windyboy
e58283210a
- vaultwarden/server:1.37.1 -> 1.37.2 (required for Bitwarden clients 2026.8.0+) - compose probe: flag only active services (config --services) so debug-profile pgweb 'Exited' no longer false-positives - runner: build aggregate args line-by-line (robust vs Jinja trim_blocks) - SMTP AUTH probe moved host-side (vaultwarden image has no python3); never prints the SMTP password - us2 facts: probe refresh 2026-08-29, image/version, vps-health install
99 lines
5.1 KiB
Markdown
99 lines
5.1 KiB
Markdown
# us2.wsvc.info
|
|
|
|
| Item | Value |
|
|
|------|--------|
|
|
| Role | Multi-service VPS (Vaultwarden, Traefik, Soft Serve, …) |
|
|
| SSH | `ssh -4 windy@us2.wsvc.info` (prefer IPv4 from WSL) |
|
|
| IPv4 | `193.9.44.165` |
|
|
| Also DNS | `auth.wsvc.info` → this host; `repo.windy.me` → this host (Soft Serve) |
|
|
| Public HTTPS | Traefik on `:80` / `:443` (`/opt/traefik`) |
|
|
|
|
## Vaultwarden (Bitwarden-compatible)
|
|
|
|
**Status: operational** (Postgres live, HTTPS 200, healthy containers, SMTP AUTH OK — last probe 2026-08-29).
|
|
|
|
Upstream docs: [docs/vaultwarden-upstream.md](../docs/vaultwarden-upstream.md)
|
|
|
|
| Item | Value |
|
|
|------|--------|
|
|
| Install path | `/opt/vaultwarden` |
|
|
| Compose | `/opt/vaultwarden/docker-compose.yml` |
|
|
| Env file | `/opt/vaultwarden/.env` |
|
|
| Admin overrides | `/opt/vaultwarden/vw-data/config.json` (**wins over env**) |
|
|
| Public URL / `DOMAIN` | `https://auth.wsvc.info` |
|
|
| Image | `vaultwarden/server:1.37.2` (pinned) |
|
|
| Live DB | **Postgres 16** (`vw-db` / service `pg`) via compose `DATABASE_URL` |
|
|
| Data (probe) | users=1, ciphers=1360 |
|
|
| Cold SQLite | `backups/sqlite-cold/db.sqlite3.pre-pg-20260801` (not used live) |
|
|
| Pre-migrate backup | `backups/pre-pg-migrate-20260801_161204/` |
|
|
| Data dir | `./vw-data` → `/data` (attachments, rsa keys, `config.json`) |
|
|
| DB backups | `vaultwarden-backup` → `pg_dump` daily 02:00 (`scripts/backup.sh`); latest e.g. `backups/vaultwarden_2026-08-01_16-23-03.sql.gz` |
|
|
| Reverse proxy | Traefik (`vw-net`) → Host(`auth.wsvc.info`), LE (`auth.wsvc.info`, valid → 2026-10-08) |
|
|
| SMTP | `mx2.windy.me:587` STARTTLS (`extra_hosts` → 194.163.160.244); from `zhiqiang@windy.me` |
|
|
| SMTP secrets | Keep **`.env`**, **`vw-data/config.json`**, and **`.smtp-credentials`** in sync — `config.json` wins; drift breaks mail |
|
|
| IP header | `X-Forwarded-For` |
|
|
| Signups | disabled (`signups_allowed=false`); invitations allowed |
|
|
| pgweb | compose profile `debug` (stopped by default) |
|
|
| Secrets | `.env`, `.admin-token`, `.smtp-credentials` — **never commit** |
|
|
|
|
### Official documentation
|
|
|
|
| Topic | Link |
|
|
|-------|------|
|
|
| Config overview | https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview |
|
|
| Postgres / migration | https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend |
|
|
| SMTP | https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration |
|
|
| Proxy / Traefik | https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples |
|
|
| Full index | [docs/vaultwarden-upstream.md](../docs/vaultwarden-upstream.md) |
|
|
|
|
### Stack
|
|
|
|
| Container | Status |
|
|
|-----------|--------|
|
|
| `vaultwarden` | Up (healthy), `vaultwarden/server:1.37.2` |
|
|
| `vw-db` | Up (healthy) — **live** Postgres |
|
|
| `vaultwarden-backup` | Up (`pg_dump`) |
|
|
| `vaultwarden-pgweb` | Exited (profile `debug`) |
|
|
|
|
Effective `config.json`: domain `https://auth.wsvc.info`, SMTP 587/starttls to `mx2.windy.me` as `zhiqiang@windy.me`, `ip_header=X-Forwarded-For`. Password matched to `.env` (fixed 2026-08-01).
|
|
|
|
### Client use
|
|
|
|
- Server URL: `https://auth.wsvc.info`
|
|
- Admin: `https://auth.wsvc.info/admin`
|
|
|
|
### Ops / runbooks
|
|
|
|
- [vaultwarden-health](../runbooks/vaultwarden-health.md)
|
|
- [vaultwarden-sqlite-to-postgres](../runbooks/vaultwarden-sqlite-to-postgres.md)
|
|
- [vaultwarden-upstream docs](../docs/vaultwarden-upstream.md)
|
|
|
|
```bash
|
|
cd ansible
|
|
ansible-playbook playbooks/health-report.yml --limit vaultwarden
|
|
# after a reviewed Vaultwarden configuration change (and only if auth 404s):
|
|
ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
|
|
-e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["vaultwarden"], "service_reconcile_restart_traefik": true}'
|
|
```
|
|
|
|
## Other running services on this host
|
|
|
|
| Container | Status | Image / notes |
|
|
|-----------|--------|---------------|
|
|
| `soft-serve` | Up | `ghcr.io/charmbracelet/soft-serve:latest` (`repo.windy.me:2222`) |
|
|
| `traefik` | Up | `traefik:v3.6.2` (`/opt/traefik`, public `:80`/`:443`) |
|
|
| `nghttpx-proxy` + `squid-backend` | Up | HTTP forward-proxy stack (`/opt/nghttpx`), network `nghttpx_internal-net`; details TBD |
|
|
|
|
Directories for `authelia`, `conduit`, `dendrite`, `mastodon`, `rustdesk`, `zitadel`, etc. exist under `/opt` but have no running containers; treat them as dormant, not documented services.
|
|
|
|
## Verified
|
|
|
|
Last checked: **2026-08-29** — operational.
|
|
|
|
- `vaultwarden` + `vw-db` healthy; `DATABASE_URL` → `pg:5432/vaultwarden`
|
|
- `https://auth.wsvc.info/` **200**, `/admin` **200**, `/api/config` OK (`disableUserRegistration: true`)
|
|
- SMTP: container → `mx2:587` OK; **AUTH OK** with effective `config.json` password (synced with `.env` / `.smtp-credentials`, fingerprint match)
|
|
- PG counts: users=1, ciphers=1360
|
|
- Image `vaultwarden/server:1.37.2` (**upgraded 2026-08-29** from 1.37.1; required for Bitwarden clients 2026.8.0+); post-upgrade 404 fixed by Traefik restart, then 200
|
|
- vps-health local check **installed 2026-08-29** (`vps-healthcheck.timer` daily 06:15 + `/usr/local/lib/vps-health/run`); `health-report.yml --limit vaultwarden` now passes (**ok**, was failing due to missing check infra + script bugs fixed: trim_blocks render, pgweb debug-profile false positive, SMTP probe moved host-side since image lacks python3)
|