counterweight/personal_infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

vaultwarden: sign-ups off by default, and publish on loopback only

Browse source 
SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a
separate manual playbook, so every routine run of the deploy - site.yml
included - silently re-opened registration. It is now
vaultwarden_signups_allowed, default false.

The port was published as a bare "8222:80". Docker writes its own iptables
rules ahead of UFW, so Vaultwarden answered plain HTTP on the public
interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from
outside.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
counterweight 2026-10-19 22:10:23 +02:00
parent ffcb0a8672
commit 751277f0c2
Signed by: counterweight
GPG key ID: 883EDBAA726BD96C
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
ansible/services/vaultwarden/vaultwarden_vars.yml
View file

@ -3,6 +3,13 @@ vaultwarden_dir: /opt/vaultwarden
vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
vaultwarden_port: 8222
# Public registration. OFF: the accounts exist, and this vault is on the open
# internet. It used to be hardcoded 'true' in the compose file and turned off by
# a separate manual playbook - so every routine run of the deploy (site.yml
# included) silently re-opened sign-ups. Flip to true only to add an account,
# then back.
vaultwarden_signups_allowed: false
# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)
# Remote access