windyboy
e58283210a
- vaultwarden/server:1.37.1 -> 1.37.2 (required for Bitwarden clients 2026.8.0+) - compose probe: flag only active services (config --services) so debug-profile pgweb 'Exited' no longer false-positives - runner: build aggregate args line-by-line (robust vs Jinja trim_blocks) - SMTP AUTH probe moved host-side (vaultwarden image has no python3); never prints the SMTP password - us2 facts: probe refresh 2026-08-29, image/version, vps-health install
5.1 KiB
5.1 KiB
us2.wsvc.info
| Item | Value |
|---|---|
| Role | Multi-service VPS (Vaultwarden, Traefik, Soft Serve, …) |
| SSH | ssh -4 windy@us2.wsvc.info (prefer IPv4 from WSL) |
| IPv4 | 193.9.44.165 |
| Also DNS | auth.wsvc.info → this host; repo.windy.me → this host (Soft Serve) |
| Public HTTPS | Traefik on :80 / :443 (/opt/traefik) |
Vaultwarden (Bitwarden-compatible)
Status: operational (Postgres live, HTTPS 200, healthy containers, SMTP AUTH OK — last probe 2026-08-29).
Upstream docs: docs/vaultwarden-upstream.md
| Item | Value |
|---|---|
| Install path | /opt/vaultwarden |
| Compose | /opt/vaultwarden/docker-compose.yml |
| Env file | /opt/vaultwarden/.env |
| Admin overrides | /opt/vaultwarden/vw-data/config.json (wins over env) |
Public URL / DOMAIN |
https://auth.wsvc.info |
| Image | vaultwarden/server:1.37.2 (pinned) |
| Live DB | Postgres 16 (vw-db / service pg) via compose DATABASE_URL |
| Data (probe) | users=1, ciphers=1360 |
| Cold SQLite | backups/sqlite-cold/db.sqlite3.pre-pg-20260801 (not used live) |
| Pre-migrate backup | backups/pre-pg-migrate-20260801_161204/ |
| Data dir | ./vw-data → /data (attachments, rsa keys, config.json) |
| DB backups | vaultwarden-backup → pg_dump daily 02:00 (scripts/backup.sh); latest e.g. backups/vaultwarden_2026-08-01_16-23-03.sql.gz |
| Reverse proxy | Traefik (vw-net) → Host(auth.wsvc.info), LE (auth.wsvc.info, valid → 2026-10-08) |
| SMTP | mx2.windy.me:587 STARTTLS (extra_hosts → 194.163.160.244); from zhiqiang@windy.me |
| SMTP secrets | Keep .env, vw-data/config.json, and .smtp-credentials in sync — config.json wins; drift breaks mail |
| IP header | X-Forwarded-For |
| Signups | disabled (signups_allowed=false); invitations allowed |
| pgweb | compose profile debug (stopped by default) |
| Secrets | .env, .admin-token, .smtp-credentials — never commit |
Official documentation
| Topic | Link |
|---|---|
| Config overview | https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview |
| Postgres / migration | https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend |
| SMTP | https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration |
| Proxy / Traefik | https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples |
| Full index | docs/vaultwarden-upstream.md |
Stack
| Container | Status |
|---|---|
vaultwarden |
Up (healthy), vaultwarden/server:1.37.2 |
vw-db |
Up (healthy) — live Postgres |
vaultwarden-backup |
Up (pg_dump) |
vaultwarden-pgweb |
Exited (profile debug) |
Effective config.json: domain https://auth.wsvc.info, SMTP 587/starttls to mx2.windy.me as zhiqiang@windy.me, ip_header=X-Forwarded-For. Password matched to .env (fixed 2026-08-01).
Client use
- Server URL:
https://auth.wsvc.info - Admin:
https://auth.wsvc.info/admin
Ops / runbooks
cd ansible
ansible-playbook playbooks/health-report.yml --limit vaultwarden
# after a reviewed Vaultwarden configuration change (and only if auth 404s):
ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
-e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["vaultwarden"], "service_reconcile_restart_traefik": true}'
Other running services on this host
| Container | Status | Image / notes |
|---|---|---|
soft-serve |
Up | ghcr.io/charmbracelet/soft-serve:latest (repo.windy.me:2222) |
traefik |
Up | traefik:v3.6.2 (/opt/traefik, public :80/:443) |
nghttpx-proxy + squid-backend |
Up | HTTP forward-proxy stack (/opt/nghttpx), network nghttpx_internal-net; details TBD |
Directories for authelia, conduit, dendrite, mastodon, rustdesk, zitadel, etc. exist under /opt but have no running containers; treat them as dormant, not documented services.
Verified
Last checked: 2026-08-29 — operational.
vaultwarden+vw-dbhealthy;DATABASE_URL→pg:5432/vaultwardenhttps://auth.wsvc.info/200,/admin200,/api/configOK (disableUserRegistration: true)- SMTP: container →
mx2:587OK; AUTH OK with effectiveconfig.jsonpassword (synced with.env/.smtp-credentials, fingerprint match) - PG counts: users=1, ciphers=1360
- Image
vaultwarden/server:1.37.2(upgraded 2026-08-29 from 1.37.1; required for Bitwarden clients 2026.8.0+); post-upgrade 404 fixed by Traefik restart, then 200 - vps-health local check installed 2026-08-29 (
vps-healthcheck.timerdaily 06:15 +/usr/local/lib/vps-health/run);health-report.yml --limit vaultwardennow passes (ok, was failing due to missing check infra + script bugs fixed: trim_blocks render, pgweb debug-profile false positive, SMTP probe moved host-side since image lacks python3)