zpericic
fe5c49edb5
- Bump image to docker.io/vaultwarden/server:1.37.1 (new digest) - Security fixes upstream: SSRF via icon endpoint, cross-org cipher access, org policy bypass, WebSocket DDoS; invite fixes in 1.37.1 - Sync vaultwarden.cfg with upstream 1.37.1 .env.template
97 lines
3.5 KiB
RPMSpec
97 lines
3.5 KiB
RPMSpec
Name: vaultwarden-container
|
|
Version: 1.37.1
|
|
Release: 1%{?dist}
|
|
Summary: Vaultwarden - Bitwarden compatible server (container)
|
|
License: AGPL-3.0
|
|
Group: System Environment/Base
|
|
URL: https://github.com/dani-garcia/vaultwarden
|
|
|
|
Source0: vaultwarden.container
|
|
Source1: vaultwarden.cfg
|
|
Source2: vaultwarden.sysusers
|
|
Source3: vaultwarden-container-enable.conf
|
|
|
|
BuildArch: noarch
|
|
BuildRequires: systemd-rpm-macros
|
|
Requires: podman
|
|
Requires: containers-common
|
|
Requires: systemd-container
|
|
# Same user, config, unit name and data dir as the native package
|
|
Conflicts: vaultwarden
|
|
|
|
%description
|
|
Vaultwarden is an unofficial Bitwarden-compatible server written in Rust.
|
|
Runs as a rootless Podman container via quadlet.
|
|
|
|
%install
|
|
%{__rm} -rf %{buildroot}
|
|
|
|
install -p -D -m 644 %{SOURCE0} %{buildroot}%{_datadir}/containers/systemd/vaultwarden.container
|
|
install -p -D -m 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/vaultwarden.conf
|
|
|
|
install -d -m 750 %{buildroot}%{_sysconfdir}/vaultwarden
|
|
install -m 640 %{SOURCE1} %{buildroot}%{_sysconfdir}/vaultwarden/vaultwarden.cfg
|
|
|
|
install -p -D -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf
|
|
|
|
# Matches the native vaultwarden layout: data in /var/lib/vaultwarden/data
|
|
# (WorkingDirectory + relative DATA_FOLDER=data). The parent dir is HOME of
|
|
# the quadlet service (rootless podman storage); only data/ is mounted into
|
|
# the container, since podman refuses :Z relabeling of $HOME itself.
|
|
install -d -m 750 %{buildroot}%{_sharedstatedir}/vaultwarden/data
|
|
|
|
%pre
|
|
%sysusers_create_package vaultwarden %{SOURCE2}
|
|
|
|
%post
|
|
if [ $1 -eq 1 ]; then
|
|
loginctl enable-linger vaultwarden || :
|
|
fi
|
|
|
|
if ! grep -q "^vaultwarden:" /etc/subuid 2>/dev/null; then
|
|
NEXT=$(awk -F: '{n=$2+$3} END{print n+0}' /etc/subuid 2>/dev/null)
|
|
[ "$NEXT" -lt 524288 ] && NEXT=524288
|
|
END=$((NEXT + 65535))
|
|
usermod --add-subuids "$NEXT-$END" --add-subgids "$NEXT-$END" vaultwarden 2>/dev/null || :
|
|
fi
|
|
|
|
%systemd_post vaultwarden.service
|
|
|
|
%preun
|
|
%systemd_preun vaultwarden.service
|
|
|
|
%postun
|
|
%systemd_postun vaultwarden.service
|
|
|
|
%clean
|
|
%{__rm} -rf %{buildroot}
|
|
|
|
%files
|
|
%defattr(-,root,root,-)
|
|
%{_datadir}/containers/systemd/vaultwarden.container
|
|
%{_sysusersdir}/vaultwarden.conf
|
|
%dir %attr(0750,root,vaultwarden) %{_sysconfdir}/vaultwarden
|
|
%config(noreplace) %attr(0640,root,vaultwarden) %{_sysconfdir}/vaultwarden/vaultwarden.cfg
|
|
%dir %{_sysconfdir}/containers/systemd/vaultwarden.container.d
|
|
%config(noreplace) %{_sysconfdir}/containers/systemd/vaultwarden.container.d/enable.conf
|
|
%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden
|
|
%dir %attr(0750,vaultwarden,vaultwarden) %{_sharedstatedir}/vaultwarden/data
|
|
|
|
%changelog
|
|
* Mon Aug 10 2026 Zoran Pericic <zpericic@netst.org> - 1.37.1-1
|
|
- Update to 1.37.1 (security fixes: SSRF via icon endpoint, cross-org
|
|
cipher access, org policy bypass, WebSocket DDoS; invite fixes)
|
|
- Sync vaultwarden.cfg with the 1.37.1 template (IP_HEADER_TRUSTED_PROXIES,
|
|
UNAUTHENTICATED_RATELIMIT_*, sqlite:// DATABASE_URL scheme)
|
|
|
|
* Mon Jul 13 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-2
|
|
- Match native vaultwarden layout: data in /var/lib/vaultwarden/data
|
|
- Use /var/lib/vaultwarden as service HOME (rootless podman storage);
|
|
podman refuses :Z relabeling of a volume that equals $HOME
|
|
- Restore :Z relabel on the data volume
|
|
- Sync vaultwarden.cfg with the native 1.36.0 template
|
|
- Add Conflicts: vaultwarden
|
|
|
|
* Tue May 06 2026 Zoran Pericic <zpericic@netst.org> - 1.36.0-1
|
|
- Initial package
|