vps/hosts/us2.wsvc.info.md

us2.wsvc.info

Item	Value
Role	Multi-service VPS (Vaultwarden, Traefik, Soft Serve, …)
SSH	ssh -4 windy@us2.wsvc.info (prefer IPv4 from WSL)
IPv4	193.9.44.165
Also DNS	auth.wsvc.info → this host; repo.windy.me → this host (Soft Serve)
Public HTTPS	Traefik on :80 / :443 (/opt/traefik)

Vaultwarden (Bitwarden-compatible)

Status: operational (Postgres live, HTTPS 200, healthy containers, SMTP AUTH OK — last probe 2026-08-01 18:55 CST).

Upstream docs: docs/vaultwarden-upstream.md

Item	Value
Install path	/opt/vaultwarden
Compose	/opt/vaultwarden/docker-compose.yml
Env file	/opt/vaultwarden/.env
Admin overrides	/opt/vaultwarden/vw-data/config.json (wins over env)
Public URL / DOMAIN	https://auth.wsvc.info
Image	vaultwarden/server:1.37.1 (pinned)
Live DB	Postgres 16 (vw-db / service pg) via compose DATABASE_URL
Data (probe)	users=1, ciphers=1327
Cold SQLite	backups/sqlite-cold/db.sqlite3.pre-pg-20260801 (not used live)
Pre-migrate backup	backups/pre-pg-migrate-20260801_161204/
Data dir	./vw-data → /data (attachments, rsa keys, config.json)
DB backups	vaultwarden-backup → pg_dump daily 02:00 (scripts/backup.sh); latest e.g. backups/vaultwarden_2026-08-01_16-23-03.sql.gz
Reverse proxy	Traefik (vw-net) → Host(auth.wsvc.info), LE (auth.wsvc.info, valid → 2026-10-08)
SMTP	mx2.windy.me:587 STARTTLS (extra_hosts → 194.163.160.244); from zhiqiang@windy.me
SMTP secrets	Keep .env, vw-data/config.json, and .smtp-credentials in sync — config.json wins; drift breaks mail
IP header	X-Forwarded-For
Signups	disabled (signups_allowed=false); invitations allowed
pgweb	compose profile debug (stopped by default)
Secrets	.env, .admin-token, .smtp-credentials — never commit

Official documentation

Topic	Link
Config overview	https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview
Postgres / migration	https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend
SMTP	https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
Proxy / Traefik	https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
Full index	docs/vaultwarden-upstream.md

Stack

Container	Status
vaultwarden	Up (healthy), vaultwarden/server:1.37.1
vw-db	Up (healthy) — live Postgres
vaultwarden-backup	Up (pg_dump)
vaultwarden-pgweb	Exited (profile debug)

Effective config.json: domain https://auth.wsvc.info, SMTP 587/starttls to mx2.windy.me as zhiqiang@windy.me, ip_header=X-Forwarded-For. Password matched to .env (fixed 2026-08-01).

Client use

• Server URL: https://auth.wsvc.info
• Admin: https://auth.wsvc.info/admin

Ops / runbooks

• vaultwarden-health
• vaultwarden-sqlite-to-postgres
• vaultwarden-upstream docs

cd ansible
ansible-playbook playbooks/health-report.yml --limit vaultwarden
# after a reviewed Vaultwarden configuration change (and only if auth 404s):
ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
  -e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["vaultwarden"], "service_reconcile_restart_traefik": true}'

Other running services on this host

Container	Status	Image / notes
soft-serve	Up	ghcr.io/charmbracelet/soft-serve:latest (repo.windy.me:2222)
traefik	Up	traefik:v3.6.2 (/opt/traefik, public :80/:443)
nghttpx-proxy + squid-backend	Up	HTTP forward-proxy stack (/opt/nghttpx), network nghttpx_internal-net; details TBD

Directories for authelia, conduit, dendrite, mastodon, rustdesk, zitadel, etc. exist under /opt but have no running containers; treat them as dormant, not documented services.

Verified

Last checked: 2026-08-01 18:55 CST — operational.

• vaultwarden + vw-db healthy; DATABASE_URL → pg:5432/vaultwarden
• https://auth.wsvc.info/ 200, /admin 200, /api/config OK (disableUserRegistration: true)
• Identity wrong-password → 400 business error (DB readable, not 500)
• SMTP: container → mx2:587 OK; STARTTLS cert CN=mx2.windy.me; AUTH OK with effective config.json password (synced with .env / .smtp-credentials)
• LE cert CN=auth.wsvc.info
• PG counts: users=1, ciphers=1327