Updated README and added webserver sample configs

2023-05-05 17:04:19 +02:00
parent 9ad722c6f3
commit 21426f710f
3 changed files with 97 additions and 3 deletions
@@ -0,0 +1,38 @@
+#Required Apache modules:
+#headers, proxy, proxy_http, proxy_wstunnel, ssl, rewrite
+
+<VirtualHost *:80>
+        ServerName vaultwarden.example.com
+        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
+        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined
+
+        # Redirect to https    
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
+</VirtualHost>
+
+<VirtualHost *:443>
+	ServerName vaultwarden.example.com
+        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
+        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined
+
+        # Reverse Proxy
+	RewriteEngine On
+	RewriteCond %{HTTP:Upgrade} =websocket [NC]
+	RewriteRule /notifications/hub(.*) ws://127.0.0.1:3012/$1 [P,L]
+	ProxyPass / http://127.0.0.1:8000/
+
+	ProxyPreserveHost On
+	ProxyRequests Off
+	RequestHeader set X-Real-IP %{REMOTE_ADDR}s
+
+        # TLS
+	# Please generate a secure TLS configuration with the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
+	SSLEngine on
+        SSLCertificateFile /etc/ssl/certs/vaultwarden-fullchain.crt
+        SSLCertificateKeyFile /etc/ssl/private/vaultwarden.key
+
+        # HSTS
+	Header always set Strict-Transport-Security "max-age=63072000"
+</VirtualHost>
@@ -0,0 +1,51 @@
+server {
+    listen 80;
+    server_name vaultwarden.example.com;
+
+    # Redirect to https
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name vaultwarden.example.com;
+
+    client_max_body_size 128M;
+
+    # TLS
+    # Please generate a secure TLS configuration with the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
+    ssl_certificate /etc/ssl/certs/vaultwarden-fullchain.crt;
+    ssl_certificate_key /etc/ssl/private/vaultwarden.key
+
+    # HSTS
+    add_header Strict-Transport-Security "max-age=63072000; preload";
+
+    # Reverse Proxy
+    resolver 127.0.0.1 valid=300s;
+    resolver_timeout 5s;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /notifications/hub {
+        proxy_pass http://127.0.0.1:3012;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location /notifications/hub/negotiate {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://127.0.0.1:8000;
+    }
+}