`secrets.*File` and `settings.log.file_path` now use
`lib.types.externalPath`, which only accepts absolute non-store path
strings. Passing an unquoted path literal (which silently copies its
contents into the Nix store) now fails at evaluation time with a clear
type error instead of being accepted.
iptables backend is currently broken for unknown reasons.
`nftables` backend works for iptables firewall too,
if built with nftablesCompat = true (our default).
The backup service hardcoded DATA_FOLDER to the local dataDir variable
(which always resolves to /var/lib/vaultwarden), ignoring any user
override set via services.vaultwarden.config.DATA_FOLDER.
This caused backups to always read from the default directory even when
the vaultwarden service itself was configured to use a different data
path.
The unit's UMask=0027 was masking spire-agent's own
os.MkdirAll("/run/spire/agent/public", 0755) down to mode 0750, so any
process not in the spire-agent group got EACCES on connect() — defeating
the point of workload attestation, which is supposed to identify
arbitrary callers regardless of their unix identity.
Pre-create the directory via RuntimeDirectory so systemd applies
RuntimeDirectoryMode (0755) independent of umask; spire-agent's MkdirAll
then becomes a no-op.
Also exercises the path in the NixOS test by fetching an SVID as a
normal user.
When OpenBao is placed behind a reverse proxy like nginx, it's
preferable to have OpenBao listen on a Unix Socket instead of TCP/IP.
OpenBao supports this, we just need to relax our sandboxing for this
ever so slightly.
The default effective socket_mode is left untouched. Meaning even with
RuntimeDirectoryMode=0755, other services can't just access OpenBao's
Unix Socket because of its Umask=0077. One needs to explicitly configure
socket_mode, socket_user and socket_group in OpenBao's [unix listener
config] to make use of this.
Additionally, setting User=openbao and Group=openbao allows other
services to make use of SupplementaryGroups=openbao or OpenBao to use
e.g. Postgres peer authentication.
[unix listener config]: https://openbao.org/docs/configuration/listener/unix/
Co-authored-by emilylange <git@emilylange.de>
Adding an example provides necessary guideline for how the format should be (i.e. without leading https://, else the domain is added as a base path, e.g. /vaultwarden.example.com). The example was chosen to match the example config (bitwarden.example.com).
This has caused problems before, and again recently https://github.com/kanidm/kanidm/issues/4209.
Instead of continuing to fix edge cases from this non-standard hardening, remove it.
