From 751277f0c2481370731c8770ca5ff46dee90aa35 Mon Sep 17 00:00:00 2001 From: counterweight Date: Mon, 19 Oct 2026 22:10:23 +0200 Subject: [PATCH] vaultwarden: sign-ups off by default, and publish on loopback only SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a separate manual playbook, so every routine run of the deploy - site.yml included - silently re-opened registration. It is now vaultwarden_signups_allowed, default false. The port was published as a bare "8222:80". Docker writes its own iptables rules ahead of UFW, so Vaultwarden answered plain HTTP on the public interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from outside. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../services/vaultwarden/deploy_vaultwarden_playbook.yml | 7 +++++-- ansible/services/vaultwarden/vaultwarden_vars.yml | 7 +++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml index 282fc2e..0a4a080 100644 --- a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml +++ b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml @@ -27,13 +27,16 @@ container_name: vaultwarden restart: unless-stopped ports: - - "{{ vaultwarden_port }}:80" + # Loopback only. Docker writes its own iptables rules AHEAD of + # UFW, so a bare "8222:80" was reachable from the internet as + # plain HTTP, bypassing Caddy and TLS. Caddy is the only client. + - "127.0.0.1:{{ vaultwarden_port }}:80" volumes: - ./data:/data environment: WEBSOCKET_ENABLED: 'true' DOMAIN: "https://{{ vaultwarden_domain }}" - SIGNUPS_ALLOWED: 'true' + SIGNUPS_ALLOWED: '{{ vaultwarden_signups_allowed | bool | lower }}' LOG_FILE: /data/vaultwarden.log - name: Deploy vaultwarden container with docker compose diff --git a/ansible/services/vaultwarden/vaultwarden_vars.yml b/ansible/services/vaultwarden/vaultwarden_vars.yml index 9edc2cd..c7470f5 100644 --- a/ansible/services/vaultwarden/vaultwarden_vars.yml +++ b/ansible/services/vaultwarden/vaultwarden_vars.yml @@ -3,6 +3,13 @@ vaultwarden_dir: /opt/vaultwarden vaultwarden_data_dir: "{{ vaultwarden_dir }}/data" vaultwarden_port: 8222 +# Public registration. OFF: the accounts exist, and this vault is on the open +# internet. It used to be hardcoded 'true' in the compose file and turned off by +# a separate manual playbook - so every routine run of the deploy (site.yml +# included) silently re-opened sign-ups. Flip to true only to add an account, +# then back. +vaultwarden_signups_allowed: false + # (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/) # Remote access