Unverified Commit 2b9b8432 authored by Tom Moulard's avatar Tom Moulard Committed by GitHub
Browse files

Bitwarden admin panel hardening (#35)

parent 57d811ba

bitwarden/docker-compose.bitwarden.yml

+13 −2
Original line number Diff line number Diff line
@@ -5,8 +5,17 @@ services: 
    image: vaultwarden/server:latest

    user: nobody

    environment:

      - ROCKET_PORT=8080

      - ADMIN_TOKEN=${USERS}

      # to enable U2F and FIDO2 WebAuthn authentication

      - DOMAIN=https://bitwarden.${SITE:-localhost}

      - PASSWORD_ITERATIONS=500000

      - ROCKET_PORT=8080

      # whether users are allowed to create Bitwarden Sends/

      - SENDS_ALLOWED="true"

      - SIGNUPS_ALLOWED="true"

      # if new users need to verify their email address upon registration

      - SIGNUPS_VERIFY="false"

      - TZ=${TZ:-Europe/Paris}

    volumes:

      - ./bitwarden/data:/data

    networks:
@@ -14,5 +23,7 @@ services: 
    restart: always

    labels:

      - 'traefik.enable=true'

      - 'traefik.http.routers.bitwarden.rule=Host(`bitwarden.${SITE:-localhost}`)'

      - 'traefik.http.routers.bitwarden-user.rule=Host(`bitwarden.${SITE:-localhost}`) && !PathPrefix(`/admin`)'

      - 'traefik.http.routers.bitwarden-admin.rule=Host(`bitwarden.${SITE:-localhost}`) && PathPrefix(`/admin`)'

      - 'traefik.http.routers.bitwarden-admin.middlewares=basic_auth@docker'

      - 'traefik.http.services.bitwarden.loadbalancer.server.port=8080'

test_config.yml

+9 −1
Original line number Diff line number Diff line
@@ -52,11 +52,19 @@ services: 
  bitwarden:

    environment:

      ADMIN_TOKEN: ''

      DOMAIN: https://bitwarden.localhost

      PASSWORD_ITERATIONS: '500000'

      ROCKET_PORT: '8080'

      SENDS_ALLOWED: '"true"'

      SIGNUPS_ALLOWED: '"true"'

      SIGNUPS_VERIFY: '"false"'

      TZ: Europe/Paris

    image: vaultwarden/server:latest

    labels:

      traefik.enable: "true"

      traefik.http.routers.bitwarden.rule: Host(`bitwarden.localhost`)

      traefik.http.routers.bitwarden-admin.middlewares: basic_auth@docker

      traefik.http.routers.bitwarden-admin.rule: Host(`bitwarden.localhost`) && PathPrefix(`/admin`)

      traefik.http.routers.bitwarden-user.rule: Host(`bitwarden.localhost`) && !PathPrefix(`/admin`)

      traefik.http.services.bitwarden.loadbalancer.server.port: '8080'

    networks:

      srv: {}