admin
d86e25662f
Vaultwarden treats defined-but-empty SMTP_HOST/SMTP_FROM as "set"; with upstream _enable_smtp defaulting true its validation errors out and the container crash-loops on every fresh deploy with app-email off (the default). Gate the SMTP group with _ENABLE_SMTP: compose default false (clean boot, mail off), flipped "true" by the app-email injection via smtp_mapping.extra. Proven on the pinned 1.33.2-alpine image (P1 repro exit 12 / P2 off boots / P3 on boots). REUSE.md: strict-image TRAP row. Sweep note: the other 5 smtp-mapped templates are campaign-boot-proven tolerant; no edits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
109 lines
3.8 KiB
YAML
109 lines
3.8 KiB
YAML
# =============================================================================
|
||
# .felhom.yml — App metadata for felhom-controller
|
||
# =============================================================================
|
||
# Place alongside docker-compose.yml in each stack directory:
|
||
# /opt/docker/stacks/vaultwarden/.felhom.yml
|
||
# =============================================================================
|
||
|
||
# --- Display info (shown on dashboard) ---
|
||
display_name: "Vaultwarden"
|
||
description: "Jelszókezelő (Bitwarden-kompatibilis)"
|
||
category: "security"
|
||
subdomain: "vault"
|
||
|
||
# --- Asset slug ---
|
||
slug: "vaultwarden"
|
||
|
||
# --- Resource hints (displayed on deploy screen) ---
|
||
resources:
|
||
mem_request: "50M"
|
||
mem_limit: "256M"
|
||
pi_compatible: true
|
||
needs_hdd: false
|
||
|
||
# --- Deploy fields ---
|
||
deploy_fields:
|
||
- env_var: DOMAIN
|
||
label: "Domain"
|
||
type: domain
|
||
description: "A szerver domain neve"
|
||
locked_after_deploy: true
|
||
|
||
- env_var: SUBDOMAIN
|
||
label: "Aldomain"
|
||
type: subdomain
|
||
default: "vault"
|
||
required: true
|
||
locked_after_deploy: true
|
||
description: "Az alkalmazás aldomainje"
|
||
|
||
- env_var: ADMIN_TOKEN
|
||
label: "Admin panel token"
|
||
type: secret
|
||
generate: "hex:32"
|
||
description: "Token az admin panel eléréséhez (https://vault.<domain>/admin)"
|
||
locked_after_deploy: true
|
||
|
||
- env_var: SIGNUPS_ALLOWED
|
||
label: "Regisztráció engedélyezése"
|
||
type: select
|
||
default: "true"
|
||
options:
|
||
- value: "true"
|
||
label: "Igen – regisztráció engedélyezve"
|
||
- value: "false"
|
||
label: "Nem – regisztráció lezárva"
|
||
description: "Új fiókok regisztrálásának engedélyezése. Az első fiók létrehozása után állítsd 'Nem'-re."
|
||
locked_after_deploy: false
|
||
|
||
# --- App info (info page content) ---
|
||
app_info:
|
||
tagline: 'Jelszókezelő - Bitwarden kompatibilis, a saját szerveren'
|
||
docs_url: 'https://github.com/dani-garcia/vaultwarden/wiki'
|
||
|
||
use_cases:
|
||
- 'Jelszavak biztonságos tárolása és automatikus kitöltése'
|
||
- 'Bitwarden kliensek teljes kompatibilitása (böngésző, mobil, asztali)'
|
||
- 'Jelszavak megosztása családtagokkal szervezeten belül'
|
||
- 'Kétfaktoros hitelesítés (TOTP) kódok tárolása'
|
||
- 'Biztonságos jegyzetek és bankkártya adatok tárolása'
|
||
|
||
first_steps:
|
||
- 'Nyisd meg a vault.DOMAIN címet a böngészőben'
|
||
- 'Hozd létre a fiókodat erős mesterjelszóval'
|
||
- 'Telepítsd a Bitwarden bővítményt a böngésződbe'
|
||
- 'Telepítsd a Bitwarden alkalmazást a telefonodra'
|
||
- 'Importáld a meglévő jelszavaidat (Chrome, Firefox, LastPass, stb.)'
|
||
|
||
|
||
# --- Controller-side health probe ---
|
||
healthcheck:
|
||
checks:
|
||
- type: api
|
||
port: 80
|
||
path: "/alive"
|
||
expect:
|
||
status: 200
|
||
|
||
# --- App-email mapping (apps → in-controller shim → hub → Resend) ---
|
||
# When app-email is on (global toggle + this app's per-app toggle), the controller injects
|
||
# the relay SMTP settings: host = the on-box shim, port = 2525, From = vaultwarden@felhom.eu.
|
||
# Vaultwarden uses STARTTLS to the shim and accepts its self-signed cert
|
||
# (SMTP_ACCEPT_INVALID_CERTS/HOSTNAMES). SMTP_USERNAME/SMTP_PASSWORD are intentionally left
|
||
# unset — the shim accepts no-auth on the Docker network and holds no Resend key.
|
||
smtp_mapping:
|
||
host_var: SMTP_HOST
|
||
port_var: SMTP_PORT
|
||
security_var: SMTP_SECURITY
|
||
security_value: starttls
|
||
from_var: SMTP_FROM
|
||
from_name_var: SMTP_FROM_NAME
|
||
from_local: vaultwarden
|
||
extra:
|
||
SMTP_ACCEPT_INVALID_CERTS: "true"
|
||
SMTP_ACCEPT_INVALID_HOSTNAMES: "true"
|
||
# Boot-gate for Vaultwarden's strict SMTP validation (campaign finding F1, 2026-07-06):
|
||
# the image errors out when SMTP_HOST/SMTP_FROM are defined-but-empty, so the compose
|
||
# default is _ENABLE_SMTP=false and this injection flips it on with the rest of the group.
|
||
_ENABLE_SMTP: "true"
|