centersl/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-03-27 07:28:31 +07:00
Code Issues Packages Projects Releases Wiki Activity

Project renaming

Browse Source
This commit is contained in:
Daniel García
2021-04-27 23:41:57 +02:00
parent 8aceb9d8f8
commit 3bbd0b6de0
48 changed files with 349 additions and 349 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
Setup-as-a-systemd-service.md
View File

@@ -1,15 +1,15 @@
These instructions require you to have [[compiled the bitwarden_rs binary|Building-binary]]. If you generated a docker image, you may want to look at [[Running with systemd-docker | Running-with-systemd-docker]]
These instructions require you to have [[compiled the vaultwarden binary|Building-binary]]. If you generated a docker image, you may want to look at [[Running with systemd-docker | Running-with-systemd-docker]]
## Setup
Making bitwarden_rs start on system startup and use the other facilities of systemd (e.g. isolation, logging,...) requires a `.service` file. The following is a usable starting point:
Making vaultwarden start on system startup and use the other facilities of systemd (e.g. isolation, logging,...) requires a `.service` file. The following is a usable starting point:
```ini
[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/bitwarden_rs
Documentation=https://github.com/dani-garcia/vaultwarden
# If you use a database like mariadb,mysql or postgresql,
# you have to add them like the following and uncomment them
# by removing the `# ` before it. This makes sure that your
# database server is started before bitwarden_rs ("After") and has
# started successfully before starting bitwarden_rs ("Requires").
# database server is started before vaultwarden ("After") and has
# started successfully before starting vaultwarden ("Requires").
# Only sqlite
After=network.target
@@ -28,36 +28,36 @@ After=network.target
[Service]
# The user/group bitwarden_rs is run under. the working directory (see below) should allow write and read access to this user/group
User=bitwarden_rs
Group=bitwarden_rs
# The user/group vaultwarden is run under. the working directory (see below) should allow write and read access to this user/group
User=vaultwarden
Group=vaultwarden
# The location of the .env file for configuration
EnvironmentFile=/etc/bitwarden_rs.env
EnvironmentFile=/etc/vaultwarden.env
# The location of the compiled binary
ExecStart=/usr/bin/bitwarden_rs
ExecStart=/usr/bin/vaultwarden
# Set reasonable connection and process limits
LimitNOFILE=1048576
LimitNPROC=64
# Isolate bitwarden_rs from the rest of the system
# Isolate vaultwarden from the rest of the system
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
WorkingDirectory=/var/lib/bitwarden_rs
ReadWriteDirectories=/var/lib/bitwarden_rs
# Allow bitwarden_rs to bind ports in the range of 0-1024
WorkingDirectory=/var/lib/vaultwarden
ReadWriteDirectories=/var/lib/vaultwarden
# Allow vaultwarden to bind ports in the range of 0-1024
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target
```
Change all paths to match your installation (`WorkingDirectory` and `ReadWriteDirectory` should be the same),
name this file `bitwarden_rs.service` and put it into `/etc/systemd/system`.
name this file `vaultwarden.service` and put it into `/etc/systemd/system`.
If you have to change an existing systemd file (which was provided to you by the package you installed), you can add your changes by using
```
$ sudo systemctl edit bitwarden_rs.service
$ sudo systemctl edit vaultwarden.service
```
To make systemd aware of your new file or any changes you made, run
```
@@ -66,23 +66,23 @@ $ sudo systemctl daemon-reload
## Usage
To start this "service", run
```
$ sudo systemctl start bitwarden_rs.service
$ sudo systemctl start vaultwarden.service
```
To enable autostart, run
```
$ sudo systemctl enable bitwarden_rs.service
$ sudo systemctl enable vaultwarden.service
```
In the same way you can `stop`, `restart` and `disable` the service.
### Updating bitwarden_rs
After compiling the new version of bitwarden_rs, you can copy the compiled (new) binary and replace the existing (old) binary and then restart the service:
### Updating vaultwarden
After compiling the new version of vaultwarden, you can copy the compiled (new) binary and replace the existing (old) binary and then restart the service:
```
$ sudo systemctl restart bitwarden_rs.service
$ sudo systemctl restart vaultwarden.service
```
### Uninstalling bitwarden_rs
### Uninstalling vaultwarden
Before doing anything else, you should stop and disable the service:
```
$ sudo systemctl disable --now bitwarden_rs.service
$ sudo systemctl disable --now vaultwarden.service
```
Then you can delete the binary, the `.env` file, the web-vault folder (if installed) and the user data (if necessary). Remember to also remove specially created users,groups and firewall rules (if needed) and the systemd file.
@@ -94,19 +94,19 @@ $ sudo systemctl daemon-reload
### Logging and status view
If you want to see the logging output, run
```
$ journalctl -u bitwarden_rs.service
$ journalctl -u vaultwarden.service
```
or to see a more concise state of the service, run
```
$ systemctl status bitwarden_rs.service
$ systemctl status vaultwarden.service
```
## Troubleshooting
### Sandboxing options with older systemd versions
In RHEL 7 (and debian 8), the used systemd does not support some of the used isolation options. ([#445](https://github.com/dani-garcia/bitwarden_rs/issues/445),[#363](https://github.com/dani-garcia/bitwarden_rs/issues/363))
In RHEL 7 (and debian 8), the used systemd does not support some of the used isolation options. ([#445](https://github.com/dani-garcia/vaultwarden/issues/445),[#363](https://github.com/dani-garcia/vaultwarden/issues/363))
This can result in one of the following errors:
```
Failed at step NAMESPACE spawning /home/bitwarden_rs/bitwarden_rs: Permission denied
Failed at step NAMESPACE spawning /home/vaultwarden/vaultwarden: Permission denied
```
or
```
@@ -127,21 +127,21 @@ before (re-)starting your service.
### Service fails to start
The following error shows in the systemd journal (`journalctl -eu bitwarden_rs.service`):
The following error shows in the systemd journal (`journalctl -eu vaultwarden.service`):
```
Feb 18 05:29:10 staging-bitwarden systemd[1]: Started Bitwarden Server (Rust Edition).
Feb 18 05:29:10 staging-bitwarden systemd[49506]: bitwarden_rs.service: Failed to execute command: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[49506]: bitwarden_rs.service: Failed at step EXEC spawning /usr/bin/bitwarden_rs: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[1]: bitwarden_rs.service: Main process exited, code=exited, status=203/EXEC
Feb 18 05:29:10 staging-bitwarden systemd[1]: bitwarden_rs.service: Failed with result 'exit-code'.
Feb 18 05:29:10 staging-bitwarden systemd[49506]: vaultwarden.service: Failed to execute command: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[49506]: vaultwarden.service: Failed at step EXEC spawning /usr/bin/vaultwarden: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[1]: vaultwarden.service: Main process exited, code=exited, status=203/EXEC
Feb 18 05:29:10 staging-bitwarden systemd[1]: vaultwarden.service: Failed with result 'exit-code'.
```
This is known to occur when bitwarden_rs is running inside a container (LXC, et al) or natively. The parameter `LimitNPROC=64` in the service file prevents the service from starting. Commenting out that particular parameter results in the service starting correctly.
This is known to occur when vaultwarden is running inside a container (LXC, et al) or natively. The parameter `LimitNPROC=64` in the service file prevents the service from starting. Commenting out that particular parameter results in the service starting correctly.
**Note**: A systemd override file will not work, the line must be commented out/removed. The easiest way to do this is via
```
# systemctl edit --full bitwarden_rs.service
# systemctl edit --full vaultwarden.service
```
then reloading the daemon & restarting.