Joakim
bfd6f22f0e
- Implement complete Vaultwarden deployment using Podman Quadlet - PostgreSQL backend via Unix socket with 777 permissions - Caddy reverse proxy with WebSocket support for live sync - Control-node admin token hashing using argon2 (OWASP preset) - Idempotent token hashing with deterministic salt generation - Full Authentik SSO integration following official guide - SMTP email configuration support (optional) - Invitation-only user registration by default - Comprehensive documentation with setup and troubleshooting guides Technical Details: - Container: vaultwarden/server:latest from Docker Hub - Database: PostgreSQL via /var/run/postgresql socket - Port: 8080 (localhost only, proxied by Caddy) - Domain: vault.jnss.me - Admin token: Hashed on control node with argon2id - SSO: OpenID Connect with offline_access scope support Role includes automatic argon2 installation on control node if needed.
36 lines
1.0 KiB
Django/Jinja
36 lines
1.0 KiB
Django/Jinja
# Vaultwarden Password Manager
|
|
{{ vaultwarden_domain }} {
|
|
# Notifications endpoint (WebSocket for live sync)
|
|
@websocket {
|
|
path /notifications/hub
|
|
}
|
|
reverse_proxy @websocket http://127.0.0.1:{{ vaultwarden_http_port }} {
|
|
header_up Upgrade {http.request.header.Upgrade}
|
|
header_up Connection {http.request.header.Connection}
|
|
}
|
|
|
|
# Regular HTTP traffic
|
|
reverse_proxy http://127.0.0.1:{{ vaultwarden_http_port }} {
|
|
header_up Host {host}
|
|
header_up X-Real-IP {remote_host}
|
|
header_up X-Forwarded-Proto https
|
|
header_up X-Forwarded-For {remote_host}
|
|
}
|
|
|
|
# Security headers
|
|
header {
|
|
X-Frame-Options SAMEORIGIN
|
|
X-Content-Type-Options nosniff
|
|
X-XSS-Protection "1; mode=block"
|
|
Referrer-Policy strict-origin-when-cross-origin
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
}
|
|
|
|
# Logging
|
|
log {
|
|
output file {{ caddy_log_dir }}/vaultwarden.log
|
|
level INFO
|
|
format json
|
|
}
|
|
}
|