9 Using an alternate base dir

techsolo12 edited this page 2021-11-18 21:37:52 +01:00

Table of Contents

• Configuration
• Reverse proxying

Traditionally, Vaultwarden is limited to residing at the root of a subdomain, e.g. https://vaultwarden.example.com.

This limitation originates in the backend and web vault, which haven't been designed to accommodate alternate base dirs (see bitwarden/server#277). The mobile/desktop apps and browser extensions actually have no issues using a base URL with a path.

In vaultwarden, with the changes in PR#868 (backend) and PR#11 (web vault), you can configure a fully functional instance at an alternate base dir.

Configuration

Simply configure your domain URL to include the base dir. For example, suppose you want to access your instance at https://vaultwarden.example.com/base-dir. (Note that you can also use multiple levels of directories, like https://vaultwarden.example.com/multi/level/base/dirif you want.)

1. Stop vaultwarden.

2. If you normally configure vaultwarden using the admin page, edit your config.json to look as follows:

   {
     "domain": "https://vaultwarden.example.com/base-dir",
     // ... other values ...
   }
   

3. If you normally configure vaultwarden via environment variables, update your config files/scripts to set the DOMAIN environment variable to the base URL. For example:

   docker run -e DOMAIN="https://vaultwarden.example.com/base-dir" ...
   

4. Restart vaultwarden.

5. You should now be able to access the web vault at https://vaultwarden.example.com/base-dir/ (note the trailing slash). For reasons not entirely clear, you'll probably run into issues if you use https://vaultwarden.example.com/base-dir (without the trailing slash).

6. Configure your apps or browser extensions to use https://vaultwarden.example.com/base-dir. If you add a trailing slash, the apps and extensions will automatically remove it before saving.

7. Note over 5. The trailing slash / issue could be solved by appending / after the route location string. For example, in nginx.

   location /my-base-path {
     # This config would cause `/` issue
   }
   
   location /my-base-path-2/ {
     # This config works perfectly
   }
   

Reverse proxying

If you are putting vaultwarden behind a reverse proxy, make sure your proxy is configured to pass the request path through to vaultwarden, since the vaultwarden API routes are set up to expect the base dir. So if a request for https://vaultwarden.example.com/base-dir/api/sync hits your reverse proxy, which then proxies to your vaultwarden listening on localhost:8080, the request must go to http://localhost:8080/base-dir/api/sync, not http://localhost:8080/api/sync.

FAQs

1. FAQs
2. Audits

Container Image Usage

1. Which container image to use
2. Starting a container
3. Updating the vaultwarden image
4. Using Docker Compose
5. Using Podman

Deployment

1. Building your own docker image
2. Building binary
3. Pre-built binaries
4. Third-party packages
5. Deployment examples
6. Proxy examples
7. Logrotate example

HTTPS

1. Enabling HTTPS
2. Running a private vaultwarden instance with Let's Encrypt certs

Configuration

1. Overview
2. Disable registration of new users
3. Disable invitations
4. Enabling admin page
5. Disable the admin token
6. Enabling WebSocket notifications
7. Enabling Mobile Client push notification
8. Enabling U2F and FIDO2 WebAuthn authentication
9. Enabling YubiKey OTP authentication
10. Changing persistent data location
11. Changing the API request size limit
12. Changing the number of workers
13. SMTP configuration
14. Translating the email templates
15. Password hint display
16. Disabling or overriding the Vault interface hosting
17. Logging
18. Creating a systemd service
19. Syncing users from LDAP
20. Using an alternate base dir (subdir/subpath)
21. Other configuration

Database

1. Using the MariaDB (MySQL) Backend
2. Using the PostgreSQL Backend
3. Running without WAL enabled
4. Migrating from MariaDB (MySQL) to SQLite

Security

1. Hardening Guide
2. Fail2Ban Setup
3. Fail2Ban + ModSecurity + Traefik + Docker

Backup

1. General (not docker)

Other Information

1. Importing data from Keepass or KeepassX
2. Backing up your vault
3. Differences from the upstream API implementation
4. Supporting upstream development
5. Caddy 2.x with Cloudflare DNS