[self-hosted][bitwarden] 基于 pre-build binary file 和 nginx 搭建 (vaultwarden)bitwarden

闲来无事, 水个教程

恳请 精, 欢迎投喂

1. 提取可执行文件

不想装 docker, 官方没提供预编译二进制文件, 要自己从 docker image 中提取

官方给的代码如下 不要跑这个, 下面有一键脚本

mkdir vw-image
cd vw-image
wget https://raw.githubusercontent.com/jjlin/docker-image-extract/main/docker-image-extract
chmod  x docker-image-extract
./docker-image-extract vaultwarden/server:alpine
ls -ld output/{vaultwarden,web-vault}

只需要用到 ./output/vaultwarden 文件 和 ./output/web-vault/ 目录

注意 ./vaultwarden 运行目录下需要有 data/ 目录

2. 配置文件 .env

运行 vaultwarden 的时候默认会读取 .env 文件加载配置

简单解释下用到的配置

# 域名, 这里设置 sub-location 为 vaultwarden
# 需要配合 nginx 配置
DOMAIN=https://nodeseek.com/vaultwarden/

# 进入后台 **超级权限** 面板命令
# 需要通过 `./vaultwarden hash` 生成
ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$NLnz/Xmt8kyBsTziQ4uqG3EV2ScmD9QRkZkw k4kp94$S4c2Ke1KYhVoHp6idDkroAQx8XhyTCnoaEntAIElcps'

# 不允许注册新用户
# 个人用, 要加帐号直接通过管理员权限加
SIGNUPS_ALLOWED=false

# 懒得配置邮箱, 密码提示直接前端显示
SHOW_PASSWORD_HINT=true

3. nginx 配置 sub-location

如果你想通过域名直接访问(如 https://nodeseek.com), 那可以跳过这节

upstream vaultwarden-default {
        zone vaultwarden-default 64k;
        server 127.0.0.1:8000; # 记得对应你的端口
        keepalive 2;
}
upstream vaultwarden-ws {
        zone vaultwarden-ws 64k;
        server 127.0.0.1:3012; # 记得对应你的端口
        keepalive 2;
}

server {
        listen 443 ssl;
        server_name nodeseek.com;

        # 其他配置

                # vaultwarden
        location /vaultwarden/ {
                proxy_http_version 1.1;
                proxy_set_header "Connection" "";

                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_pass http://vaultwarden-default;
        }

        # DO NOT add a trailing /, else you will experience issues
        location /vaultwarden/notifications/hub/negotiate {
                proxy_http_version 1.1;
                proxy_set_header "Connection" "";

                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_pass http://vaultwarden-default;
        }

        # DO NOT add a trailing /, else you will experience issues
        location /vaultwarden/notifications/hub {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";

                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Forwarded $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_pass http://vaultwarden-ws;
        }

4. 配置 ubuntu/debian service

[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/vaultwarden

# Only sqlite
After=network.target

[Service]
EnvironmentFile=/etc/vaultwarden/.env
ExecStart=/usr/bin/vaultwarden
WorkingDirectory=/etc/vaultwarden/

[Install]
WantedBy=multi-user.target

5. 脚本

跑完下面的脚本后

• 可执行文件 vaultwarden 在 /usr/bin/ 目录下
• 你需要编写 /etc/vaultwarden/.env 文件
• 你需要配置 nginx
• 通过 systemctl start vaultwarden 命令开启服务

#!/bin/bash

if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit 1
fi

green_output() {
    echo -e "\033[0;32m$1\e[0m"
}

TMP=$(mktemp -d) && cd "$TMP" || exit

# extract docker image
wget https://raw.githubusercontent.com/jjlin/docker-image-extract/main/docker-image-extract
chmod  x ./docker-image-extract
./docker-image-extract vaultwarden/server:alpine
mkdir -p /etc/vaultwarden/data/
mv ./output/web-vault /etc/vaultwarden/
mv ./output/vaultwarden /usr/bin/
rm -rf "$TMP"

# config
cat >> /etc/vaultwarden/.env <> /etc/systemd/system/vaultwarden.service <<EOF
[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/vaultwarden

# Only sqlite
After=network.target

[Service]
EnvironmentFile=/etc/vaultwarden/.env
ExecStart=/usr/bin/vaultwarden
WorkingDirectory=/etc/vaultwarden/

[Install]
WantedBy=multi-user.target
EOF

systemctl enable vaultwarden

green_output 'vaultwarden has been installed'
green_output 'you need to edit /etc/vaultwarden/.env to add your domain and admin token'
green_output 'do not forget to config nginx'

6. tip

• 访问 DOMAIN/admin 来进入管理界面

  如果你的 DOMAIN 配置是 https://nodeseek.com 就进 https://nodeseek.com/admin

  如果是 https://nodeseek.com/vaultwarden/ 进 https://nodeseek.com/vaultwarden/admin

  一般不用进, 除了添加用户 (如果你允许新用户注册, 那这个界面基本不用进)

• 在管理界面输入邀请用户邮箱后, 该邮箱可直接注册

• 一定要开启 https

• 如果想隐藏服务, sublocation 可以设置的长一点

7. 声明

本教程基于 官方wiki