mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-12-09 17:23:04 +03:00
My setup on docker Synology NAS. Is it correct this way? #2321
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @BobWs on GitHub.
So I have installed this image on docker Synology NAS and I have some questions about the setup.
This is my installation/setup for now:
Folders mapped:
docker/bw-data/ to /data/
Ports mapped:
Local port: 3012 to container port 3012
Local port: 81 to container port 80 (my local 80 port is in use by a webserver so I had to choose an alternative port)
The container is served behind an reverse proxy (to server SSL connection outside of the LAN with my own domain)
Reverse Proxy setup: (setup though Synology DSM GUI)
Source
Protocol: HTTPS
Hostname: vault.mydomain.com
Port: 443
Destination
Protocol: HTTP
Hostname: localhost
Port: 81
When browsing to https://vault.mydomain.com I see the Bitwarden Web UI and I can login and create creadentials etc. (desktop app and mobile apps all works fine)
But when I change the proxy destination port to 3012 I’m getting an error Web-socket page.
Also when browsing my-ip-address:3012 I’m getting the same error. Browsing my-ip-address:80 I see the Web UI.
This setup works fine for me, but I was wondering if this setup that is working for me is the right path or is it just dumb luck and that it isn't necessary to specify port 3012.
Also how do I fix the notification error warning?
error in the log file:
ERROR: '/notifications/hub' should be proxied towards the websocket server, otherwise notifications will not work. Go to the README for more info.
@fbartels commented on GitHub:
Hi @BobWs ,
the Nginx configuration ui of Synology is not sophisticated enough to manage the extra path for the websocket connection. But luckily you can also manage vhosts for Nginx manually, for this you only have to place the configuration file into
/usr/local/etc/nginx/sites-enabled.@BobWs commented on GitHub:
Hi @fbartels
Thanks for your help. I've created a proxy file and placed it in /usr/local/etc/nginx/sites-enabled
My file is called "bitwarden_proxy.conf" and looks like this:
server {
include conf.d/ssl/ssl.conf;
listen 443 ssl http2;
server_name vault.*;
location /notifications/hub/negotiate {
include conf.d/proxy-confs/proxy.conf;
proxy_pass http://localhost:81;
}
location / {
include conf.d/proxy-confs/proxy.conf;
proxy_pass http://localhost:81;
}
location /notifications/hub {
proxy_pass http://localhost:3012/api/websocket;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
But I still get the ERROR: '/notifications/hub' should be proxied towards the websocket server, otherwise notifications will not work. Go to the README for more info.
What am I doing wrong?
@mprasil commented on GitHub:
Your setup sounds wrong. You need to proxy just specific path to the
3012port, the rest should still be routed to81in your case. See documentation. I'm not sure how/if DSM GUI allows that setup though. Check out PROXY.md for how is it configured in other proxy servers.Note that the WebSockets configuration is not strictly necessary, it just enables live sync in Vault and browser extensions.
@mprasil commented on GitHub:
From the screenshot of proxy settings it doesn't look like that supports the required per-path setting. You might need to run another container with some other proxy, (say one of the servers we have sample configuration for) and then let synology to proxy that container instead to add HTTPS.
If you want to just use the Synology proxy, then you can't use WebSockets, which honestly isn't really that big deal unless you update your passwords couple times per hour. 😉
@BobWs commented on GitHub:
This is how it looks like on the synology:
What do I need to change? and where?
Thanks!
@BobWs commented on GitHub:
I copied from this link
https://github.com/dani-garcia/bitwarden_rs/blob/master/PROXY.md
I will give it a try!
@BobWs commented on GitHub:
Didn't make any difference Error still in log
@dani-garcia commented on GitHub:
I can't say that I know my way around nginx, but
proxy_pass http://localhost:3012/api/websocket;should probably be justproxy_pass http://localhost:3012;, like in all the other proxy examples. I'm not sure where the/api/websocketpart comes from.@dani-garcia commented on GitHub:
Is there a chance that it's still using the rule created in the GUI instead of the conf file? Other than that i don't have any idea.
@BobWs commented on GitHub:
So do I have to delete the GUI rule?
@dani-garcia commented on GitHub:
Probably something like this:
@BobWs commented on GitHub:
okay thanks I will give it a try!
@dani-garcia commented on GitHub:
I'm not sure, but maybe the GUI has precedence over the config file, so it's worth a shot, I think. Maybe reboot after the change just to make sure.
@BobWs commented on GitHub:
So I figure out that I was in the wrong place! /usr/local/etc/nginx/sites-enabled is not where the proxy file is.
This is the folder where I found the proxy file of synology GUI /etc/nginx/app.d
And this is the configuration what is inside the proxy file:
server {
listen 443 ssl;
listen [::]:443 ssl;
}
So can you please help me how to edit the file with the right configurations?
@fbartels commented on GitHub:
the one file you found was the file automatically created by the nginx gui, if you edit this, you changes will likely be overwritten by synology when you use the nginx gui to edit another host. while you may use it as a template, the update safe way would be to move your bitwarden nginx configuration into site-enabled.
@BobWs commented on GitHub:
So Synology has updated their GUI and there is now a setup preference for Web-socket within the reverse proxy GUI setup. I have again tried to setup notification, but it's still not working. Keep getting the error message
ERROR: '/notifications/hub' should be proxied towards the websocket server, otherwise notifications will not work. Go to the README for more info.What am I missing?
@mprasil commented on GitHub:
Unless you can configure it to forward this specific path:
/notifications/hubto the3012port and everything else including/notifications/hub/negotiateto port80, it won't work. From the screenshots it doesn't look like the GUI supports that level of configuration.@BobWs commented on GitHub:
@fbartels I Will give it another try today, changing the proxy file in /etc/nginx/app.d didn’t make any difference.
@dani-garcia commented on GitHub:
This hasn't had activity in some time, so I'm closing it now.
If this is still an issue, please reopen it.
@BobWs commented on GitHub:
Well it isn't working. When I create a proxy file in /usr/local/etc/nginx/sites-enabled and restart nginx my synology goes crazy and I get an error message: "DSM cannot start up normally because it ran into a problem. Please contact the Synology support team for help."
Then I remove the proxy conf file and restart nginx again and my Synology acts normal again. So It isn't working for my.
Guess I will have to stick with the non notification working version.
@Hobbabobba commented on GitHub:
If some users experience problems: remember to change the path to your certs, if you have can´t use the standard cert.
you will find all the certs of your diskstation in
/usr/syno/etc/certificate/_archive