Merge 8b78065616 into 3608c4c7f8

ALL_README.md

@@ -5,4 +5,5 @@
 - [Irakurri README euskaraz](README_eu.md)
 - [Lire le README en français](README_fr.md)
 - [Le o README en galego](README_gl.md)
+- [Baca README dalam bahasa bahasa Indonesia](README_id.md)
 - [阅读中文（简体）的 README](README_zh_Hans.md)

README.md

@@ -21,7 +21,7 @@ Vaultwarden is a password manager, allowing generation and storage of passwords
 Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
 
 
-**Shipped version:** 1.29.1~ynh4
+**Shipped version:** 1.32.0~ynh1
 
 **Demo:** <https://vault.bitwarden.com/#/register>
 

README_es.md

@@ -21,7 +21,7 @@ Vaultwarden is a password manager, allowing generation and storage of passwords
 Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
 
 
-**Versión actual:** 1.29.1~ynh4
+**Versión actual:** 1.32.0~ynh1
 
 **Demo:** <https://vault.bitwarden.com/#/register>
 

README_eu.md

@@ -21,7 +21,7 @@ Vaultwarden is a password manager, allowing generation and storage of passwords
 Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
 
 
-**Paketatutako bertsioa:** 1.29.1~ynh4
+**Paketatutako bertsioa:** 1.32.0~ynh1
 
 **Demoa:** <https://vault.bitwarden.com/#/register>
 

README_fr.md

@@ -21,7 +21,7 @@ Vaultwarden est un gestionnaire de mots de passe, qui permet de générer et de
 Il existe des clients pour [Linux, macOS et Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), et comme module d'extension pour navigateur web. Il est aussi possible de gérer ses mot de passe depuis l'interface web.
 
 
-**Version incluse :** 1.29.1~ynh4
+**Version incluse :** 1.32.0~ynh1
 
 **Démo :** <https://vault.bitwarden.com/#/register>
 

README_gl.md

@@ -21,7 +21,7 @@ Vaultwarden is a password manager, allowing generation and storage of passwords
 Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
 
 
-**Versión proporcionada:** 1.29.1~ynh4
+**Versión proporcionada:** 1.32.0~ynh1
 
 **Demo:** <https://vault.bitwarden.com/#/register>
 

README_id.md

@@ -0,0 +1,52 @@
+<!--
+N.B.: README ini dibuat secara otomatis oleh <https://github.com/YunoHost/apps/tree/master/tools/readme_generator>
+Ini TIDAK boleh diedit dengan tangan.
+-->
+
+# Vaultwarden untuk YunoHost
+
+[![Tingkat integrasi](https://dash.yunohost.org/integration/vaultwarden.svg)](https://ci-apps.yunohost.org/ci/apps/vaultwarden/) ![Status kerja](https://ci-apps.yunohost.org/ci/badges/vaultwarden.status.svg) ![Status pemeliharaan](https://ci-apps.yunohost.org/ci/badges/vaultwarden.maintain.svg)
+
+[![Pasang Vaultwarden dengan YunoHost](https://install-app.yunohost.org/install-with-yunohost.svg)](https://install-app.yunohost.org/?app=vaultwarden)
+
+*[Baca README ini dengan bahasa yang lain.](./ALL_README.md)*
+
+> *Paket ini memperbolehkan Anda untuk memasang Vaultwarden secara cepat dan mudah pada server YunoHost.*  
+> *Bila Anda tidak mempunyai YunoHost, silakan berkonsultasi dengan [panduan](https://yunohost.org/install) untuk mempelajari bagaimana untuk memasangnya.*
+
+## Ringkasan
+
+Vaultwarden is a password manager, allowing generation and storage of passwords in a secure way. These are protected by a single password called the "master password".
+
+Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
+
+
+**Versi terkirim:** 1.32.0~ynh1
+
+**Demo:** <https://vault.bitwarden.com/#/register>
+
+## Tangkapan Layar
+
+![Tangkapan Layar pada Vaultwarden](./doc/screenshots/screenshot1.png)
+
+## Dokumentasi dan sumber daya
+
+- Dokumentasi pengguna resmi: <https://help.bitwarden.com/>
+- Dokumentasi admin resmi: <https://github.com/dani-garcia/vaultwarden/wiki>
+- Depot kode aplikasi hulu: <https://github.com/dani-garcia/vaultwarden>
+- Gudang YunoHost: <https://apps.yunohost.org/app/vaultwarden>
+- Laporkan bug: <https://github.com/YunoHost-Apps/vaultwarden_ynh/issues>
+
+## Info developer
+
+Silakan kirim pull request ke [`testing` branch](https://github.com/YunoHost-Apps/vaultwarden_ynh/tree/testing).
+
+Untuk mencoba branch `testing`, silakan dilanjutkan seperti:
+
+```bash
+sudo yunohost app install https://github.com/YunoHost-Apps/vaultwarden_ynh/tree/testing --debug
+atau
+sudo yunohost app upgrade vaultwarden -u https://github.com/YunoHost-Apps/vaultwarden_ynh/tree/testing --debug
+```
+
+**Info lebih lanjut mengenai pemaketan aplikasi:** <https://yunohost.org/packaging_apps>

README_zh_Hans.md

@@ -21,7 +21,7 @@ Vaultwarden is a password manager, allowing generation and storage of passwords
 Clients exist for [Linux, macOS and Windows](https://bitwarden.com/#download), [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden), [iOS](https://itunes.apple.com/app/bitwarden-free-password-manager/id1137397744?mt=8), and as a web browser plug-ins. It is also possible to manage passwords from the web interface.
 
 
-**分发版本：** 1.29.1~ynh4
+**分发版本：** 1.32.0~ynh1
 
 **演示：** <https://vault.bitwarden.com/#/register>
 

conf/nginx.conf

@@ -7,22 +7,13 @@ location __PATH__/ {
   # Common parameter to increase upload size limit in conjunction with dedicated php-fpm file
   client_max_body_size 100M;
 
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade $http_upgrade;
+  proxy_set_header Connection $connection_upgrade;
+
   proxy_set_header Host $host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_pass http://127.0.0.1:__PORT_ROCKET__;
 }
-
-location __INSTALL_DIR__/notifications/hub {
-  proxy_set_header Host $host;
-  proxy_set_header X-Real-IP $remote_addr;
-  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-  proxy_set_header Upgrade $http_upgrade;
-  proxy_set_header Connection "upgrade";
-  proxy_pass http://127.0.0.1:__PORT_WEBSOCKET__;
-}
-
-location __INSTALL_DIR__/notifications/hub/negotiate {
-  proxy_pass http://127.0.0.1:__PORT_ROCKET__;
-}

conf/vaultwarden.env

@@ -1,30 +1,72 @@
+# shellcheck disable=SC2034,SC2148
 ## Vaultwarden Configuration File
 ## Uncomment any of the following lines to change the defaults
 ##
 ## Be aware that most of these settings will be overridden if they were changed
 ## in the admin interface. Those overrides are stored within DATA_FOLDER/config.json .
 ##
-## By default, vaultwarden expects for this file to be named ".env" and located
+## By default, Vaultwarden expects for this file to be named ".env" and located
 ## in the current working directory. If this is not the case, the environment
 ## variable ENV_FILE can be set to the location of this file prior to starting
-## vaultwarden.
+## Vaultwarden.
+
+####################
+### Data folders ###
+####################
 
 ## Main data folder
-DATA_FOLDER=__DATA_DIR__
+# DATA_FOLDER=data
+
+## Individual folders, these override %DATA_FOLDER%
+# RSA_KEY_FILENAME=data/rsa_key
+# ICON_CACHE_FOLDER=data/icon_cache
+# ATTACHMENTS_FOLDER=data/attachments
+# SENDS_FOLDER=data/sends
+# TMP_FOLDER=data/tmp
+
+## Templates data folder, by default uses embedded templates
+## Check source code to see the format
+# TEMPLATES_FOLDER=data/templates
+## Automatically reload the templates for every request, slow, use only for development
+# RELOAD_TEMPLATES=false
+
+## Web vault settings
+# WEB_VAULT_FOLDER=web-vault/
+# WEB_VAULT_ENABLED=true
+
+#########################
+### Database settings ###
+#########################
 
 ## Database URL
 ## When using SQLite, this is the path to the DB file, default to %DATA_FOLDER%/db.sqlite3
 # DATABASE_URL=data/db.sqlite3
 ## When using MySQL, specify an appropriate connection URI.
-## Details: https://docs.diesel.rs/diesel/mysql/struct.MysqlConnection.html
+## Details: https://docs.diesel.rs/2.1.x/diesel/mysql/struct.MysqlConnection.html
 # DATABASE_URL=mysql://user:password@host[:port]/database_name
 ## When using PostgreSQL, specify an appropriate connection URI (recommended)
 ## or keyword/value connection string.
 ## Details:
-## - https://docs.diesel.rs/diesel/pg/struct.PgConnection.html
+## - https://docs.diesel.rs/2.1.x/diesel/pg/struct.PgConnection.html
 ## - https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
 # DATABASE_URL=postgresql://user:password@host[:port]/database_name
 
+## Enable WAL for the DB
+## Set to false to avoid enabling WAL during startup.
+## Note that if the DB already has WAL enabled, you will also need to disable WAL in the DB,
+## this setting only prevents Vaultwarden from automatically enabling it on start.
+## Please read project wiki page about this setting first before changing the value as it can
+## cause performance degradation or might render the service unable to start.
+# ENABLE_DB_WAL=true
+
+## Database connection retries
+## Number of times to retry the database connection during startup, with 1 second delay between each retry, set to 0 to retry indefinitely
+# DB_CONNECTION_RETRIES=15
+
+## Database timeout
+## Timeout when acquiring database connection
+# DATABASE_TIMEOUT=30
+
 ## Database max connections
 ## Define the size of the connection pool used for connecting to the database.
 # DATABASE_MAX_CONNS=10
@@ -38,53 +80,44 @@ DATA_FOLDER=__DATA_DIR__
 ## - PostgreSQL: ""
 # DATABASE_CONN_INIT=""
 
-## Individual folders, these override %DATA_FOLDER%
+#################
-# RSA_KEY_FILENAME=data/rsa_key
+### WebSocket ###
-# ICON_CACHE_FOLDER=data/icon_cache
+#################
-# ATTACHMENTS_FOLDER=data/attachments
-# SENDS_FOLDER=data/sends
-# TMP_FOLDER=data/tmp
 
-## Templates data folder, by default uses embedded templates
+## Enable websocket notifications
-## Check source code to see the format
+# ENABLE_WEBSOCKET=true
-# TEMPLATES_FOLDER=/path/to/templates
-## Automatically reload the templates for every request, slow, use only for development
-# RELOAD_TEMPLATES=false
 
-## Client IP Header, used to identify the IP of the client, defaults to "X-Real-IP"
+##########################
-## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
+### Push notifications ###
-# IP_HEADER=X-Real-IP
+##########################
 
-## Cache time-to-live for successfully obtained icons, in seconds (0 is "forever")
+## Enables push notifications (requires key and id from https://bitwarden.com/host)
-# ICON_CACHE_TTL=2592000
+## If you choose "European Union" Data Region, uncomment PUSH_RELAY_URI and PUSH_IDENTITY_URI then replace .com by .eu
-## Cache time-to-live for icons which weren't available, in seconds (0 is "forever")
+## Details about mobile client push notification:
-# ICON_CACHE_NEGTTL=259200
+## - https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification
+# PUSH_ENABLED=false
+# PUSH_INSTALLATION_ID=CHANGEME
+# PUSH_INSTALLATION_KEY=CHANGEME
+## Don't change this unless you know what you're doing.
+# PUSH_RELAY_URI=https://push.bitwarden.com
+# PUSH_IDENTITY_URI=https://identity.bitwarden.com
 
-## Web vault settings
+#####################
-WEB_VAULT_FOLDER=web-vault/
+### Schedule jobs ###
-WEB_VAULT_ENABLED=true
+#####################
-
-## Enables websocket notifications
-WEBSOCKET_ENABLED=true
-
-## Controls the WebSocket server address and port
-WEBSOCKET_ADDRESS=127.0.0.1
-WEBSOCKET_PORT=__PORT_WEBSOCKET__
-
-## Controls whether users are allowed to create Bitwarden Sends.
-## This setting applies globally to all users.
-## To control this on a per-org basis instead, use the "Disable Send" org policy.
-# SENDS_ALLOWED=true
-
-## Controls whether users can enable emergency access to their accounts.
-## This setting applies globally to all users.
-# EMERGENCY_ACCESS_ALLOWED=true
 
 ## Job scheduler settings
 ##
 ## Job schedules use a cron-like syntax (as parsed by https://crates.io/crates/cron),
 ## and are always in terms of UTC time (regardless of your local time zone settings).
 ##
+## The schedule format is a bit different from crontab as crontab does not contains seconds.
+## You can test the the format here: https://crontab.guru, but remove the first digit!
+## SEC  MIN   HOUR   DAY OF MONTH    MONTH   DAY OF WEEK
+## "0   30   9,12,15     1,15       May-Aug  Mon,Wed,Fri"
+## "0   30     *          *            *          *     "
+## "0   30     1          *            *          *     "
+##
 ## How often (in ms) the job scheduler thread checks for jobs that need running.
 ## Set to 0 to globally disable scheduled jobs.
 # JOB_POLL_INTERVAL_MS=30000
@@ -102,45 +135,157 @@ WEBSOCKET_PORT=__PORT_WEBSOCKET__
 # INCOMPLETE_2FA_SCHEDULE="30 * * * * *"
 ##
 ## Cron schedule of the job that sends expiration reminders to emergency access grantors.
-## Defaults to hourly (5 minutes after the hour). Set blank to disable this job.
+## Defaults to hourly (3 minutes after the hour). Set blank to disable this job.
-# EMERGENCY_NOTIFICATION_REMINDER_SCHEDULE="0 5 * * * *"
+# EMERGENCY_NOTIFICATION_REMINDER_SCHEDULE="0 3 * * * *"
 ##
 ## Cron schedule of the job that grants emergency access requests that have met the required wait time.
-## Defaults to hourly (5 minutes after the hour). Set blank to disable this job.
+## Defaults to hourly (7 minutes after the hour). Set blank to disable this job.
-# EMERGENCY_REQUEST_TIMEOUT_SCHEDULE="0 5 * * * *"
+# EMERGENCY_REQUEST_TIMEOUT_SCHEDULE="0 7 * * * *"
+##
+## Cron schedule of the job that cleans old events from the event table.
+## Defaults to daily. Set blank to disable this job. Also without EVENTS_DAYS_RETAIN set, this job will not start.
+# EVENT_CLEANUP_SCHEDULE="0 10 0 * * *"
+## Number of days to retain events stored in the database.
+## If unset (the default), events are kept indefinitely and the scheduled job is disabled!
+# EVENTS_DAYS_RETAIN=
+##
+## Cron schedule of the job that cleans old auth requests from the auth request.
+## Defaults to every minute. Set blank to disable this job.
+# AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 
-## Enable extended logging, which shows timestamps and targets in the logs
+########################
-# EXTENDED_LOGGING=true
+### General settings ###
+########################
 
-## Timestamp format used in extended logging.
+## Domain settings
-## Format specifiers: https://docs.rs/chrono/latest/chrono/format/strftime
+## The domain must match the address from where you access the server
-# LOG_TIMESTAMP_FORMAT="%Y-%m-%d %H:%M:%S.%3f"
+## It's recommended to configure this value, otherwise certain functionality might not work,
+## like attachment downloads, email links and U2F.
+## For U2F to work, the server must use HTTPS, you can use Let's Encrypt for free certs
+## To use HTTPS, the recommended way is to put Vaultwarden behind a reverse proxy
+## Details:
+## - https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS
+## - https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples
+## For development
+# DOMAIN=http://localhost
+## For public server
+# DOMAIN=https://vw.domain.tld
+## For public server (URL with port number)
+# DOMAIN=https://vw.domain.tld:8443
+## For public server (URL with path)
+# DOMAIN=https://domain.tld/vw
 
-## Logging to file
+## Controls whether users are allowed to create Bitwarden Sends.
-LOG_FILE=/var/log/__APP__/__APP__.log
+## This setting applies globally to all users.
+## To control this on a per-org basis instead, use the "Disable Send" org policy.
+# SENDS_ALLOWED=true
 
-## Logging to Syslog
+## HIBP Api Key
-## This requires extended logging
+## HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
-# USE_SYSLOG=false
+# HIBP_API_KEY=
 
-## Log level
+## Per-organization attachment storage limit (KB)
-## Change the verbosity of the log output
+## Max kilobytes of attachment storage allowed per organization.
-## Valid values are "trace", "debug", "info", "warn", "error" and "off"
+## When this limit is reached, organization members will not be allowed to upload further attachments for ciphers owned by that organization.
-## Setting it to "trace" or "debug" would also show logs for mounted
+# ORG_ATTACHMENT_LIMIT=
-## routes and static file, websocket and alive requests
+## Per-user attachment storage limit (KB)
-# LOG_LEVEL=Info
+## Max kilobytes of attachment storage allowed per user.
+## When this limit is reached, the user will not be allowed to upload further attachments.
+# USER_ATTACHMENT_LIMIT=
+## Per-user send storage limit (KB)
+## Max kilobytes of send storage allowed per user.
+## When this limit is reached, the user will not be allowed to upload further sends.
+# USER_SEND_LIMIT=
 
-## Enable WAL for the DB
+## Number of days to wait before auto-deleting a trashed item.
-## Set to false to avoid enabling WAL during startup.
+## If unset (the default), trashed items are not auto-deleted.
-## Note that if the DB already has WAL enabled, you will also need to disable WAL in the DB,
+## This setting applies globally, so make sure to inform all users of any changes to this setting.
-## this setting only prevents vaultwarden from automatically enabling it on start.
+# TRASH_AUTO_DELETE_DAYS=
-## Please read project wiki page about this setting first before changing the value as it can
-## cause performance degradation or might render the service unable to start.
-# ENABLE_DB_WAL=true
 
-## Database connection retries
+## Number of minutes to wait before a 2FA-enabled login is considered incomplete,
-## Number of times to retry the database connection during startup, with 1 second delay between each retry, set to 0 to retry indefinitely
+## resulting in an email notification. An incomplete 2FA login is one where the correct
-# DB_CONNECTION_RETRIES=15
+## master password was provided but the required 2FA step was not completed, which
+## potentially indicates a master password compromise. Set to 0 to disable this check.
+## This setting applies globally to all users.
+# INCOMPLETE_2FA_TIME_LIMIT=3
+
+## Disable icon downloading
+## Set to true to disable icon downloading in the internal icon service.
+## This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
+## network requests. $ICON_CACHE_TTL must also be set to 0; otherwise, the existing icons
+## will be deleted eventually, but won't be downloaded again.
+# DISABLE_ICON_DOWNLOAD=false
+
+## Controls if new users can register
+# SIGNUPS_ALLOWED=true
+
+## Controls if new users need to verify their email address upon registration
+## Note that setting this option to true prevents logins until the email address has been verified!
+## The welcome email will include a verification link, and login attempts will periodically
+## trigger another verification email to be sent.
+# SIGNUPS_VERIFY=false
+
+## If SIGNUPS_VERIFY is set to true, this limits how many seconds after the last time
+## an email verification link has been sent another verification email will be sent
+# SIGNUPS_VERIFY_RESEND_TIME=3600
+
+## If SIGNUPS_VERIFY is set to true, this limits how many times an email verification
+## email will be re-sent upon an attempted login.
+# SIGNUPS_VERIFY_RESEND_LIMIT=6
+
+## Controls if new users from a list of comma-separated domains can register
+## even if SIGNUPS_ALLOWED is set to false
+# SIGNUPS_DOMAINS_WHITELIST=example.com,example.net,example.org
+
+## Controls whether event logging is enabled for organizations
+## This setting applies to organizations.
+## Disabled by default. Also check the EVENT_CLEANUP_SCHEDULE and EVENTS_DAYS_RETAIN settings.
+# ORG_EVENTS_ENABLED=false
+
+## Controls which users can create new orgs.
+## Blank or 'all' means all users can create orgs (this is the default):
+# ORG_CREATION_USERS=
+## 'none' means no users can create orgs:
+# ORG_CREATION_USERS=none
+## A comma-separated list means only those users can create orgs:
+# ORG_CREATION_USERS=admin1@example.com,admin2@example.com
+
+## Invitations org admins to invite users, even when signups are disabled
+# INVITATIONS_ALLOWED=true
+## Name shown in the invitation emails that don't come from a specific organization
+# INVITATION_ORG_NAME=Vaultwarden
+
+## The number of hours after which an organization invite token, emergency access invite token,
+## email verification token and deletion request token will expire (must be at least 1)
+# INVITATION_EXPIRATION_HOURS=120
+
+## Controls whether users can enable emergency access to their accounts.
+## This setting applies globally to all users.
+# EMERGENCY_ACCESS_ALLOWED=true
+
+## Controls whether users can change their email.
+## This setting applies globally to all users
+# EMAIL_CHANGE_ALLOWED=true
+
+## Number of server-side passwords hashing iterations for the password hash.
+## The default for new users. If changed, it will be updated during login for existing users.
+# PASSWORD_ITERATIONS=600000
+
+## Controls whether users can set password hints. This setting applies globally to all users.
+# PASSWORD_HINTS_ALLOWED=true
+
+## Controls whether a password hint should be shown directly in the web page if
+## SMTP service is not configured. Not recommended for publicly-accessible instances
+## as this provides unauthenticated access to potentially sensitive data.
+# SHOW_PASSWORD_HINT=false
+
+#########################
+### Advanced settings ###
+#########################
+
+## Client IP Header, used to identify the IP of the client, defaults to "X-Real-IP"
+## Set to the string "none" (without quotes), to disable any headers and just use the remote IP
+# IP_HEADER=X-Real-IP
 
 ## Icon service
 ## The predefined icon services are: internal, bitwarden, duckduckgo, google.
@@ -163,12 +308,12 @@ LOG_FILE=/var/log/__APP__/__APP__.log
 ## are currently better supported by the Bitwarden clients.
 # ICON_REDIRECT_CODE=302
 
-## Disable icon downloading
+## Cache time-to-live for successfully obtained icons, in seconds (0 is "forever")
-## Set to true to disable icon downloading in the internal icon service.
+## Default: 2592000 (30 days)
-## This still serves existing icons from $ICON_CACHE_FOLDER, without generating any external
+# ICON_CACHE_TTL=2592000
-## network requests. $ICON_CACHE_TTL must also be set to 0; otherwise, the existing icons
+## Cache time-to-live for icons which weren't available, in seconds (0 is "forever")
-## will be deleted eventually, but won't be downloaded again.
+## Default: 2592000 (3 days)
-# DISABLE_ICON_DOWNLOAD=false
+# ICON_CACHE_NEGTTL=259200
 
 ## Icon download timeout
 ## Configure the timeout value when downloading the favicons.
@@ -185,105 +330,64 @@ LOG_FILE=/var/log/__APP__/__APP__.log
 ## Useful to secure your internal environment: See https://en.wikipedia.org/wiki/Reserved_IP_addresses for a list of IPs which it will block
 # ICON_BLACKLIST_NON_GLOBAL_IPS=true
 
-## Disable 2FA remember
+## Client Settings
-## Enabling this would force the users to use a second factor to login every time.
+## Enable experimental feature flags for clients.
-## Note that the checkbox would still be present, but ignored.
+## This is a comma-separated list of flags, e.g. "flag1,flag2,flag3".
-# DISABLE_2FA_REMEMBER=false
+##
+## The following flags are available:
+## - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
+## - "autofill-v2": Use the new autofill implementation.
+## - "browser-fileless-import": Directly import credentials from other providers without a file.
+## - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
+# EXPERIMENTAL_CLIENT_FEATURE_FLAGS=fido2-vault-credentials
 
-## Maximum attempts before an email token is reset and a new email will need to be sent.
+## Require new device emails. When a user logs in an email is required to be sent.
-# EMAIL_ATTEMPTS_LIMIT=3
+## If sending the email fails the login attempt will fail!!
+# REQUIRE_DEVICE_EMAIL=false
 
-## Token expiration time
+## Enable extended logging, which shows timestamps and targets in the logs
-## Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
+# EXTENDED_LOGGING=true
-# EMAIL_EXPIRATION_TIME=600
 
-## Email token size
+## Timestamp format used in extended logging.
-## Number of digits in an email 2FA token (min: 6, max: 255).
+## Format specifiers: https://docs.rs/chrono/latest/chrono/format/strftime
-## Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting!
+# LOG_TIMESTAMP_FORMAT="%Y-%m-%d %H:%M:%S.%3f"
-# EMAIL_TOKEN_SIZE=6
 
-## Controls if new users can register
+## Logging to Syslog
-SIGNUPS_ALLOWED=false
+## This requires extended logging
+# USE_SYSLOG=false
 
-## Controls if new users need to verify their email address upon registration
+## Logging to file
-## Note that setting this option to true prevents logins until the email address has been verified!
+# LOG_FILE=/path/to/log
-## The welcome email will include a verification link, and login attempts will periodically
-## trigger another verification email to be sent.
-# SIGNUPS_VERIFY=false
 
-## If SIGNUPS_VERIFY is set to true, this limits how many seconds after the last time
+## Log level
-## an email verification link has been sent another verification email will be sent
+## Change the verbosity of the log output
-# SIGNUPS_VERIFY_RESEND_TIME=3600
+## Valid values are "trace", "debug", "info", "warn", "error" and "off"
+## Setting it to "trace" or "debug" would also show logs for mounted
+## routes and static file, websocket and alive requests
+# LOG_LEVEL=info
 
-## If SIGNUPS_VERIFY is set to true, this limits how many times an email verification
+## Token for the admin interface, preferably an Argon2 PCH string
-## email will be re-sent upon an attempted login.
+## Vaultwarden has a built-in generator by calling `vaultwarden hash`
-# SIGNUPS_VERIFY_RESEND_LIMIT=6
+## For details see: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
-
-## Controls if new users from a list of comma-separated domains can register
-## even if SIGNUPS_ALLOWED is set to false
-# SIGNUPS_DOMAINS_WHITELIST=example.com,example.net,example.org
-
-## Controls which users can create new orgs.
-## Blank or 'all' means all users can create orgs (this is the default):
-# ORG_CREATION_USERS=
-## 'none' means no users can create orgs:
-# ORG_CREATION_USERS=none
-## A comma-separated list means only those users can create orgs:
-# ORG_CREATION_USERS=admin1@example.com,admin2@example.com
-
-## Token for the admin interface, preferably use a long random string
-## One option is to use 'openssl rand -base64 48'
 ## If not set, the admin panel is disabled
-ADMIN_TOKEN=__ADMIN_TOKEN__
+## New Argon2 PHC string
+## Note that for some environments, like docker-compose you need to escape all the dollar signs `$` with an extra dollar sign like `$$`
+## Also, use single quotes (') instead of double quotes (") to enclose the string when needed
+# ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$MmeKRnGK5RW5mJS7h3TOL89GrpLPXJPAtTK8FTqj9HM$DqsstvoSAETl9YhnsXbf43WeaUwJC6JhViIvuPoig78'
+## Old plain text string (Will generate warnings in favor of Argon2)
+# ADMIN_TOKEN=Vy2VyYTTsKPv8W5aEOWUbB/Bt3DEKePbHmI4m9VcemUMS2rEviDowNAFqYi1xjmp
 
 ## Enable this to bypass the admin panel security. This option is only
 ## meant to be used with the use of a separate auth layer in front
 # DISABLE_ADMIN_TOKEN=false
 
-## Invitations org admins to invite users, even when signups are disabled
+## Number of seconds, on average, between admin login requests from the same IP address before rate limiting kicks in.
-# INVITATIONS_ALLOWED=true
+# ADMIN_RATELIMIT_SECONDS=300
-## Name shown in the invitation emails that don't come from a specific organization
+## Allow a burst of requests of up to this size, while maintaining the average indicated by `ADMIN_RATELIMIT_SECONDS`.
-# INVITATION_ORG_NAME=Vaultwarden
+# ADMIN_RATELIMIT_MAX_BURST=3
 
-## Per-organization attachment storage limit (KB)
+## Set the lifetime of admin sessions to this value (in minutes).
-## Max kilobytes of attachment storage allowed per organization.
+# ADMIN_SESSION_LIFETIME=20
-## When this limit is reached, organization members will not be allowed to upload further attachments for ciphers owned by that organization.
-# ORG_ATTACHMENT_LIMIT=
-## Per-user attachment storage limit (KB)
-## Max kilobytes of attachment storage allowed per user.
-## When this limit is reached, the user will not be allowed to upload further attachments.
-# USER_ATTACHMENT_LIMIT=
-
-## Number of days to wait before auto-deleting a trashed item.
-## If unset (the default), trashed items are not auto-deleted.
-## This setting applies globally, so make sure to inform all users of any changes to this setting.
-# TRASH_AUTO_DELETE_DAYS=
-
-## Number of minutes to wait before a 2FA-enabled login is considered incomplete,
-## resulting in an email notification. An incomplete 2FA login is one where the correct
-## master password was provided but the required 2FA step was not completed, which
-## potentially indicates a master password compromise. Set to 0 to disable this check.
-## This setting applies globally to all users.
-# INCOMPLETE_2FA_TIME_LIMIT=3
-
-## Controls the PBBKDF password iterations to apply on the server
-## The change only applies when the password is changed
-# PASSWORD_ITERATIONS=100000
-
-## Controls whether users can set password hints. This setting applies globally to all users.
-# PASSWORD_HINTS_ALLOWED=true
-
-## Controls whether a password hint should be shown directly in the web page if
-## SMTP service is not configured. Not recommended for publicly-accessible instances
-## as this provides unauthenticated access to potentially sensitive data.
-# SHOW_PASSWORD_HINT=false
-
-## Domain settings
-## The domain must match the address from where you access the server
-## It's recommended to configure this value, otherwise certain functionality might not work,
-## like attachment downloads, email links and U2F.
-## For U2F to work, the server must use HTTPS, you can use Let's Encrypt for free certs
-DOMAIN=https://__DOMAIN____PATH__
 
 ## Allowed iframe ancestors (Know the risks!)
 ## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
@@ -298,10 +402,16 @@ DOMAIN=https://__DOMAIN____PATH__
 ## Note that this applies to both the login and the 2FA, so it's recommended to allow a burst size of at least 2.
 # LOGIN_RATELIMIT_MAX_BURST=10
 
-## Number of seconds, on average, between admin requests from the same IP address before rate limiting kicks in.
+## BETA FEATURE: Groups
-# ADMIN_RATELIMIT_SECONDS=300
+## Controls whether group support is enabled for organizations
-## Allow a burst of requests of up to this size, while maintaining the average indicated by `ADMIN_RATELIMIT_SECONDS`.
+## This setting applies to organizations.
-# ADMIN_RATELIMIT_MAX_BURST=3
+## Disabled by default because this is a beta feature, it contains known issues!
+## KNOW WHAT YOU ARE DOING!
+# ORG_GROUPS_ENABLED=false
+
+########################
+### MFA/2FA settings ###
+########################
 
 ## Yubico (Yubikey) Settings
 ## Set your Client ID and Secret Key for Yubikey OTP
@@ -322,6 +432,30 @@ DOMAIN=https://__DOMAIN____PATH__
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
 
+## Email 2FA settings
+## Email token size
+## Number of digits in an email 2FA token (min: 6, max: 255).
+## Note that the Bitwarden clients are hardcoded to mention 6 digit codes regardless of this setting!
+# EMAIL_TOKEN_SIZE=6
+##
+## Token expiration time
+## Maximum time in seconds a token is valid. The time the user has to open email client and copy token.
+# EMAIL_EXPIRATION_TIME=600
+##
+## Maximum attempts before an email token is reset and a new email will need to be sent.
+# EMAIL_ATTEMPTS_LIMIT=3
+##
+## Setup email 2FA regardless of any organization policy
+# EMAIL_2FA_ENFORCE_ON_VERIFIED_INVITE=false
+## Automatically setup email 2FA as fallback provider when needed
+# EMAIL_2FA_AUTO_FALLBACK=false
+
+## Other MFA/2FA settings
+## Disable 2FA remember
+## Enabling this would force the users to use a second factor to login every time.
+## Note that the checkbox would still be present, but ignored.
+# DISABLE_2FA_REMEMBER=false
+##
 ## Authenticator Settings
 ## Disable authenticator time drifted codes to be valid.
 ## TOTP codes of the previous and next 30 seconds will be invalid
@@ -334,57 +468,102 @@ DOMAIN=https://__DOMAIN____PATH__
 ## In any case, if a code has been used it can not be used again, also codes which predates it will be invalid.
 # AUTHENTICATOR_DISABLE_TIME_DRIFT=false
 
-## Rocket specific settings
+###########################
-## See https://rocket.rs/v0.4/guide/configuration/ for more details.
+### SMTP Email settings ###
-ROCKET_ADDRESS=127.0.0.1
+###########################
-ROCKET_PORT=__PORT_ROCKET__
-ROCKET_WORKERS=1
-# ROCKET_TLS={certs="/path/to/certs.pem",key="/path/to/key.pem"}
 
-## Mail specific settings, set SMTP_HOST and SMTP_FROM to enable the mail service.
+## Mail specific settings, set SMTP_FROM and either SMTP_HOST or USE_SENDMAIL to enable the mail service.
 ## To make sure the email links are pointing to the correct host, set the DOMAIN variable.
 ## Note: if SMTP_USERNAME is specified, SMTP_PASSWORD is mandatory
-SMTP_HOST=__DOMAIN__
+# SMTP_HOST=smtp.domain.tld
-SMTP_FROM=__APP__@__DOMAIN__
+# SMTP_FROM=vaultwarden@domain.tld
-SMTP_FROM_NAME=Vaultwarden
+# SMTP_FROM_NAME=Vaultwarden
-SMTP_SECURITY=starttls
+# SMTP_USERNAME=username
-SMTP_PORT=25
+# SMTP_PASSWORD=password
-SMTP_USERNAME=__APP__
-SMTP_PASSWORD=__MAIL_PWD__
 # SMTP_TIMEOUT=15
 
+## Choose the type of secure connection for SMTP. The default is "starttls".
+## The available options are:
+## - "starttls": The default port is 587.
+## - "force_tls": The default port is 465.
+## - "off": The default port is 25.
+## Ports 587 (submission) and 25 (smtp) are standard without encryption and with encryption via STARTTLS (Explicit TLS). Port 465 (submissions) is used for encrypted submission (Implicit TLS).
+# SMTP_SECURITY=starttls
+# SMTP_PORT=587
+
+# Whether to send mail via the `sendmail` command
+# USE_SENDMAIL=false
+# Which sendmail command to use. The one found in the $PATH is used if not specified.
+# SENDMAIL_COMMAND="/path/to/sendmail"
+
 ## Defaults for SSL is "Plain" and "Login" and nothing for Non-SSL connections.
 ## Possible values: ["Plain", "Login", "Xoauth2"].
 ## Multiple options need to be separated by a comma ','.
-# SMTP_AUTH_MECHANISM="Plain"
+# SMTP_AUTH_MECHANISM=
 
 ## Server name sent during the SMTP HELO
 ## By default this value should be is on the machine's hostname,
 ## but might need to be changed in case it trips some anti-spam filters
 # HELO_NAME=
 
+## Embed images as email attachments
+# SMTP_EMBED_IMAGES=true
+
 ## SMTP debugging
 ## When set to true this will output very detailed SMTP messages.
 ## WARNING: This could contain sensitive information like passwords and usernames! Only enable this during troubleshooting!
 # SMTP_DEBUG=false
 
-## Accept Invalid Hostnames
-## DANGEROUS: This option introduces significant vulnerabilities to man-in-the-middle attacks!
-## Only use this as a last resort if you are not able to use a valid certificate.
-# SMTP_ACCEPT_INVALID_HOSTNAMES=false
-
 ## Accept Invalid Certificates
 ## DANGEROUS: This option introduces significant vulnerabilities to man-in-the-middle attacks!
 ## Only use this as a last resort if you are not able to use a valid certificate.
 ## If the Certificate is valid but the hostname doesn't match, please use SMTP_ACCEPT_INVALID_HOSTNAMES instead.
 # SMTP_ACCEPT_INVALID_CERTS=false
 
-## Require new device emails. When a user logs in an email is required to be sent.
+## Accept Invalid Hostnames
-## If sending the email fails the login attempt will fail!!
+## DANGEROUS: This option introduces significant vulnerabilities to man-in-the-middle attacks!
-# REQUIRE_DEVICE_EMAIL=false
+## Only use this as a last resort if you are not able to use a valid certificate.
+# SMTP_ACCEPT_INVALID_HOSTNAMES=false
 
-## HIBP Api Key
+#######################
-## HaveIBeenPwned API Key, request it here: https://haveibeenpwned.com/API/Key
+### Rocket settings ###
-# HIBP_API_KEY=
+#######################
 
-# vim: syntax=ini
+## Rocket specific settings
+## See https://rocket.rs/v0.5/guide/configuration/ for more details.
+# ROCKET_ADDRESS=0.0.0.0
+## The default port is 8000, unless running in a Docker container, in which case it is 80.
+# ROCKET_PORT=8000
+# ROCKET_TLS={certs="/path/to/certs.pem",key="/path/to/key.pem"}
+
+#######################################
+### YunoHost Specific Configuration ###
+#######################################
+
+DATA_FOLDER=__DATA_DIR__
+
+WEB_VAULT_FOLDER=web-vault/
+WEB_VAULT_ENABLED=true
+
+DOMAIN=https://__DOMAIN____PATH__
+
+SIGNUPS_ALLOWED=false
+
+LOG_FILE=/var/log/__APP__/__APP__.log
+
+ADMIN_TOKEN=__ADMIN_TOKEN__
+
+SMTP_HOST=__DOMAIN__
+SMTP_FROM=__APP__@__DOMAIN__
+SMTP_FROM_NAME=Vaultwarden
+SMTP_USERNAME=__APP__
+SMTP_PASSWORD=__MAIL_PWD__
+
+SMTP_SECURITY=starttls
+SMTP_PORT=25
+
+ROCKET_ADDRESS=127.0.0.1
+ROCKET_PORT=__PORT_ROCKET__
+ROCKET_WORKERS=1
+
+# vim: syntax=ini

manifest.toml

@@ -7,9 +7,9 @@ name = "Vaultwarden"
 description.en = "Manage passwords and other sensitive informations"
 description.fr = "Gérez les mots de passe et autres informations sensibles"
 
-version = "1.29.1~ynh4"
+version = "1.32.0~ynh1"
 
-maintainers = ["yalh76"]
+maintainers = [ ]
 
 [upstream]
 license = "GPL-3.0-or-later"
@@ -19,11 +19,14 @@ userdoc = "https://help.bitwarden.com/"
 code = "https://github.com/dani-garcia/vaultwarden"
 
 [integration]
-yunohost = ">= 11.2"
+yunohost = ">= 12.0.0"
 architectures = "all"
 multi_instance = true
+
 ldap = false
+
 sso = false
+
 disk = "50M"
 ram.build = "50M"
 ram.runtime = "50M"
@@ -53,13 +56,12 @@ ram.runtime = "50M"
     [resources.data_dir]
 
     [resources.ports]
-    websocket.default = 3012
     rocket.default = 8095
 
     [resources.permissions]
     main.url = "/"
     api.url = "/api"
-    api.additional_urls = ["/identity"]
+    api.additional_urls = [ "/identity" ]
     api.allowed = "visitors"
     api.auth_header = false
     api.show_tile = false

scripts/backup

@@ -28,30 +28,16 @@ ynh_backup --src_path="$install_dir"
 ynh_backup --src_path="$data_dir" --is_big
 
 #=================================================
-# BACKUP THE NGINX CONFIGURATION
+# SYSTEM CONFIGURATION
 #=================================================
 
 ynh_backup --src_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 
-#=================================================
-# BACKUP FAIL2BAN CONFIGURATION
-#=================================================
-
 ynh_backup --src_path="/etc/fail2ban/jail.d/$app.conf"
 ynh_backup --src_path="/etc/fail2ban/filter.d/$app.conf"
 
-#=================================================
-# SPECIFIC BACKUP
-#=================================================
-# BACKUP LOGROTATE
-#=================================================
-
 ynh_backup --src_path="/etc/logrotate.d/$app"
 
-#=================================================
-# BACKUP SYSTEMD
-#=================================================
-
 ynh_backup --src_path="/etc/systemd/system/$app.service"
 
 #=================================================

scripts/change_url

@@ -16,7 +16,7 @@ source /usr/share/yunohost/helpers
 #=================================================
 ynh_script_progression --message="Stopping a systemd service..."
 
-ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd"
+ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd" --line_match="Vaultwarden process exited"
 
 #=================================================
 # MODIFY URL IN NGINX CONF

scripts/install

@@ -63,7 +63,7 @@ ynh_use_logrotate
 # Create a dedicated Fail2Ban config
 ynh_add_fail2ban_config --logpath="/var/log/$app/$app.log" --failregex="^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$"
 
-yunohost service add $app --description="$app daemon for vaultwarden" --log="/var/log/$app/$app.log"
+yunohost service add $app --description="$app daemon for Vaultwarden" --log="/var/log/$app/$app.log"
 
 #=================================================
 # START SYSTEMD SERVICE

scripts/restore

@@ -39,7 +39,7 @@ ynh_restore_file --origin_path="/etc/nginx/conf.d/$domain.d/$app.conf"
 ynh_restore_file --origin_path="/etc/systemd/system/$app.service"
 systemctl enable $app.service --quiet
 
-yunohost service add $app --description="$app daemon for vaultwarden" --log="/var/log/$app/$app.log"
+yunohost service add $app --description="$app daemon for Vaultwarden" --log="/var/log/$app/$app.log"
 
 # Create log file for fail2ban
 mkdir -p "/var/log/$app"

scripts/upgrade

@@ -10,12 +10,6 @@ source _common.sh
 source ynh_docker_image_extract
 source /usr/share/yunohost/helpers
 
-#=================================================
-# CHECK VERSION
-#=================================================
-
-upgrade_type=$(ynh_check_app_version_changed)
-
 #=================================================
 # STANDARD UPGRADE STEPS
 #=================================================
@@ -23,18 +17,14 @@ upgrade_type=$(ynh_check_app_version_changed)
 #=================================================
 ynh_script_progression --message="Stopping a systemd service..."
 
-ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd" --line_match="Stopping Vaultwarden Server"
+ynh_systemd_action --service_name=$app --action="stop" --log_path="systemd" --line_match="Vaultwarden process exited"
 
 #=================================================
 # DOWNLOAD, CHECK AND UNPACK SOURCE
 #=================================================
+ynh_script_progression --message="Upgrading source files..."
 
-if [ "$upgrade_type" == "UPGRADE_APP" ]
+_download_vaultwarden_from_docker
-then
-	ynh_script_progression --message="Upgrading source files..."
-
-	_download_vaultwarden_from_docker
-fi
 
 #=================================================
 # UPDATE A CONFIG FILE
@@ -78,7 +68,7 @@ ynh_use_logrotate --non-append
 # Create a dedicated Fail2Ban config
 ynh_add_fail2ban_config --logpath="/var/log/$app/$app.log" --failregex="^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$"
 
-yunohost service add $app --description="$app daemon for vaultwarden" --log="/var/log/$app/$app.log"
+yunohost service add $app --description="$app daemon for Vaultwarden" --log="/var/log/$app/$app.log"
 
 #=================================================
 # START SYSTEMD SERVICE

tests.toml

@@ -4,6 +4,10 @@ test_format = 1.0
 
 [default]
 
+    preinstall = """
+    sudo apt-get update >/dev/null && sudo apt-get install rsync -y >/dev/null
+    """
+
     # -------------------------------
     # Commits to test upgrade from
     # -------------------------------