ORG_NAME=Vaultwarden @@ -266,12 +306,13 @@ ## The default for new users. If changed, it will be updated during login for existing users. # PASSWORD_ITERATIONS=600000 -## Controls whether users can set password hints. This setting applies globally to all users. +## Controls whether users can set or show password hints. This setting applies globally to all users. # PASSWORD_HINTS_ALLOWED=true ## Controls whether a password hint should be shown directly in the web page if -## SMTP service is not configured. Not recommended for publicly-accessible instances -## as this provides unauthenticated access to potentially sensitive data. +## SMTP service is not configured and password hints are allowed. +## Not recommended for publicly-accessible instances because this provides +## unauthenticated access to potentially sensitive data. # SHOW_PASSWORD_HINT=false ######################### @@ -307,34 +348,46 @@ ## Default: 2592000 (30 days) # ICON_CACHE_TTL=2592000 ## Cache time-to-live for icons which weren't available, in seconds (0 is "forever") -## Default: 2592000 (3 days) +## Default: 259200 (3 days) # ICON_CACHE_NEGTTL=259200 ## Icon download timeout ## Configure the timeout value when downloading the favicons. -## The default is 10 seconds, but this could be to low on slower network connections +## The default is 10 seconds, but this could be too low on slower network connections # ICON_DOWNLOAD_TIMEOUT=10 -## Icon blacklist Regex -## Any domains or IPs that match this regex won't be fetched by the icon service. +## Block HTTP domains/IPs by Regex +## Any domains or IPs that match this regex won't be fetched by the internal HTTP client. ## Useful to hide other servers in the local network. Check the WIKI for more details -## NOTE: Always enclose this regex withing single quotes! -# ICON_BLACKLIST_REGEX='^(192\.168\.0\.[0-9]+|192\.168\.1\.[0-9]+)$' +## NOTE: Always enclose this regex within single quotes! +# HTTP_REQUEST_BLOCK_REGEX='^(192\.168\.0\.[0-9]+|192\.168\.1\.[0-9]+)$' -## Any IP which is not defined as a global IP will be blacklisted. +## Enabling this will cause the internal HTTP client to refuse to connect to any non-global IP address. ## Useful to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block -# ICON_BLACKLIST_NON_GLOBAL_IPS=true +# HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=true ## Client Settings ## Enable experimental feature flags for clients. ## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3". +## Note that clients cache the /api/config endpoint for about 1 hour and it could take some time before they are enabled or disabled! ## ## The following flags are available: -## - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials. -## - "autofill-v2": Use the new autofill implementation. -## - "browser-fileless-import": Directly import credentials from other providers without a file. -## - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor. -# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials +## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0) +## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0) +## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1) +## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0) +## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0) +## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) +## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0) +## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0) +## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2) +## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2) +## - "pm-30529-webauthn-related-origins": +## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0) +## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0) +## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0) +## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0) +# EXPERIMENTAL_CLIENT_FEATURE_FLAGS= ## Require new device emails. When a user logs in an email is required to be sent. ## If sending the email fails the login attempt will fail!! @@ -357,8 +410,9 @@ ## Log level ## Change the verbosity of the log output ## Valid values are "trace", "debug", "info", "warn", "error" and "off" -## Setting it to "trace" or "debug" would also show logs for mounted -## routes and static file, websocket and alive requests +## Setting it to "trace" or "debug" would also show logs for mounted routes and static file, websocket and alive requests +## For a specific module append a comma separated `path::to::module=log_level` +## For example, to only see debug logs for icons use: LOG_LEVEL="info,vaultwarden::api::icons=debug" # LOG_LEVEL=info ## Token for the admin interface, preferably an Argon2 PCH string @@ -391,6 +445,14 @@ ## Multiple values must be separated with a whitespace. # ALLOWED_IFRAME_ANCESTORS= +## Allowed connect-src (Know the risks!) +## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src +## Allows other domains to URLs which can be loaded using script interfaces like the Forwarded email alias feature +## This adds the configured value to the 'Content-Security-Policy' headers 'connect-src' value. +## Multiple values must be separated with a whitespace. And only HTTPS values are allowed. +## Example: "https://my-addy-io.domain.tld https://my-simplelogin.domain.tld" +# ALLOWED_CONNECT_SRC="" + ## Number of seconds, on average, between login requests from the same IP address before rate limiting kicks in. # LOGIN_RATELIMIT_SECONDS=60 ## Allow a burst of requests of up to this size, while maintaining the average indicated by `LOGIN_RATELIMIT_SECONDS`. @@ -404,6 +466,72 @@ ## KNOW WHAT YOU ARE DOING! # ORG_GROUPS_ENABLED=false +## Increase secure note size limit (Know the risks!) +## Sets the secure note size limit to 100_000 instead of the default 10_000. +## WARNING: This could cause issues with clients. Also exports will not work on Bitwarden servers! +## KNOW WHAT YOU ARE DOING! +# INCREASE_NOTE_SIZE_LIMIT=false + +## Enforce Single Org with Reset Password Policy +## Enforce that the Single Org policy is enabled before setting the Reset Password policy +## Bitwarden enforces this by default. In Vaultwarden we encouraged to use multiple organizations because groups were not available. +## Setting this to true will enforce the Single Org Policy to be enabled before you can enable the Reset Password policy. +# ENFORCE_SINGLE_ORG_WITH_RESET_PW_POLICY=false + +## Prefer IPv6 (AAAA) resolving +## This settings configures the DNS resolver to resolve IPv6 first, and if not available try IPv4 +## This could be useful in IPv6 only environments. +# DNS_PREFER_IPV6=false + +##################################### +### SSO settings (OpenID Connect) ### +##################################### + +## Controls whether users can login using an OpenID Connect identity provider +# SSO_ENABLED=false + +## Prevent users from logging in directly without going through SSO +# SSO_ONLY=false + +## On SSO Signup if a user with a matching email already exists make the association +# SSO_SIGNUPS_MATCH_EMAIL=true + +## Allow unknown email verification status. Allowing this with `SSO_SIGNUPS_MATCH_EMAIL=true` open potential account takeover. +# SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false + +## Base URL of the OIDC server (auto-discovery is used) +## - Should not include the `/.well-known/openid-configuration` part and no trailing `/` +## - ${SSO_AUTHORITY}/.well-known/openid-configuration should return a json document: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse +# SSO_AUTHORITY=https://auth.example.com + +## Authorization request scopes. Optional SSO scopes, override if email and profile are not enough (`openid` is implicit). +# SSO_SCOPES="email profile" + +## Additional authorization url parameters (ex: to obtain a `refresh_token` with Google Auth). +# SSO_AUTHORIZE_EXTRA_PARAMS="access_type=offline&prompt=consent" + +## Activate PKCE for the Auth Code flow. +# SSO_PKCE=true + +## Regex for additional trusted Id token audience (by default only the client_id is trusted). +# SSO_AUDIENCE_TRUSTED='^$' + +## Set your Client ID and Client Key +# SSO_CLIENT_ID=11111 +# SSO_CLIENT_SECRET=AAAAAAAAAAAAAAAAAAAAAAAA + +## Optional Master password policy (minComplexity=[0-4]), `enforceOnLogin` is not supported at the moment. +# SSO_MASTER_PASSWORD_POLICY='{"enforceOnLogin":false,"minComplexity":3,"minLength":12,"requireLower":false,"requireNumbers":false,"requireSpecial":false,"requireUpper":false}' + +## Use sso only for authentication not the session lifecycle +# SSO_AUTH_ONLY_NOT_SESSION=false + +## Client cache for discovery endpoint. Duration in seconds (0 to disable). +# SSO_CLIENT_CACHE_EXPIRATION=0 + +## Log all the tokens, LOG_LEVEL=debug is required +# SSO_DEBUG_TOKENS=false + ######################## ### MFA/2FA settings ### ######################## @@ -417,15 +545,21 @@ # YUBICO_SERVER=http://yourdomain.com/wsapi/2.0/verify ## Duo Settings -## You need to configure all options to enable global Duo support, otherwise users would need to configure it themselves +## You need to configure the DUO_IKEY, DUO_SKEY, and DUO_HOST options to enable global Duo support. +## Otherwise users will need to configure it themselves. ## Create an account and protect an application as mentioned in this link (only the first step, not the rest): ## https://help.bitwarden.com/article/setup-two-step-login-duo/#create-a-duo-security-account ## Then set the following options, based on the values obtained from the last step: -# DUO_IKEY= -# DUO_SKEY= +# DUO_IKEY= +# DUO_SKEY= # DUO_HOST= ## After that, you should be able to follow the rest of the guide linked above, ## ignoring the fields that ask for the values that you already configured beforehand. +## +## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'. +## Duo no longer supports this, but it still works for some integrations. +## If you aren't sure, leave this alone. +# DUO_USE_IFRAME=false ## Email 2FA settings ## Email token size @@ -440,7 +574,7 @@ ## Maximum attempts before an email token is reset and a new email will need to be sent. # EMAIL_ATTEMPTS_LIMIT=3 ## -## Setup email 2FA regardless of any organization policy +## Setup email 2FA on registration regardless of any organization policy # EMAIL_2FA_ENFORCE_ON_VERIFIED_INVITE=false ## Automatically setup email 2FA as fallback provider when needed # EMAIL_2FA_AUTO_FALLBACK=false @@ -457,7 +591,7 @@ ## ## According to the RFC6238 (https://tools.ietf.org/html/rfc6238), ## we allow by default the TOTP code which was valid one step back and one in the future. -## This can however allow attackers to be a bit more lucky with there attempts because there are 3 valid codes. +## This can however allow attackers to be a bit more lucky with their attempts because there are 3 valid codes. ## You can disable this, so that only the current TOTP Code is allowed. ## Keep in mind that when a sever drifts out of time, valid codes could be marked as invalid. ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid. @@ -497,7 +631,7 @@ # SMTP_AUTH_MECHANISM= ## Server name sent during the SMTP HELO -## By default this value should be is on the machine's hostname, +## By default this value should be the machine's hostname, ## but might need to be changed in case it trips some anti-spam filters # HELO_NAME= @@ -526,7 +660,7 @@ ## Rocket specific settings ## See https://rocket.rs/v0.5/guide/configuration/ for more details. -# ROCKET_ADDRESS=127.0.0.1 +# ROCKET_ADDRESS=0.0.0.0 ## The default port is 8000, unless running in a Docker container, in which case it is 80. # ROCKET_PORT=8000 # ROCKET_TLS={certs="/path/to/certs.pem",key="/path/to/key.pem"} diff --git a/vaultwarden.container b/vaultwarden.container index 05bb660..3bf23c1 100644 --- a/vaultwarden.container +++ b/vaultwarden.container @@ -6,11 +6,11 @@ ContainerName=vaultwarden Image=docker.io/vaultwarden/server:1.36.0@sha256:d626d04934cd1192ad8ced1adb975099fca78cec33ab467d2d3c923cde7f3b0c EnvironmentFile=/etc/vaultwarden/vaultwarden.cfg PublishPort=127.0.0.1:8000:80 -Volume=/var/lib/vaultwarden-container:/data:Z +Volume=/var/lib/vaultwarden/data:/data:Z Volume=/etc/localtime:/etc/localtime:ro [Service] User=vaultwarden -Environment=HOME=/var/lib/vaultwarden-container +Environment=HOME=/var/lib/vaultwarden Restart=on-failure RestartSec=5s