Name:           vaultwarden-container
Version:        1.37.1
Release:        1%{?dist}
Summary:        Vaultwarden - Bitwarden compatible server (container)
License:        AGPL-3.0
Group:          System Environment/Base
URL:            https://github.com/dani-garcia/vaultwarden

Source0:        vaultwarden.container
Source1:        vaultwarden.cfg
Source2:        vaultwarden.sysusers
Source3:        vaultwarden-container-enable.conf

BuildArch:      noarch
BuildRequires:  systemd-rpm-macros
Requires:       podman
Requires:       containers-common
Requires:       systemd-container
# Same user, config, unit name and data dir as the native package
Conflicts:      vaultwarden

%description
Vaultwarden is an unofficial Bitwarden-compatible server written in Rust.
Runs as a rootless Podman container via quadlet.

%install
%{__rm} -rf %{buildroot}

install -p -D -m 644 %{SOURCE0} %{buildroot}%{_datadir}/containers/systemd/vaultwarden.container
install -p -D -m 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/vaultwarden.conf

install -d -m 750 %{buildroot}%{_sysconfdir}/vaultwarden
install -m 640 %{SOURCE1} %{buildroot}%{_sysconfdir}/vaultwarden/vaultwarden.cfg

install -p -D -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf

# Matches the native vaultwarden layout: data in /var/lib/vaultwarden/data
# (WorkingDirectory + relative DATA_FOLDER=data). The parent dir is HOME of
# the quadlet service (rootless podman storage); only data/ is mounted into
# the container, since podman refuses :Z relabeling of $HOME itself.
install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden/data

%pre
%sysusers_create_package vaultwarden %{SOURCE2}

%post
if [ $1 -eq 1 ]; then
    loginctl enable-linger vaultwarden || :
fi

if ! grep -q "^vaultwarden:" /etc/subuid 2>/dev/null; then
    NEXT=$(awk -F: '{n=$2+$3} END{print n+0}' /etc/subuid 2>/dev/null)
    [ "$NEXT" -lt 524288 ] && NEXT=524288
    END=$((NEXT + 65535))
    usermod --add-subuids "$NEXT-$END" --add-subgids "$NEXT-$END" vaultwarden 2>/dev/null || :
fi

%systemd_post vaultwarden.service

%preun
%systemd_preun vaultwarden.service

%postun
%systemd_postun vaultwarden.service

%clean
%{__rm} -rf %{buildroot}

%files
%defattr(-,root,root,-)
%{_datadir}/containers/systemd/vaultwarden.container
%{_sysusersdir}/vaultwarden.conf
%dir %attr(0750,root,vaultwarden) %{_sysconfdir}/vaultwarden
%config(noreplace) %attr(0640,root,vaultwarden) %{_sysconfdir}/vaultwarden/vaultwarden.cfg
%dir %{_sysconfdir}/containers/systemd/vaultwarden.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf
%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden
%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data

%changelog
* Mon Aug 10 2026 Zoran Pericic <zpericic@netst.org> - 1.37.1-1
- Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org
  cipher access, org policy bypass, WebSocket DDoS; invite fixes)
- Sync vaultwarden.cfg with the 1.37.1 template (IP_HEADER_TRUSTED_PROXIES,
  UNAUTHENTICATED_RATELIMIT_*, sqlite:// DATABASE_URL scheme)

* Mon Jul 13 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-2
- Match native vaultwarden layout: data in /var/lib/vaultwarden/data
- Use /var/lib/vaultwarden as service HOME (rootless podman storage);
  podman refuses :Z relabeling of a volume that equals $HOME
- Restore :Z relabel on the data volume
- Sync vaultwarden.cfg with the native 1.36.0 template
- Add Conflicts: vaultwarden

* Tue May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
- Initial package