Updated README and added webserver sample configs

README.md

@@ -11,11 +11,16 @@ Make sure you have the required build dependencies:
 * git
 * patch
 * curl
+* apparmor
+
+```
+apt install docker.io git patch curl apparmor
+```
 
 Then:
 
 ```
-git clone https://github.com/greizgh/vaultwarden-debian.git
+git clone https://github.com/nisenbeck/vaultwarden-debian.git
 cd vaultwarden-debian
 ./build.sh -r <version> # target vaultwarden version, example 1.19.0
 ```
@@ -23,7 +28,7 @@ cd vaultwarden-debian
 The `build.sh` script will build vaultwarden for the same Debian version which targets vaultwarden.
 That means, to build vaultwarden v1.19.0, make sure to checkout tag `v1.19.0` of this project.
 
-To compile for a different Debian version, specify the release name (e.g. Buster, Bullseye) using the `-o` option. You can compile for arm32v7 or amd64 architecture using the `-a` option, only the Buster (default) release of debian is supported by arm32v7.
+To compile for a different Debian version, specify the release name (e.g. Buster, Bullseye) using the `-o` option. You can compile for arm32v7, arm64 and amd64 architecture using the `-a` option. Only the Buster (default) release of debian is supported by arm32v7.
 
 ```
 ./build.sh -o bullseye
@@ -35,7 +40,7 @@ The packaged systemd unit is **disabled**, you need to configure vaultwarden thr
 [EnvFile](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Command%20lines):
 `/etc/vaultwarden/config.env`
 
-You will also probably want to setup a reverse proxy.
+You will also probably want to setup a reverse proxy. See [webserver](./webserver) for examples.
 
 
 ## License

webserver/Apache-VirtualHost.example.conf

@@ -0,0 +1,38 @@
+#Required Apache modules:
+#headers, proxy, proxy_http, proxy_wstunnel, ssl, rewrite
+
+<VirtualHost *:80>
+        ServerName vaultwarden.example.com
+        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
+        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined
+
+        # Redirect to https    
+        RewriteEngine On
+        RewriteCond %{HTTPS} off
+        RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
+</VirtualHost>
+
+<VirtualHost *:443>
+	ServerName vaultwarden.example.com
+        ErrorLog ${APACHE_LOG_DIR}/vaultwarden-error.log
+        CustomLog ${APACHE_LOG_DIR}/vaultwarden-access.log combined
+
+        # Reverse Proxy
+	RewriteEngine On
+	RewriteCond %{HTTP:Upgrade} =websocket [NC]
+	RewriteRule /notifications/hub(.*) ws://127.0.0.1:3012/$1 [P,L]
+	ProxyPass / http://127.0.0.1:8000/
+
+	ProxyPreserveHost On
+	ProxyRequests Off
+	RequestHeader set X-Real-IP %{REMOTE_ADDR}s
+
+        # TLS
+	# Please generate a secure TLS configuration with the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
+	SSLEngine on
+        SSLCertificateFile /etc/ssl/certs/vaultwarden-fullchain.crt
+        SSLCertificateKeyFile /etc/ssl/private/vaultwarden.key
+
+        # HSTS
+	Header always set Strict-Transport-Security "max-age=63072000"
+</VirtualHost>

webserver/Nginx-VirtualHost.example.conf

@@ -0,0 +1,51 @@
+server {
+    listen 80;
+    server_name vaultwarden.example.com;
+
+    # Redirect to https
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name vaultwarden.example.com;
+
+    client_max_body_size 128M;
+
+    # TLS
+    # Please generate a secure TLS configuration with the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
+    ssl_certificate /etc/ssl/certs/vaultwarden-fullchain.crt;
+    ssl_certificate_key /etc/ssl/private/vaultwarden.key
+
+    # HSTS
+    add_header Strict-Transport-Security "max-age=63072000; preload";
+
+    # Reverse Proxy
+    resolver 127.0.0.1 valid=300s;
+    resolver_timeout 5s;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /notifications/hub {
+        proxy_pass http://127.0.0.1:3012;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location /notifications/hub/negotiate {
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://127.0.0.1:8000;
+    }
+}