admin/vw-api
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
45 Commits 1 Branch 0 Tags
main
Commit Graph
12 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Thijs Herman 495edffde3 Harden API-key model: per-key scoping + revocable keys, and configurable/whitelist-aware rate limiting (#16) 
* API scope and rate limiting

* improvements from review
 2026-05-28 11:45:16 +02:00
Thijs Herman 159eab5d1c chore: multi-arch Docker build (amd64, arm64, armv7) (#4) 
* chore: multi-arch Docker build (amd64, arm64, armv7)

- Remove hardcoded GOARCH=amd64 from Dockerfile, use TARGETARCH ARG
- Add QEMU + buildx to CI for cross-compilation
- Build for linux/amd64, linux/arm64, linux/arm/v7

* chore: update action versions, add dependabot

- actions/checkout v4 → v6
- actions/setup-go v5 → v6
- Add dependabot.yml (monthly checks for Go, Actions, Docker)
 2026-02-21 12:15:43 +01:00
Thijs Herman 2b4340d8b0 feat: add organization vault support (#3) 
* feat: add organization vault support

- Add RSA-OAEP decryption (type 3: SHA-256, type 4: SHA-1)
- Decrypt user's RSA private key from sync response (PKCS8 DER)
- Decrypt organization keys using user's RSA private key
- Route cipher decryption to correct key based on organizationId
- Personal vault items continue to work unchanged

Adds 11 new unit tests covering:
- RSA cipher string parsing (type 3/4)
- RSA-OAEP round-trip (SHA-1 and SHA-256)
- Private key decrypt/parse round-trip
- Org key decrypt + encKey/macKey split
- Cipher decryption with org vs personal key
- Backward compatibility for personal items

Also adds CI/CD pipeline (.github/workflows/ci.yml):
- Tests + build on PRs and main pushes
- Docker build + push to GHCR on main

* fix: split concatenated .gitignore entries

* chore: clean up gitignore
 2026-02-21 12:08:03 +01:00
Thijs Herman f194e85ec0 docs: add setup guide, dedicated user recommendation, troubleshooting 
- How to store secrets in Vaultwarden
- Recommended: dedicated user for security
- Docker Compose alongside existing Vaultwarden
- Troubleshooting table with common errors
 2026-02-20 18:21:14 +00:00
Thijs Herman 059f23af2a chore: fix module path to match GitHub URL, update Makefile GHCR path 
- Module: github.com/thijsherman → github.com/Turbootzz
- Makefile: turboot/ → ghcr.io/turbootzz/
- Added docker-push-tag target
 2026-02-20 18:18:13 +00:00
Thijs Herman eecdb5d0eb docs: update copyright year 2026-02-20 18:15:35 +00:00
Thijs Herman ffdfefea6d docs: fix remaining ~15MB references to ~20MB 2026-02-20 17:15:43 +00:00
Thijs Herman 997805fa79 docs: fix image size, document 2FA bypass env vars 2026-02-20 13:02:18 +00:00
Thijs Herman d2eb2518fe fix: use deviceType 14 (Server) instead of 10 (Firefox) 
Prevents confusing 'Firefox' login emails from Vaultwarden.
Device type 14 = SDK/Server, which better represents this service.
 2026-02-20 12:58:39 +00:00
Thijs Herman 9f8ebf2408 feat: replace Bitwarden CLI with native Go API client (#2) 
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.

## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
  - AES-256-CBC + HMAC-SHA256 decryption
  - PBKDF2-SHA256 and Argon2id key derivation
  - HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)

## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)

## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars

## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)

## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)
 2026-02-20 13:28:38 +01:00
Thijs Herman e320f95d9f Security: Redact secret names from production logs & bind port to localhost (#1) 
* security: redact secret names from logs, bind port to localhost

- handlers: replace secret names in Warn/Error logs with client IP
  (prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
  (Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
  (prevents direct access bypassing reverse proxy)

Found during security pen test of vault.turboot.com

* Enhance logging for secret retrieval and cache access
 2026-02-20 12:39:04 +01:00
Thijs Herman 6ae6201dad Initial commit 2025-10-17 12:56:43 +02:00