vps/hosts/us2.wsvc.info.md

us2.wsvc.info

Item	Value
Role	Multi-service VPS (Vaultwarden, Traefik, Soft Serve, …)
SSH	ssh -4 windy@us2.wsvc.info (prefer IPv4 from WSL)
IPv4	193.9.44.165
Also DNS	auth.wsvc.info → this host; repo.windy.me → this host (Gitea)
Public HTTPS	Traefik on :80 / :443 (/opt/traefik)

Vaultwarden (Bitwarden-compatible)

Status: operational (Postgres live, HTTPS 200, healthy containers, SMTP AUTH OK — last probe 2026-08-29).

Upstream docs: docs/vaultwarden-upstream.md

Item	Value
Install path	/opt/vaultwarden
Compose	/opt/vaultwarden/docker-compose.yml
Env file	/opt/vaultwarden/.env
Admin overrides	/opt/vaultwarden/vw-data/config.json (wins over env)
Public URL / DOMAIN	https://auth.wsvc.info
Image	vaultwarden/server:1.37.2 (pinned)
Live DB	Postgres 16 (vw-db / service pg) via compose DATABASE_URL
Data (probe)	users=1, ciphers=1360
Cold SQLite	backups/sqlite-cold/db.sqlite3.pre-pg-20260801 (not used live)
Pre-migrate backup	backups/pre-pg-migrate-20260801_161204/
Data dir	./vw-data → /data (attachments, rsa keys, config.json)
DB backups	vaultwarden-backup → pg_dump daily 02:00 (scripts/backup.sh); latest e.g. backups/vaultwarden_2026-08-01_16-23-03.sql.gz
Reverse proxy	Traefik (vw-net) → Host(auth.wsvc.info), LE (auth.wsvc.info, valid → 2026-10-08)
SMTP	mx2.windy.me:587 STARTTLS (extra_hosts → 194.163.160.244); from zhiqiang@windy.me
SMTP secrets	Keep .env, vw-data/config.json, and .smtp-credentials in sync — config.json wins; drift breaks mail
IP header	X-Forwarded-For
Signups	disabled (signups_allowed=false); invitations allowed
pgweb	compose profile debug (stopped by default)
Secrets	.env, .admin-token, .smtp-credentials — never commit

Official documentation

Topic	Link
Config overview	https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview
Postgres / migration	https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend
SMTP	https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
Proxy / Traefik	https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
Full index	docs/vaultwarden-upstream.md

Stack

Container	Status
vaultwarden	Up (healthy), vaultwarden/server:1.37.2
vw-db	Up (healthy) — live Postgres
vaultwarden-backup	Up (pg_dump)
vaultwarden-pgweb	Exited (profile debug)

Effective config.json: domain https://auth.wsvc.info, SMTP 587/starttls to mx2.windy.me as zhiqiang@windy.me, ip_header=X-Forwarded-For. Password matched to .env (fixed 2026-08-01).

Client use

• Server URL: https://auth.wsvc.info
• Admin: https://auth.wsvc.info/admin

Ops / runbooks

• vaultwarden-health
• vaultwarden-sqlite-to-postgres
• vaultwarden-upstream docs

cd ansible
ansible-playbook playbooks/health-report.yml --limit vaultwarden
# after a reviewed Vaultwarden configuration change (and only if auth 404s):
ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
  -e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["vaultwarden"], "service_reconcile_restart_traefik": true}'

Other running services on this host

Container	Status	Image / notes
gitea	Up	gitea/gitea@sha256:1c17ecaead42e… (1.27.3-rootless) — SSH repo.windy.me:2222, web https://repo.windy.me
gitea-backup	Up	alpine + sqlite3/rsync sidecar (daily backup 02:00 / prune 03:00, crond)

Gitea (replaced Soft Serve 2026-09-18; Plane VPS-94)

• /opt/gitea/compose.yml (+ Dockerfile.backup, scripts/, config/app.ini, data/, secrets/, backups/); 镜像: compose/gitea/(参考, 服务器文件为准)
• rootless 镜像 uid 1000:1000; SQLite /opt/gitea/data/data/gitea.db; repos /opt/gitea/data/data/git/repositories/; app.ini /opt/gitea/config/app.ini(600, 含 SECRET_KEY)
• SSH: 内置 server 容器内 :2322(SSH_LISTEN_PORT 非特权), Traefik TCP entrypoint ssh(:2222 → gitea:2322, HostSNI(*), tls=false) on vw-net; clone URL ssh://git@repo.windy.me:2222/windy/<repo>.git(owner 段 windy)
• host key 复用 soft-serve(SSH_SERVER_HOST_KEYS=/secrets/soft_serve_host_ed25519, ed25519, 指纹 SHA256:PdxZRe74…): 客户端 known_hosts 零变更; 仅公钥认证(密码认证未启用)
• Web: https://repo.windy.me(Traefik websecure + letsencrypt); DISABLE_REGISTRATION=true, Actions 关闭; 管理员 windy(凭据仅存服务器 /opt/gitea/.admin-credentials, 勿入库/入 Plane)
• 仓库: 16 个(顶层 11 + cdia/ 4 + windyboy/go-caatsm), 2026-09-18 自 soft-serve push --mirror 迁移, 逐仓 ls-remote ref 全集 + HEAD symref 两端一致; 可见性仅 dotfiles-personal private, 其余 public(与 soft-serve 现状一致)
• 备份: sidecar 每日 02:00 → backups/gitea_<TS>/{app.ini.tar.gz, gitea.db, repos.tar.gz}(app.ini 含恢复必需 SECRET_KEY), 03:00 prune 保留 14 份; 已验证手动备份产物 109.9M
• 回滚: /opt/soft-serve 未删(compose stop + sidecar 停, 数据与旧备份冻结保留), 回滚 = Traefik :2222 指回 soft-serve:23231 + 客户端 remote 回改旧无 owner 段路径; 观察 2–4 周后清理(历史: W1N-244~248) | traefik | Up | traefik:v3.6.2 (/opt/traefik, public :80/:443) | | nghttpx-proxy + squid-backend | Up | HTTP forward-proxy stack (/opt/nghttpx), network nghttpx_internal-net; details TBD |

Disk cleanup 2026-09-18 (Plane vps VPS-93): root 71% → 23% (~33G freed) keeping soft-serve / vaultwarden / traefik (nghttpx kept running per operator choice). Removed: unused Docker images + orphan volumes (incl. zitadel_data 801M), dormant /opt dirs (dendrite + its disabled dendrite.service unit, mastodon, dailysync, keycloak, media-repo, authelia, conduit, npm, manager, fusion, zitadel, rustdesk), rootless podman storage (6.4G stale goauthentik), home dev caches, apt cache, journal 3.8G→162M (+SystemMaxUse=200M drop-in, active next boot), truncated container logs (nghttpx 550M / traefik / squid). Follow-up: nghttpx-proxy logs grow ~25M/day (INFO per-connection); root-cause log-level/rotation fix still open (needs container restart approval).

Remaining running services on this host: gitea, vaultwarden stack, traefik, nghttpx-proxy + squid-backend (undocumented forward proxy, /opt/nghttpx). /opt/soft-serve kept stopped as rollback (2–4 weeks, data intact). /home/windy/authelia (76M) left in place — outside approved cleanup scope.

Verified

Last checked: 2026-09-18 — operational; disk cleanup done (see note above, Plane vps VPS-93). Prior full probe: 2026-08-29.

• vaultwarden + vw-db healthy; DATABASE_URL → pg:5432/vaultwarden
• https://auth.wsvc.info/ 200, /admin 200, /api/config OK (disableUserRegistration: true)
• SMTP: container → mx2:587 OK; AUTH OK with effective config.json password (synced with .env / .smtp-credentials, fingerprint match)
• PG counts: users=1, ciphers=1360
• Image vaultwarden/server:1.37.2 (upgraded 2026-08-29 from 1.37.1; required for Bitwarden clients 2026.8.0+); post-upgrade 404 fixed by Traefik restart, then 200
• vps-health local check installed 2026-08-29 (vps-healthcheck.timer daily 06:15 + /usr/local/lib/vps-health/run); health-report.yml --limit vaultwarden now passes (ok, was failing due to missing check infra + script bugs fixed: trim_blocks render, pgweb debug-profile false positive, SMTP probe moved host-side since image lacks python3)