62 lines
2.2 KiB
Bash
62 lines
2.2 KiB
Bash
# ===========================================
|
|
# Vaultwarden API Configuration
|
|
# ===========================================
|
|
# Copy this file to .env and fill in your values.
|
|
# NEVER commit your actual .env file!
|
|
|
|
# --- Required ---
|
|
|
|
# Your Vaultwarden instance URL
|
|
VAULTWARDEN_URL=https://vault.yourdomain.com
|
|
|
|
# Your Vaultwarden login email
|
|
VAULTWARDEN_EMAIL=you@example.com
|
|
|
|
# Your Vaultwarden master password
|
|
VAULTWARDEN_PASSWORD=your-master-password
|
|
|
|
# API key for authenticating to this service (min 32 chars).
|
|
# This single key has FULL access to every secret the account can decrypt.
|
|
# Generate one: openssl rand -base64 32
|
|
# At least one of API_KEY / API_KEYS / API_KEYS_FILE is required.
|
|
API_KEY=
|
|
|
|
# --- Optional ---
|
|
|
|
# Multiple, individually-revocable keys, each scoped to specific organizations
|
|
# and/or collections. Scope is enforced SERVER-SIDE regardless of query filters,
|
|
# so a scoped key can only read secrets within its scope. Each key needs >= 32 chars.
|
|
# Refs may be friendly names or UUIDs (UUIDs recommended — names are case-insensitive,
|
|
# break on rename, and a duplicate name binds to the lowest matching UUID). A key with
|
|
# no organizations/collections is unscoped (full access). Note: an org-scoped key cannot
|
|
# read personal/no-org items.
|
|
#
|
|
# Inline JSON (string env var):
|
|
# API_KEYS=[{"name":"dev-team","key":"<32+ chars>","organizations":["MyOrg"],"collections":["Secrets - DEV"]}]
|
|
#
|
|
# Or a mounted JSON file (takes precedence over API_KEYS; ideal as a Docker secret):
|
|
# API_KEYS_FILE=/run/secrets/api-keys.json
|
|
|
|
# Restrict access to specific IPs/CIDRs
|
|
# ALLOWED_IPS=192.168.1.0/24,10.0.0.1
|
|
|
|
# Auto-whitelist GitHub Actions IPs (for CI/CD)
|
|
# ENABLE_GITHUB_IP_RANGES=true
|
|
|
|
# Trusted reverse proxy IPs (for correct client IP detection)
|
|
# TRUSTED_PROXY_IP=172.16.0.0/12
|
|
|
|
# How often to re-sync the vault (default: 5m)
|
|
# SYNC_INTERVAL=5m
|
|
|
|
# Rate limiting (per client IP). Whitelisted IPs (ALLOWED_IPS / TRUSTED_PROXY_IP)
|
|
# bypass the limiter entirely. Defaults: 30 requests per 1m window.
|
|
# RATE_LIMIT_MAX=30
|
|
# RATE_LIMIT_WINDOW=1m
|
|
|
|
# Environment (development shows detailed errors, production hides them)
|
|
# ENVIRONMENT=production
|
|
|
|
# Enable debug logging (shows secret names in logs — NOT for production!)
|
|
# DEBUG=false
|