Pangolin Proxy Setup for Vaultwarden (working with Bitwarden apps)

[shanelord01]

Apologies if this info is available elsewhere. Vaultwarden (and Bitwarden apps) work perfectly well behind Pangolin. I have my Vaultwarden server running on Unraid, which has a Newt tunnel to my Pangolin server hosted on a VPS.

1. Setup vaultwarden. I used the app in the Unraid store, just changed the variable "WEBSOCKET_ENABLED" to "ENABLE_WEBSOCKET" as per here.
2. Follow the setup to configure vaultwarden.
3. In General Settings of vaultwarden, set your URL to the new HTTPS URL Pangolin will give it ie "https://vaultwarden.mydomain.com"
4. Configure a new resource on your Pangolin server, set the URL for your server (matching what you put in step 3 above).
5. Ensure Authentication is enabled (ie "Use Platform SSO").
6. Under "Rules" in the resource in Pangolin, set the following:

Priority | Action | Match Type | Value

1 | Always Allow | Path | /api/*
2 | Always Allow | Path | /identity/*
3 | Always Allow | Path | /wl/*
4 | Always Deny | Path | /admin/*

7. Optional, if you have setup Geo Blocking in Pangolin, I then setup:

Priority | Action | Match Type | Value

10 | Pass to Auth | Country | MyCountry **
11 | Pass to Auth | Country | CountryIAmOKWith **
12 | Pass to Auth | Country | AnotherCountryIAmOKWith **
100 | Always Deny | Country | ALL COUNTRIES (ALL)

** Replace these with actual countries. Except fpr "ALL COUNTRIES (ALL)" which is real and blocks everything you don't set at a higher priority.

This should allow you to use the web app, iOS and Android apps etc.

[stefan0xC]

Thanks for this guide but I have the feeling that it's missing the most crucial bits like how do I setup a Pangolin server in the first place? How do I configure a Newt tunnel for my Vaultwarden instance? I.e. the things you glossed over in your intro.

1. Setup vaultwarden. I used the app in the Unraid store, just changed the variable "WEBSOCKET_ENABLED" to "ENABLE_WEBSOCKET" as per here.

Does the app in the Unraid store come preconfigured? Because as the wiki page says WebSockets are already enabled by default, so it should not be necessary to configure them in Vaultwarden anymore. (Unless you want to disable it but that should probably be fixed by Unraid then.)

2. Follow the setup to configure vaultwarden.

Which setup are you referring to? Is this specific to Unraid?

3. In General Settings of vaultwarden, set your URL to the new HTTPS URL Pangolin will give it ie "https://vaultwarden.mydomain.com/"

Do you mean the General Settings section in the /admin panel? That is not enabled by default because you have to configure an ADMIN_TOKEN. Cf. https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page

I think I would rewrite those steps as "Install and configure Vaultwarden." - the only relevant part would be setting the DOMAIN to the correct base URL.

Regarding the rules: Why the /wl/* path? Is this a pangolin specific thing? Why do you block the /admin path? Have you tested if WebSockets work? (Are the rules necessary if I don't enable authentication?)

[shanelord01]

I'm not here to write an extensive guide - all of your questions are answered by using the internet to look up resources and read them for each of the services mentioned. I am just running through how to make vaultwarden (running on unraid) work with Pangolin. There are plenty of Pangolin and Unraid resources.

• Setup Pangolin

Setting up Pangolin is beyond this guide - If you want to setup Pangolin, go to https://docs.pangolin.net/self-host/quick-install

• Does the app in the Unraid store come preconfigured?

Yes, but the one thing I called out is it uses the old "WEBSOCKET_ENABLED" variable. I changed that as I noted above.

• Which setup are you referring to? Is this specific to Unraid?

Not really. The admin panel is setup by default with the unraid app - just need to provide the token during the initial setup (you are prompted). The rest is just following the vaultwarden setup guide for your own needs.

• Rules

These are defined by the Pangolin team after testing vaultwarden as per the bottom of the page here: https://docs.pangolin.net/manage/access-control/rules

[stefan0xC]

I'm not here to write an extensive guide

Yeah, and I'm not requesting that you do. In fact I suggested that you scrub parts of it because in my view they are completely unnecessary given that Vaultwarden also has it's own documentation which you can find, and thus that part is only confusing because it's too specific to your Unraid setup but thanks for clarifying.

all of your questions are answered by using the internet to look up resources and read them for each of the services mentioned

Well, yeah but what good does that do for anyone else reading your guide? If you happen to know where something is explained better, it would be helpful that you link to further documentation (like you did with the GeoIP blocking and now to Pangolin) so that they don't have to do that.

The question why the Pangolin team wrote this specific rule is not explained anywhere as far as I've looked. Nevertheless, thanks for pointing out where you got it from. (I think it's probably unnecessary then though.)

And also my question regarding WebSockets support is not answered. It may be that upgrading the connection just works but if you have to allow the /api endpoints I was wondering whether you also need to allow the /notifications endpoint? (You can check this more easily than me because you already set it up and I don't have the time to replicate your system just to answer this specific question.)

Lastly, I just wanted to say that if you don't find my feedback helpful and your guide useful enough as is you can of course ignore it. But if that's your response to my feedback why bother writing such a guide at all? I'm not sure what's your target audience but a person who can setup Pangolin and Newt on their own most likely wouldn't have a problem setting up Vaultwarden either and thus would not need most of it in the first place. (I mean especially if they don't even have to do anything special other than setting up the DOMAIN and follow the suggestions by the Pangolin team.)

[oobatz247]

Thanks bro! - just solved my problem that I'd been hunting down a solution for all morning.

[lavabrothers]

If anybody is having issues with websockets/Notifications for clients (Like Desktop/IOS/Android), you need to also add the path notifications/* as also another allowed path

Priority | Action | Match Type | Value

1 | Always Allow | Path | /api/*
2 | Always Allow | Path | /identity/*
3 | Always Allow | Path | /wl/*
4 | Always Deny | Path | /admin/*
5 | Always Allow | Path | /notifications/*

To get Mobile push you also need to enable push for your vaultwarden server with the bitwarden installation key as outlined in this PR
#3304
Or all you need to do is add

PUSH_ENABLED=true
PUSH_INSTALLATION_ID=CHANGEME
PUSH_INSTALLATION_KEY=CHANGEME

Where you get the ID and KEY from
https://bitwarden.com/host/
Then it all works magically! Good luck out there. The Mobile pushing setup is not unique to pangolin and can be applied to any setup I think

[andrewilliams876]

got all this set up but still no push notif? any idea

[benb245]

For me Favicons are not showing and Download of Attachments is not working from the Bitwarden Android App when Authentication is enabled and the above rules are set. Does anyone know which path I need to add to get it working?

[lavabrothers]

You need to allow the
'/icons/*' route as well. Figured this out just recently

[benb245]

That's working, thanks. Now I only have the "attachment download problem" left. How can I find out the path?

[BlackDex]

Check the logs of your reverse proxy or the browser f12 developer console. That should show the paths and which fail.

[benb245]

Just found it. It is just /attachments/*
Thanks!

[piranhap]

For some reason I get 404 on subdomain.domain.com

Any ideas? I made sure all the rules above were added and sso auth is off
Newt is installed on main host, all services on that host are docker containers.

[lavabrothers]

If I recall correctly, vaultwarden requires SSL. In the picture shown there SSL seems to be off

Also localhost is unlikely to work if you are running pangolin via docker, try to either use the docker dns hostname if you bridged the networks or the ip of the server

[piranhap]

still 404 after enabling it

[lavabrothers]

I also see you are using localhost as the target IP. Correct me if I'm wrong but that would not work if you have newt running via docker as it will loop back onto itself. You'll need to provide the ip of the server or docker hostname (if vaultwarden is within the same docker network) for it to work.

[xupefei]

404 is because you have a health check failure, just disable it while debugging. Traefik will not proxy data when health check is down.

[dawidmachon]

(btw my opinion - vault have own auth already so no need for double)