diff --git a/Proxy-examples.md b/Proxy-examples.md index 34ef7d5..95bfff6 100644 --- a/Proxy-examples.md +++ b/Proxy-examples.md @@ -110,7 +110,7 @@ You'll have to set `IP_HEADER` to `X-Forwarded-For` instead of `X-Real-IP` in th
-Nginx (by blackdex)
+Nginx - v1.29.0 (by blackdex)
```nginx # The `upstream` directives ensure that you have a http/1.1 connection @@ -122,10 +122,14 @@ upstream vaultwarden-default { server 127.0.0.1:8080; keepalive 2; } -upstream vaultwarden-ws { - zone vaultwarden-ws 64k; - server 127.0.0.1:3012; - keepalive 2; + +# Needed to support websocket connections +# See: https://nginx.org/en/docs/http/websocket.html +# Instead of "close" as stated in the above link we send an empty value. +# Else all keepalive connections will not work. +map $http_upgrade $connection_upgrade { + default upgrade; + '' ""; } # Redirect HTTP to HTTPS @@ -133,7 +137,11 @@ server { listen 80; listen [::]:80; server_name vaultwarden.example.tld; - return 301 https://$host$request_uri; + + if ($host = vaultwarden.example.tld) { + return 301 https://$host$request_uri; + } + return 404; } server { @@ -146,11 +154,12 @@ server { #ssl_certificate_key /path/to/certificate/letsencrypt/live/vaultwarden.example.tld/privkey.pem; #ssl_trusted_certificate /path/to/certificate/letsencrypt/live/vaultwarden.example.tld/fullchain.pem; - client_max_body_size 128M; + client_max_body_size 525M; location / { proxy_http_version 1.1; - proxy_set_header "Connection" ""; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -160,21 +169,6 @@ server { proxy_pass http://vaultwarden-default; } - # DO NOT add a trailing /, else you will experience issues - location /notifications/hub { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Forwarded $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_pass http://vaultwarden-ws; - } - # Optionally add extra authentication besides the ADMIN_TOKEN # Remove the comments below `#` and create the htpasswd_file to have it active # @@ -184,7 +178,8 @@ server { # auth_basic_user_file /path/to/htpasswd_file; # # proxy_http_version 1.1; - # proxy_set_header "Connection" ""; + # proxy_set_header Upgrade $http_upgrade; + # proxy_set_header Connection $connection_upgrade; # # proxy_set_header Host $host; # proxy_set_header X-Real-IP $remote_addr; @@ -208,7 +203,7 @@ If you run into 504 Gateway Timeout problems, tell nginx to wait longer for vaul
-Nginx with sub-path (by BlackDex)
+Nginx with sub-path - v1.29.0 (by BlackDex)
In this example vaultwarden will be available via https://bitwarden.example.tld/vault/
If you want to use any other sub-path, like `bitwarden` or `secret-vault` you should change `/vault/` in the example below to match.
@@ -217,7 +212,7 @@ For this to work you need to configure your `DOMAIN` variable to match so it sho ```ini ; Add the sub-path! Else this will not work! -DOMAIN=https://bitwarden.example.tld/vault/ +DOMAIN=https://vaultwarden.example.tld/vault/ ``` ```nginx @@ -230,28 +225,28 @@ upstream vaultwarden-default { server 127.0.0.1:8080; keepalive 2; } -upstream vaultwarden-ws { - zone vaultwarden-ws 64k; - server 127.0.0.1:3012; - keepalive 2; + +# Needed to support websocket connections +# See: https://nginx.org/en/docs/http/websocket.html +# Instead of "close" as stated in the above link we send an empty value. +# Else all keepalive connections will not work. +map $http_upgrade $connection_upgrade { + default upgrade; + '' ""; } # Redirect HTTP to HTTPS server { - if ($host = bitwarden.example.tld) { - return 301 https://$host$request_uri; - } - - listen 80; listen [::]:80; - server_name bitwarden.example.tld; + server_name vaultwarden.example.tld; + + if ($host = vaultwarden.example.tld) { + return 301 https://$host$request_uri; + } return 404; - - } - server { listen 443 ssl http2; listen [::]:443 ssl http2; @@ -262,50 +257,23 @@ server { #ssl_certificate_key /path/to/certificate/letsencrypt/live/vaultwarden.example.tld/privkey.pem; #ssl_trusted_certificate /path/to/certificate/letsencrypt/live/vaultwarden.example.tld/fullchain.pem; - client_max_body_size 128M; + client_max_body_size 525M; ## Using a Sub Path Config # Path to the root of your installation # Be sure to DO ADD a trailing /, else you will experience issues # But only for this location, all other locations should NOT add this. location /vault/ { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_pass http://vaultwarden-default; - } - - # DO NOT add a trailing /, else you will experience issues - location /vault/notifications/hub/negotiate { - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_pass http://vaultwarden-default; - } - - # DO NOT add a trailing /, else you will experience issues - location /vault/notifications/hub { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; + proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Forwarded $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - proxy_pass http://vaultwarden-ws; + proxy_pass http://vaultwarden-default; } # Optionally add extra authentication besides the ADMIN_TOKEN @@ -318,7 +286,8 @@ server { # auth_basic_user_file /path/to/htpasswd_file; # # proxy_http_version 1.1; - # proxy_set_header "Connection" ""; + # proxy_set_header Upgrade $http_upgrade; + # proxy_set_header Connection $connection_upgrade; # # proxy_set_header Host $host; # proxy_set_header X-Real-IP $remote_addr;