jeff/portioner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Resolve Vaultwarden unprivileged port binding and update Admin Token docs

Browse Source
This commit is contained in:
Jeff Cheng
2026-02-22 18:38:38 -05:00
parent e6cbe70836
commit 1d7df93a94
3 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
vaultwarden/SETUP.md
View File

@@ -32,6 +32,11 @@ Vaultwarden is a lightweight, community-driven server implementation of the Bitw
- [ ] **Action**: In the Portainer Stack configuration, upload or define the variables from `stack.env`. - [ ] **Action**: In the Portainer Stack configuration, upload or define the variables from `stack.env`.
- Important: Ensure `DOMAIN` is set correctly for WebAuthn/FIDO2 to function. - Important: Ensure `DOMAIN` is set correctly for WebAuthn/FIDO2 to function.
- Temporary: Keep `SIGNUPS_ALLOWED=true` initially. - Temporary: Keep `SIGNUPS_ALLOWED=true` initially.
- [ ] **Action (Admin Token)**: The Vaultwarden Admin Panel requires a secure hash, not plain text. To generate it, SSH into your NAS and run:
```bash
docker run --rm -it vaultwarden/server vaultwarden hash
```
Enter your desired admin password, copy the generated `$$argon2id$$...` string, and paste it as the `ADMIN_TOKEN` value.
### Deploy Stack ### Deploy Stack
- [ ] **Action**: Create a new stack named `vaultwarden-stack`. - [ ] **Action**: Create a new stack named `vaultwarden-stack`.

4
vaultwarden/docker-compose.portainer.yml
View File

@@ -21,9 +21,11 @@ services:
- SMTP_PASSWORD=${SMTP_PASSWORD} - SMTP_PASSWORD=${SMTP_PASSWORD}
# Admin Panel # Admin Panel
- ADMIN_TOKEN=${ADMIN_TOKEN} - ADMIN_TOKEN=${ADMIN_TOKEN}
# Required for running as non-root (cannot bind to port 80)
- ROCKET_PORT=8080
volumes: volumes:
- /volume1/docker/vaultwarden/data:/data:rw - /volume1/docker/vaultwarden/data:/data:rw
ports: ports:
- "8020:80" # Web UI - "8020:8080" # Web UI
# Note: Vaultwarden integrates the WebSocket server into the main process in recent versions, # Note: Vaultwarden integrates the WebSocket server into the main process in recent versions,
# so exposing port 3012 is no longer required for typical setups unless using reverse proxy splitting. # so exposing port 3012 is no longer required for typical setups unless using reverse proxy splitting.

4
vaultwarden/stack.env
View File

@@ -19,7 +19,9 @@ SMTP_USERNAME=your_username
SMTP_PASSWORD=your_password SMTP_PASSWORD=your_password
# Admin Panel Token (Optional) # Admin Panel Token (Optional)
# Generate a secure hash using: vaultwarden hash # IMPORTANT: Do not use plain text! Generate a secure hash by running this command via SSH on your NAS:
# docker run --rm -it vaultwarden/server vaultwarden hash
# It will prompt for a password and output a hash. Paste the full hash below.
# Example: # Example:
# ADMIN_TOKEN=$$argon2id$$v=19... # ADMIN_TOKEN=$$argon2id$$v=19...
ADMIN_TOKEN=your_generated_admin_token ADMIN_TOKEN=your_generated_admin_token