Hi, I'm working on improving the security of my home server.
I want to use the Bitwarden app and the Chrome/Firefox extensions outside my LAN, but I don't need Web Vault at all. How do I block access to Web Vault from outside the LAN in the Caddyfile?
pass.my-domain {
@block_webvault_outside {
not remote_ip 192.168.1.0/24 10.8.0.0/24
# What should be there?
# path /admin* will lock only admin options
}
respond @block_webvault_outside 403
reverse_proxy vaultwarden:80
}
4 Comments
SnotFlickerman@lemmy.blahaj.zone · 5 pts · 108d
I personally don't expose services like these to the Internet directly but rather put them behind a Wireguard VPN that I stay connected to while remote to be able to access local network resources and ad-blocking without actually exposing anything in my internal network except the Wireguard port.
That doesn't work for everyone of course, but I personally would be really nervous exposing a service like Vaultwarden to the Internet without having it behind a VPN.
relaymoth@sh.itjust.works · 3 pts · 107d
If you're deploying Vaultwarden via docker, there's an ENV to disable web vault
Set to false and redeploy.
LinusTor@feddit.org · 1 pts · 107d
But that will also block my access to WebVault within the LAN
relaymoth@sh.itjust.works · 1 pts · 106d
You're right.
If you login to Vaultwarden and access the Web vault, is there a path like
/adminyou can add to your blocked paths config?