Thijs Herman
059f23af2a
chore: fix module path to match GitHub URL, update Makefile GHCR path
...
- Module: github.com/thijsherman → github.com/Turbootzz
- Makefile: turboot/ → ghcr.io/turbootzz/
- Added docker-push-tag target
2026-02-20 18:18:13 +00:00
Thijs Herman
eecdb5d0eb
docs: update copyright year
2026-02-20 18:15:35 +00:00
Thijs Herman
ffdfefea6d
docs: fix remaining ~15MB references to ~20MB
2026-02-20 17:15:43 +00:00
Thijs Herman
997805fa79
docs: fix image size, document 2FA bypass env vars
2026-02-20 13:02:18 +00:00
Thijs Herman
d2eb2518fe
fix: use deviceType 14 (Server) instead of 10 (Firefox)
...
Prevents confusing 'Firefox' login emails from Vaultwarden.
Device type 14 = SDK/Server, which better represents this service.
2026-02-20 12:58:39 +00:00
Thijs Herman
9f8ebf2408
feat: replace Bitwarden CLI with native Go API client ( #2 )
...
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.
## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
- AES-256-CBC + HMAC-SHA256 decryption
- PBKDF2-SHA256 and Argon2id key derivation
- HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)
## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)
## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars
## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)
## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)
2026-02-20 13:28:38 +01:00
Thijs Herman
e320f95d9f
Security: Redact secret names from production logs & bind port to localhost ( #1 )
...
* security: redact secret names from logs, bind port to localhost
- handlers: replace secret names in Warn/Error logs with client IP
(prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
(Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
(prevents direct access bypassing reverse proxy)
Found during security pen test of vault.turboot.com
* Enhance logging for secret retrieval and cache access
2026-02-20 12:39:04 +01:00
Turbootzz
9f41e1a1f7
updated README
2025-10-24 21:32:07 +02:00
Turbootzz
79b436ea6f
applied suggestions
2025-10-24 21:26:45 +02:00
Turbootzz
70481d0350
fixed Fiber IP security and cleanup code
2025-10-24 21:20:29 +02:00
Turbootzz
8cea6d1f8c
fixed IP whitelist bugs
2025-10-24 20:39:11 +02:00
Turbootzz
e48098090d
added IP whitelisting
2025-10-24 19:30:56 +02:00
Turbootzz
3055c413ef
added CLI improvments to docker
2025-10-24 19:01:39 +02:00
Turbootzz
d7a51a0f60
changed auth method
2025-10-24 18:28:52 +02:00
Turbootzz
1daa409a73
fixed CLI issue
2025-10-24 14:10:01 +02:00
Turbootzz
349ebd7562
solved issues
2025-10-24 13:45:17 +02:00
Turbootzz
4131345add
security update
2025-10-24 13:25:05 +02:00
Turbootzz
5b9f19e237
supports amd64
2025-10-17 17:35:56 +02:00
Turbootzz
5f937f6213
Added implementation
2025-10-17 13:32:58 +02:00
Thijs Herman
6ae6201dad
Initial commit
2025-10-17 12:56:43 +02:00
Thijs Herman