SIGNUPS_ALLOWED was hardcoded 'true' in the compose file and turned off by a
separate manual playbook, so every routine run of the deploy - site.yml
included - silently re-opened registration. It is now
vaultwarden_signups_allowed, default false.
The port was published as a bare "8222:80". Docker writes its own iptables
rules ahead of UFW, so Vaultwarden answered plain HTTP on the public
interface, bypassing Caddy and TLS. Now 127.0.0.1:8222; verified closed from
outside.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
counterweight
751277f0c2
