lasers/bitwarden_rs
1
0
Fork 0
mirror of https://github.com/dani-garcia/bitwarden_rs synced 2024-11-21 17:36:41 +01:00
Code Issues Projects Releases Wiki Activity
Page: Setup as a systemd service
Pages
Audits Backing up your vault Building binary Building your own docker image Caddy 2.x with Cloudflare DNS Changing persistent data location Changing the API request size limit Changing the number of workers Configuration overview Customize Vaultwarden CSS Deployment examples Differences from the upstream API implementation Disable admin token Disable invitations Disable registration of new users Disabling or overriding the Vault interface hosting Docker Traefik ModSecurity Setup Enable admin page Enabling HTTPS Enabling Mobile Client push notification Enabling U2F (and FIDO2 WebAuthn) authentication Enabling U2F authentication Enabling WebSocket notifications Enabling Yubikey OTP authentication Enabling admin page secure the admin_token Enabling admin page FAQs Fail2Ban Setup General (not docker) Hardening Guide Home Importing data from Keepass or KeepassX Kubernetes deployment Logging Logrotate example Migrating from MariaDB (MySQL) to SQLite Other configuration Password hint display Pre built binaries Private CA and self signed certs that work with Chrome Proxy examples Running a private vaultwarden instance with Let's Encrypt certs Running docker container with non root user Running without WAL enabled SMTP Configuration Setup as a systemd service Starting a Container Supporting upstream Syncing users from LDAP Testing SSO Third party packages Translating the email templates Updating the vaultwarden image Using Docker Compose Using Podman Using an alternate base dir Using the MariaDB (MySQL) Backend Using the MySQL Backend Using the PostgreSQL Backend Which container image to use
14 Setup as a systemd service
Rahil Bhimjiani edited this page 2024-02-22 20:30:09 +05:30
Table of Contents

These instructions require you to have compiled the vaultwarden binary. If you generated a docker image, you may want to look at Running with systemd-docker

Setup

Making vaultwarden start on system startup and use the other facilities of systemd (e.g. isolation, logging,...) requires a .service file. The following is a usable starting point:

[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/vaultwarden
# If you use a database like mariadb,mysql or postgresql, 
# you have to add them like the following and uncomment them 
# by removing the `# ` before it. This makes sure that your 
# database server is started before vaultwarden ("After") and has 
# started successfully before starting vaultwarden ("Requires").

# Only sqlite
After=network.target

# MariaDB
# After=network.target mariadb.service
# Requires=mariadb.service

# Mysql
# After=network.target mysqld.service
# Requires=mysqld.service

# PostgreSQL
# After=network.target postgresql.service
# Requires=postgresql.service


[Service]
# The user/group vaultwarden is run under. the working directory (see below) should allow write and read access to this user/group
User=vaultwarden
Group=vaultwarden
# Use an environment file for configuration.
EnvironmentFile=/etc/vaultwarden.env
# The location of the compiled binary
ExecStart=/usr/bin/vaultwarden
# Set reasonable connection and process limits
LimitNOFILE=1048576
LimitNPROC=64
# Isolate vaultwarden from the rest of the system
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
WorkingDirectory=/var/lib/vaultwarden
ReadWritePaths=/var/lib/vaultwarden

[Install]
WantedBy=multi-user.target

Change all paths to match your installation (WorkingDirectory and ReadWritePaths should be the same), name this file vaultwarden.service and put it into /etc/systemd/system.

If you have to change an existing systemd file (which was provided to you by the package you installed), you can add your changes by using

$ sudo systemctl edit vaultwarden.service

To make systemd aware of your new file or any changes you made, run

$ sudo systemctl daemon-reload

Usage

To start this "service", run

$ sudo systemctl start vaultwarden.service

To enable autostart, run

$ sudo systemctl enable vaultwarden.service

In the same way you can stop, restart and disable the service.

Updating vaultwarden

After compiling the new version of vaultwarden, you can copy the compiled (new) binary and replace the existing (old) binary and then restart the service:

$ sudo systemctl restart vaultwarden.service

Uninstalling vaultwarden

Before doing anything else, you should stop and disable the service:

$ sudo systemctl disable --now vaultwarden.service

Then you can delete the binary, the environment file, the web-vault folder (if installed) and the user data (if necessary). Remember to also remove specially created users,groups and firewall rules (if needed) and the systemd file.

After removing the systemd file you should make systemd aware of it via:

$ sudo systemctl daemon-reload

Logging and status view

If you want to see the logging output, run

$ journalctl -u vaultwarden.service

or to see a more concise state of the service, run

$ systemctl status vaultwarden.service

Troubleshooting

Sandboxing options with older systemd versions

In RHEL 7 (and debian 8), the used systemd does not support some of the used isolation options. (#445,#363) This can result in one of the following errors:

Failed at step NAMESPACE spawning /home/vaultwarden/vaultwarden: Permission denied

or

Failed to parse protect system value

To work around this you can comment out some or all of these settings by putting a # in front of the lines containing PrivateTmp, PrivateDevices, ProtectHome, ProtectSystem and ReadWritePaths. While commenting out all of them will probably work, it's not recommended as these are security measures which are good to have. To see which options your systemd supports, look at the output of

$ systemctl --version

to determine your systemd version and compare with systemd/NEWS.md.

After editing your .service file, don't forget to

$ sudo systemctl daemon-reload

before (re-)starting your service.

Service fails to start

The following error shows in the systemd journal (journalctl -eu vaultwarden.service):

Feb 18 05:29:10 staging-bitwarden systemd[1]: Started Bitwarden Server (Rust Edition).
Feb 18 05:29:10 staging-bitwarden systemd[49506]: vaultwarden.service: Failed to execute command: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[49506]: vaultwarden.service: Failed at step EXEC spawning /usr/bin/vaultwarden: Resource temporarily unavailable
Feb 18 05:29:10 staging-bitwarden systemd[1]: vaultwarden.service: Main process exited, code=exited, status=203/EXEC
Feb 18 05:29:10 staging-bitwarden systemd[1]: vaultwarden.service: Failed with result 'exit-code'.

This is known to occur when vaultwarden is running inside a container (LXC, et al) or natively. The parameter LimitNPROC=64 in the service file prevents the service from starting. Commenting out that particular parameter results in the service starting correctly.

Note: A systemd override file will not work, the line must be commented out/removed. The easiest way to do this is via

# systemctl edit --full vaultwarden.service

then reloading the daemon & restarting.

Environment variables are not loaded

Please note that systemd does not support comments in the same line as a variable in the EnvironmentFile=/etc/vaultwarden.env file (see #1607). In this environment file example the variable WEBSOCKET_ENABLED will not be loaded.

ROCKET_PORT=8080
WEBSOCKET_ENABLED=true # enable websocket

If you want same-line comments consider using /var/lib/vaultwarden/.env instead (which will also get rid of the .env file missing INFO on startup).

More information

For more information on .service files, see the manpages of systemd.service and (for the security configuration) systemd.exec

FAQs

  1. FAQs
  2. Audits

Container Image Usage

  1. Which container image to use
  2. Starting a container
  3. Updating the vaultwarden image
  4. Using Docker Compose
  5. Using Podman

Deployment

  1. Building your own docker image
  2. Building binary
  3. Pre-built binaries
  4. Third-party packages
  5. Deployment examples
  6. Proxy examples
  7. Logrotate example

HTTPS

  1. Enabling HTTPS
  2. Running a private vaultwarden instance with Let's Encrypt certs

Configuration

  1. Overview
  2. Disable registration of new users
  3. Disable invitations
  4. Enabling admin page
  5. Disable the admin token
  6. Enabling WebSocket notifications
  7. Enabling Mobile Client push notification
  8. Enabling U2F and FIDO2 WebAuthn authentication
  9. Enabling YubiKey OTP authentication
  10. Changing persistent data location
  11. Changing the API request size limit
  12. Changing the number of workers
  13. SMTP configuration
  14. Translating the email templates
  15. Password hint display
  16. Disabling or overriding the Vault interface hosting
  17. Logging
  18. Creating a systemd service
  19. Syncing users from LDAP
  20. Using an alternate base dir (subdir/subpath)
  21. Other configuration

Database

  1. Using the MariaDB (MySQL) Backend
  2. Using the PostgreSQL Backend
  3. Running without WAL enabled
  4. Migrating from MariaDB (MySQL) to SQLite

Security

  1. Hardening Guide
  2. Fail2Ban Setup
  3. Fail2Ban + ModSecurity + Traefik + Docker

Backup

  1. General (not docker)

Other Information

  1. Importing data from Keepass or KeepassX
  2. Backing up your vault
  3. Differences from the upstream API implementation
  4. Supporting upstream development
  5. Caddy 2.x with Cloudflare DNS