VaultWarden: Difference between revisions
| Line 113: | Line 113: | ||
# The user/group bitwarden_rs is run under. the working directory (see below) should allow write and read access to this user/group | # The user/group bitwarden_rs is run under. the working directory (see below) should allow write and read access to this user/group | ||
User=root | User=root | ||
Group=root | |||
# The location of the .env file for configuration | # The location of the .env file for configuration | ||
EnvironmentFile=/opt/bitwarden/.env | EnvironmentFile=/opt/bitwarden/.env | ||
| Line 120: | Line 121: | ||
LimitNOFILE=1048576 | LimitNOFILE=1048576 | ||
# Isolate bitwarden_rs from the rest of the system | # Isolate bitwarden_rs from the rest of the system | ||
PrivateTmp=true | # PrivateTmp=true | ||
PrivateDevices=true | # PrivateDevices=true | ||
ProtectHome=true | # ProtectHome=true | ||
ProtectSystem=strict | # ProtectSystem=strict | ||
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here) | # Only allow writes to the following directory and set it to the working directory (user and password data are stored here) | ||
WorkingDirectory=/opt/bitwarden/data | WorkingDirectory=/opt/bitwarden/data/ | ||
ReadWriteDirectories=/opt/bitwarden/data | ReadWriteDirectories=/opt/bitwarden/data/ | ||
# Allow bitwarden_rs to bind ports in the range of 0-1024 | # Allow bitwarden_rs to bind ports in the range of 0-1024 | ||
AmbientCapabilities=CAP_NET_BIND_SERVICE | #AmbientCapabilities=CAP_NET_BIND_SERVICE | ||
[Install] | [Install] | ||
Revision as of 22:01, 23 February 2021
| IP: | 192.168.88.?? |
|---|---|
| MAC: | B6:04:55:14:93:89 |
| Domain: | keys.flowerhouse.at |
| OS: | Debian Buster |
|---|---|
| RAM: | 512MB |
| Cores: | 1 |
| Privileged: | No |
The BitWarden-LXC is reachable under 192.168.88.?? which is located in the ServerVLAN.
The subdomain is keys.flowerhouse.at which is handled by the ReverseProxy.
Basic Setup
The original BitWarden-Server is only available with docker, this an alternative software programmed with rust.
Install the required packages:
apt install git curl wget htop pkg-config openssl libssl1.1 libssl-dev build-essential
Rust
Download script and follow installer:
curl https://sh.rustup.rs -sSf | sh
Create environment variable:
echo 'export PATH=~/.cargo/bin:$PATH' >> ~/.bashrc
export PATH=~/.cargo/bin:$PATH
After running following command:
which rustc
It should show the path:
/root/.cargo/bin/rustc
NodeJS
Download latest NodeJS package:
wget https://nodejs.org/dist/latest/node-v15.10.0-linux-x64.tar.xz
Unpack and move folder:
tar -xvf nnode-v15.10.0-linux-x64.tar.xz
mv node-v15.10.0-linux-x64.tar.xz /opt/
Create link:
ln -sf /opt/node-v15.10.0-linux-x64 /opt/node
Build bitwarden_rs
To build bitwarden_rs, enough CPU and RAM is needed for it to work, with 4 Cores and 1GB RAM it worked fine.
Clone the bitwarden_rs repository and use cargo to build it:
git clone https://github.com/dani-garcia/bitwarden_rs && pushd bitwarden_rs
cargo clean && cargo build --features sqlite --release
file target/release/bitwarden_rs
Create folder and move bitwarden_rs:
mkdir /opt/bitwarden
mkdir /opt/bitwarden/data
cd ~/bitwarden_rs/target/release
mv ~/bitwarden_rs/target/release/bitwarden_rs /opt/bitwarden
rm -r ~/bitwarden_rs
Create .env file and paste template configuration:
nano /opt/bitwarden/.env
Install WebVault
It is not needed to build WebVault, you can use one of the prepatched branches
Move to the bitwarden_rs release folder and download WebVault:
wget https://github.com/dani-garcia/bw_web_builds/releases/download/v2.18.1d/bw_web_v2.18.1d.tar.gz
Unpack and rename folder:
tar -xvf bw_web_v2.18.1d.tar.gz
mv bw_web_v2.18.1d.tar.gz web-vault
systemd service
Create a service file for bitwarden_rs:
nano /etc/systemd/system/bitwarden.service
And paste following:
[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/bitwarden_rs
# Only sqlite
After=network.target
[Service]
# The user/group bitwarden_rs is run under. the working directory (see below) should allow write and read access to this user/group
User=root
Group=root
# The location of the .env file for configuration
EnvironmentFile=/opt/bitwarden/.env
# The location of the compiled binary
ExecStart=/opt/bitwarden/bitwarden_rs
# Set reasonable connection and process limits
LimitNOFILE=1048576
# Isolate bitwarden_rs from the rest of the system
# PrivateTmp=true
# PrivateDevices=true
# ProtectHome=true
# ProtectSystem=strict
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
WorkingDirectory=/opt/bitwarden/data/
ReadWriteDirectories=/opt/bitwarden/data/
# Allow bitwarden_rs to bind ports in the range of 0-1024
#AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target
Start and check if service is running:
systemctl start bitwarden
systemctl status bitwarden
Enable service to start at boot:
systemctl enable bitwarden
