Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Daniel García

Last update: Jan 8, 2023

Related tags

Security tools docker rust rocket hacktoberfest bitwarden bitwarden-rs vaultwarden

Overview

Alternative implementation of the Bitwarden server API written in Rust and compatible with upstream Bitwarden clients*, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal.

📢 Note: This project was known as Bitwarden_RS and has been renamed to separate itself from the official Bitwarden server in the hopes of avoiding confusion and trademark/branding issues. Please see #1642 for more explanation.

Image is based on Rust implementation of Bitwarden API.

This project is not associated with the Bitwarden project nor 8bit Solutions LLC.

⚠️ IMPORTANT ⚠️ : When using this server, please report any bugs or suggestions to us directly (look at the bottom of this page for ways to get in touch), regardless of whatever clients you are using (mobile, desktop, browser...). DO NOT use the official support channels.

Features

Basically full implementation of Bitwarden API is provided including:

Organizations support
Attachments
Vault API support
Serving the static files for Vault interface
Website icons API
Authenticator and U2F support
YubiKey and Duo support

Installation

Pull the docker image and mount a volume from the host for persistent storage:

docker pull vaultwarden/server:latest
docker run -d --name vaultwarden -v /vw-data/:/data/ -p 80:80 vaultwarden/server:latest

This will preserve any persistent data under /vw-data/, you can adapt the path to whatever suits you.

IMPORTANT: Some web browsers, like Chrome, disallow the use of Web Crypto APIs in insecure contexts. In this case, you might get an error like Cannot read property 'importKey'. To solve this problem, you need to access the web vault from HTTPS.

This can be configured in vaultwarden directly or using a third-party reverse proxy (some examples).

If you have an available domain name, you can get HTTPS certificates with Let's Encrypt, or you can generate self-signed certificates with utilities like mkcert. Some proxies automatically do this step, like Caddy (see examples linked above).

Usage

See the vaultwarden wiki for more information on how to configure and run the vaultwarden server.

Get in touch

To ask a question, offer suggestions or new features or to get help configuring or installing the software, please use the forum.

If you spot any bugs or crashes with vaultwarden itself, please create an issue. Make sure there aren't any similar issues open, though!

If you prefer to chat, we're usually hanging around at #vaultwarden:matrix.org room on Matrix. Feel free to join us!

Describe the Bug

When removing/adding entry on the web Vault, everything because super laggy, and unresponsive. I have had the page completely freeze with a white screen, the only way to access the page again was to refresh it, which cancels out the current actions.

Steps To Reproduce

Delete/edit any item on the web Vault.

Expected Result

Be responsive, and not freezes the page.

Actual Result

Becomes unresponsive, and freezes.

Environment

Vault Items: 2476
Bitwarden_rs version: v1.19.0
Web-vault version: v2.18.1
Running within Docker: true
Internet access: true
Uses a proxy: false
DNS Check: true
Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Database type: SQLite
Clients used:
Reverse proxy and version:
Other relevant information:

Config (Generated via diagnostics page)

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_ip_header_enabled": true,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "/data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "/data",
  "database_max_conns": 10,
  "database_url": "/****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****.*******.***",
  "domain_origin": "*****://*****.*******.***",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "/data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "invitation_org_name": "Bitwarden_RS",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "org_attachment_limit": null,
  "org_creation_users": "",
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "/data/rsa_key",
  "show_password_hint": true,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": false,
  "smtp_from": "",
  "smtp_from_name": "Bitwarden_RS",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": null,
  "templates_folder": "/data/templates",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": true,
  "websocket_port": 8080,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

enhancement troubleshooting low priority

opened by ncodee 45

Setup with Fail2Ban

Hello all! First off, thank you for this! It is amazing! I was talking to u/me-ro on the homelab subreddit and they suggested I raise an issue to see if I can get some help with setting up bitwarden and Fail2Ban. He mentioned it logged all the password attempts but I can't find any of the logs.

Can someone please help?

Thanks!
help wanted question

opened by itr6 38
Icon caching problem or time out fetching icon

I have a similar problem with icon caching. This happened a few updates ago. I don't know exactly when. But when I check the log this is what I see.

} stdout 12:53:12 [2019-02-10 12:53:12][bitwarden_rs::api::icons][ERROR] Error downloading icon: ReqError. stdout 12:53:12 [CAUSE] Error { stdout 12:53:12 kind: Io( stdout 12:53:12 Custom { stdout 12:53:12 kind: WouldBlock, stdout 12:53:12 error: StringError( stdout 12:53:12 "timed out" stdout 12:53:12 ) stdout 12:53:12 } stdout 12:53:12 ), stdout 12:53:12 url: Some( stdout 12:53:12 "https://www.oneplus.com/favicon.ico" stdout 12:53:12 ) stdout 12:53:12 }

Also when looking in the icon_cache folder I see the missing icons named like this: www.oneplus.com.png.miss

Any idea how to fix this?

Originally posted by @BobWs in https://github.com/dani-garcia/bitwarden_rs/issues/292#issuecomment-462132916
troubleshooting

opened by BobWs 36

Vault loading issues (attachments?)

Subject of the issue

After updating from 1.24.0 to 1.25.0, I am having issues loading my vault. Error messages indicate issues with attachments (included error logs under "Troubleshooting data").

Other account settings seem to work fine (changing equivalent domains or updating 2FA settings still worked), so it seems to only affect the vault data.

No issues on 1.24.0. In fact, I could revert Vaultwarden back to 1.24.0 without restoring my database from backups and the vault seems to load just fine again. Syncing from the browser extension works fine too.

Deployment environment

vaultwarden version: 1.25.0

Install method: Docker
Clients used: Web vault & official browser extension
MySQL/MariaDB or PostgreSQL version: 10.5.15-MariaDB-1:10.5.15+maria~focal

Steps to reproduce

Docker Compose with the latest tag, upgrade from 1.24.0 (pull, down, up) No other changes were done, except using 1.24.0 instead of latest when reverting back.

Log into web vault / sync with browser extension.

Actual behaviour

Web vault was empty with no entries. Browser extension (where previously logged in & synced) just returned a sync error.

Troubleshooting data

vaultwarden    | 2022-05-23T19:45:16.513924114Z [2022-05-23 19:45:16.513][panic][ERROR] thread 'rocket-worker-thread' panicked at 'Error loading attachments: DatabaseError(__Unknown, "Commands out of sync; you can't run this command now")': src/db/models/attachment.rs:196
vaultwarden    | 2022-05-23T19:45:16.516877999Z    0: vaultwarden::init_logging::{{closure}}
vaultwarden    | 2022-05-23T19:45:16.516917724Z    1: std::panicking::rust_panic_with_hook
vaultwarden    | 2022-05-23T19:45:16.516969010Z    2: std::panicking::begin_panic_handler::{{closure}}
vaultwarden    | 2022-05-23T19:45:16.516997363Z    3: std::sys_common::backtrace::__rust_end_short_backtrace
vaultwarden    | 2022-05-23T19:45:16.517034252Z    4: rust_begin_unwind
vaultwarden    | 2022-05-23T19:45:16.517048589Z    5: core::panicking::panic_fmt
vaultwarden    | 2022-05-23T19:45:16.517079778Z    6: core::result::unwrap_failed
vaultwarden    | 2022-05-23T19:45:16.517093013Z    7: tokio::runtime::enter::exit
vaultwarden    | 2022-05-23T19:45:16.517123690Z    8: tokio::runtime::thread_pool::worker::block_in_place
vaultwarden    | 2022-05-23T19:45:16.517135091Z    9: <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll
vaultwarden    | 2022-05-23T19:45:16.517161912Z   10: <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll
vaultwarden    | 2022-05-23T19:45:16.517174946Z   11: <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll
vaultwarden    | 2022-05-23T19:45:16.517209531Z   12: <core::future::from_generator::GenFuture<T> as core::future::future::Future>::poll
vaultwarden    | 2022-05-23T19:45:16.517224429Z   13: tokio::runtime::task::harness::poll_future
vaultwarden    | 2022-05-23T19:45:16.517266849Z   14: tokio::runtime::task::harness::Harness<T,S>::poll
vaultwarden    | 2022-05-23T19:45:16.517280976Z   15: std::thread::local::LocalKey<T>::with
vaultwarden    | 2022-05-23T19:45:16.517307125Z   16: tokio::runtime::thread_pool::worker::Context::run_task
vaultwarden    | 2022-05-23T19:45:16.517318657Z   17: tokio::runtime::thread_pool::worker::Context::run
vaultwarden    | 2022-05-23T19:45:16.517350286Z   18: tokio::macros::scoped_tls::ScopedKey<T>::set
vaultwarden    | 2022-05-23T19:45:16.517365504Z   19: tokio::runtime::thread_pool::worker::run
vaultwarden    | 2022-05-23T19:45:16.517397605Z   20: <tokio::runtime::blocking::task::BlockingTask<T> as core::future::future::Future>::poll
vaultwarden    | 2022-05-23T19:45:16.517412883Z   21: tokio::runtime::task::harness::Harness<T,S>::poll
vaultwarden    | 2022-05-23T19:45:16.517460072Z   22: tokio::runtime::blocking::pool::Inner::run
vaultwarden    | 2022-05-23T19:45:16.517476022Z   23: std::sys_common::backtrace::__rust_begin_short_backtrace
vaultwarden    | 2022-05-23T19:45:16.517518501Z   24: core::ops::function::FnOnce::call_once{{vtable.shim}}
vaultwarden    | 2022-05-23T19:45:16.517536144Z   25: std::sys::unix::thread::Thread::new::thread_start
vaultwarden    | 2022-05-23T19:45:16.517572913Z   26: start_thread
vaultwarden    | 2022-05-23T19:45:16.517588172Z   27: clone
vaultwarden    | 2022-05-23T19:45:16.517619471Z

wontfix Third party

opened by Decicus 35

Android application crashes on unlock but not login

Subject of the issue

Your environment

Bitwarden_rs version: 1.16.3 with and without this patch backported, just in case: https://github.com/dani-garcia/bitwarden_rs/commit/0b6a003a8baa909798097100627571b090b1e066.patch

Install method: NixOS
Clients used: Bitwarden f-droid 2.6.1 LineageOS 17.1 (android 10)
Reverse proxy and version: nginx 1.16.1
Version of mysql/postgresql: sqlite
Other relevant information:

Steps to reproduce

Lock the vault Type the master password, and unlock. The application crashes Logcat:

21:25:28.486 12658 12658 I MonoDroid: UNHANDLED EXCEPTION:
21:25:28.495 12658 12658 I MonoDroid: System.Exception: PBKDF2 iteration minimum is 5000.
21:25:28.495 12658 12658 I MonoDroid:   at Bit.Core.Services.CryptoService.MakeKeyAsync (System.String password, System.String salt, System.Nullable`1[T] kdf, System.Nullable`1[T] kdfIterations) [0x0009d] in <9f872fb189f94834a4003aff394890d6>:0 
21:25:28.495 12658 12658 I MonoDroid:   at Bit.App.Pages.LockPageViewModel.SubmitAsync () [0x009e9] in <26e6ab0d79a14f20b188c6e5329517c2>:0 
21:25:28.495 12658 12658 I MonoDroid:   at Bit.App.Pages.LockPage.<Unlock_Clicked>b__17_1 () [0x0006d] in <26e6ab0d79a14f20b188c6e5329517c2>:0 
21:25:28.495 12658 12658 I MonoDroid:   at System.Runtime.CompilerServices.AsyncMethodBuilderCore+<>c.<ThrowAsync>b__7_0 (System.Object state) [0x00000] in <8b5405f22643417f995402e834d2ceac>:0 
21:25:28.495 12658 12658 I MonoDroid:   at Android.App.SyncContext+<>c__DisplayClass2_0.<Post>b__0 () [0x00000] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.495 12658 12658 I MonoDroid:   at Java.Lang.Thread+RunnableImplementor.Run () [0x00008] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.495 12658 12658 I MonoDroid:   at Java.Lang.IRunnableInvoker.n_Run (System.IntPtr jnienv, System.IntPtr native__this) [0x00008] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.495 12658 12658 I MonoDroid:   at (wrapper dynamic-method) Android.Runtime.DynamicMethodNameCounter.50(intptr,intptr)
21:25:28.502 12658 12658 D AndroidRuntime: Shutting down VM
21:25:28.503 12658 12658 E AndroidRuntime: FATAL EXCEPTION: main
21:25:28.503 12658 12658 E AndroidRuntime: Process: com.x8bit.bitwarden, PID: 12658
21:25:28.503 12658 12658 E AndroidRuntime: android.runtime.JavaProxyThrowable: System.Exception: PBKDF2 iteration minimum is 5000.
21:25:28.503 12658 12658 E AndroidRuntime:   at Bit.Core.Services.CryptoService.MakeKeyAsync (System.String password, System.String salt, System.Nullable`1[T] kdf, System.Nullable`1[T] kdfIterations) [0x0009d] in <9f872fb189f94834a4003aff394890d6>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at Bit.App.Pages.LockPageViewModel.SubmitAsync () [0x009e9] in <26e6ab0d79a14f20b188c6e5329517c2>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at Bit.App.Pages.LockPage.<Unlock_Clicked>b__17_1 () [0x0006d] in <26e6ab0d79a14f20b188c6e5329517c2>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at System.Runtime.CompilerServices.AsyncMethodBuilderCore+<>c.<ThrowAsync>b__7_0 (System.Object state) [0x00000] in <8b5405f22643417f995402e834d2ceac>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at Android.App.SyncContext+<>c__DisplayClass2_0.<Post>b__0 () [0x00000] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at Java.Lang.Thread+RunnableImplementor.Run () [0x00008] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at Java.Lang.IRunnableInvoker.n_Run (System.IntPtr jnienv, System.IntPtr native__this) [0x00008] in <4ed8ad1e269942a1a95e75a1ad177714>:0 
21:25:28.503 12658 12658 E AndroidRuntime:   at (wrapper dynamic-method) Android.Runtime.DynamicMethodNameCounter.50(intptr,intptr)
21:25:28.503 12658 12658 E AndroidRuntime: 	at mono.java.lang.RunnableImplementor.n_run(Native Method)
21:25:28.503 12658 12658 E AndroidRuntime: 	at mono.java.lang.RunnableImplementor.run(RunnableImplementor.java:30)
21:25:28.503 12658 12658 E AndroidRuntime: 	at android.os.Handler.handleCallback(Handler.java:883)
21:25:28.503 12658 12658 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:100)
21:25:28.503 12658 12658 E AndroidRuntime: 	at android.os.Looper.loop(Looper.java:214)
21:25:28.503 12658 12658 E AndroidRuntime: 	at android.app.ActivityThread.main(ActivityThread.java:7356)
21:25:28.503 12658 12658 E AndroidRuntime: 	at java.lang.reflect.Method.invoke(Native Method)
21:25:28.503 12658 12658 E AndroidRuntime: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:491)
21:25:28.503 12658 12658 E AndroidRuntime: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:940)
21:25:28.507  1365  7690 W ActivityTaskManager:   Force finishing activity com.x8bit.bitwarden/.MainActivity
21:25:28.507  1365 13388 I DropBoxManagerService: add tag=data_app_crash isTagEnabled=true flags=0x2
21:25:28.523  1365  3729 E BufferQueueProducer: [unnamed-1365-31] setMaxDequeuedBufferCount: 2 dequeued buffers would exceed the maxBufferCount (2) (maxAcquired 1 async 0 mDequeuedBufferCannotBlock 0)

Expected behaviour

Unlock the vault

Actual behaviour

Bitwarden closes

opened by symphorien 32

[WIP] Simple LDAP sync
So this is definitely a work in progress as it's quite messy. This is also my first time using Rust, so this is probably not very idiomatic and contains mistakes.

This patch adds several new config values for setting up a connection to an LDAP server, then polling it periodically and generating invites for users that do not yet have accounts. In short, I roughly did what was discussed in #40 and used what @mprasil wrote in #173 to add users.

A couple of notes:

There are still a bunch of print statements that I ought to clean up

I'm not sure if the way that I kicked off the thread is the best way to do so. Tokio only allows one Reactor Core, so if something is added later on, this may cause an issue. It may be possible to initialize a core in the main function and then pass handles down to the other functions.

There are a few error handling items within the Futures that I can't quite figure out. Not sure how best to deal with them.

Please let me know any feedback. I'm happy to iterate on this!
opened by ViViDboarder 32
Fix failing large note imports

When importing to Vaultwarden (or Bitwarden) notes larger then 10_000 encrypted characters are invalid. This because it for one isn't compatible with Bitwarden. And some clients tend to break on very large notes.

We already added a check for this limit when adding a single cipher, but this caused issues during import, and could cause a partial imported vault. Bitwarden does some validations before actually running it through the import process and generates a special error message which helps the user indicate which items are invalid during the import.

This PR adds that validation check and returns the same kind of error. Fixes #3048

opened by BlackDex 0
[NOTE] ⚠️ Client fails to connect or login ⚠️
New versions

If you are currently unable to login with any client after you either have the clients updated or Vaultwarden it self please check you are running the latest version of Vaultwarden!

Bitwarden has released new client versions which are not compatible with Vaultwarden version bellow 1.27.0. Since version 1.27.0 Vaultwarden supports these new clients and has many bugs fixed and features added.

See the release notes here Release v1.27.0 (2022-12-24).

If you are running the testing tagged releases of Vaultwarden, the version should be 1.26.0-10dadfca, which is exactly the same as the released 1.27.0.

Please do not report any client connection bugs or issues before you have fully updated your environment to the latest version. To check which version you are running right now you can best login into the Admin Interface. To access the Admin Interface you need to go to https://your.domain.tld/admin and after login click on the Diagnostics tab. This will show you the current version you have running.

If you can't access the admin interface you can also check the web-vault version on the web client. It should look something like this.

An other way to check the version of Vaultwarden is via the cli, either via docker or container-less install.

# If you have installed Vaultwarden via a package manager like pacman, deb or yum. vaultwarden --version # If you have it running via docker or podman # Replace vaultwarden-container-name with the actual name of your vaultwarden container, check `docker ps` docker exec vaultwarden-container-name /vaultwarden --version

Other common issues

There are some other common issues where people are reporting 2FA/MFA not working. Most of the time this is either incorrect date/time, this can be checked in the Admin Interface at the Diagnostics page. Or, the reverse proxy has some added security settings enabled which replace or adds the already present correct security headers, or prevent PUT or DELETE requests.

This causes issues like unable to login, update ciphers, upload attachments and other strange issues. Please also check the logs of your reverse proxy before posting any issue!
opened by BlackDex 0
Update WebSocket Notifications
Previously the websocket notifications were using the string app_id as the ContextId. This was incorrect and should have been the device_uuid from the client device executing the request. The clients will ignore the websocket request if the uuid matches. This also fixes some issues with the Desktop client which is able to modify attachments within the same screen and causes an issue when saving the attachment afterwards.

Also changed the way to handle removed attachments, since that causes an error saving the vault cipher afterwards, complaining about a missing attachment. Bitwarden ignores this, and continues with the remaining attachments (if any). This also fixes #2591 .

Further some more websocket notifications have been added to some other functions which enhance the user experience.

Logout users when deauthed, changed password, rotated keys

Trigger OrgSyncKeys on user confirm and removal

Added some extra to the send feature

Also renamed UpdateTypes to match Bitwarden naming.
opened by BlackDex 0
Access to fetch at 'https://2fa.directory/api/v3/totp.json' has been blocked by CORS policy
Subject of the issue

After update to 1.27.0 [Latest] the ability to check for enabled 2FA is broken.

In the Chrome browser console, the following information: "Access to fetch at 'https://2fa.directory/api/v3/totp.json' from origin 'https://my.doma.in' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled."

In the Web Vault always "good news".

Deployment environment

vaultwarden version: 1.27.0 [Latest]

Install method: Docker image (vaultwarden/server:latest)

Clients used: web wault (Chrome/Firefox/Opera browsers)

Reverse proxy and version: nginx/1.23.2

MySQL/MariaDB or PostgreSQL version: sqlite3

Other relevant details:

Steps to reproduce

Expected behaviour

Actual behaviour

Troubleshooting data
future Vault Third party
opened by ob-tk 4
Resolve uninlined_format_args clippy warnings

The upcomming release of Rust 1.67.0 will warn on uninlined_format_args. This PR resolves that by inlining all these items. It also looks nicer.

Also added a clippy.toml which indicates the MSRV to prevent clippy suggests which could break the MSRV version compile.

opened by BlackDex 4
Log message to stderr if LOG_FILE is not writable

Closes #3055. Logs a message to stderr if the configured log file isn't writable. Because the error! macro is configured to use any log files already set up I'm using eprintln! here. Let me know if there's another way you would prefer.

opened by pjsier 3

Releases(1.27.0)

1.27.0(Dec 24, 2022)
New features

Event logs for organizations

With this feature enabled, actions occurring inside an organization will be recorded in a log, viewable by organization admins and owners. Check the official documentation to learn more: https://bitwarden.com/help/event-logs/ (Note that the Public API is not yet implemented, so the events are only viewable in the Web Vault)

To enable this feature, set ORG_EVENTS_ENABLED=true. By default all events will be stored indefinitely, if you want to limit that, you can use the EVENTS_DAYS_RETAIN option. You can also tune the cleanup schedule with EVENT_CLEANUP_SCHEDULE.

Group support (beta)

Enables the creation and use of groups inside an organization. At the moment this is in beta because there are some known issues (https://github.com/dani-garcia/vaultwarden/issues/2989). Still, the more this feature is tested, the faster we will be able to stabilize it.

To enable this feature, set ORG_GROUPS_ENABLED=true, make sure to make proper backups of your instance before hand.

What's Changed

Group support | applied .diff by @MFijak in https://github.com/dani-garcia/vaultwarden/pull/2846

Add Organizational event logging feature by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2868

Updated web vault to 2022.12.0 by @dani-garcia

Update diesel to 2.0.2 by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/2724

Limit Cipher Note encrypted string size by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2945

fix invitations of new users when mail is disabled by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2773

attach images in email by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2784

allow registration without invite link by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2799

Fix master password hint update not working. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2834

Sync global_domains.json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2840

verify email on registration by invite by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2804

Take ROCKET_ADDRESS into account in the Docker healthcheck by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2844

Update github workflows by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2852

feat: Bump web-vault to v2022.10.1 by @GeekCornerGH in https://github.com/dani-garcia/vaultwarden/pull/2859

Update Rust version, deps and workflow by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2888

Add /devices/knowndevice endpoint by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2893

fix: removed a double space by @GeekCornerGH in https://github.com/dani-garcia/vaultwarden/pull/2894

Support Org Export for v2022.11 clients by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2899

Use constant size generic parameter for random bytes generation by @samueltardieu in https://github.com/dani-garcia/vaultwarden/pull/2910

Update config comment to reflect rfc8314. by @skid9000 in https://github.com/dani-garcia/vaultwarden/pull/2911

Set "Bypass admin page security" as read-only by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2918

Fully remove DuckDuckGo email service. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2919

Added missing register endpoint to identity by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2920

Prevent DNS leak when icon regex is configured by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2921

Update settings description by @karbobc in https://github.com/dani-garcia/vaultwarden/pull/2928

allow managers to set groups of a collection by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2933

Update Vaultwarden Logo's by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2940

check if sqlite folder exists by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2873

redirect to admin login page when forward fails by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2886

Cleanups and Fixes for Emergency Access by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2936

Update dependencies for Rust and Admin interface. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2941

Fix admin repost warning. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2953

Add dev-only query logging support by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2954

Fix managers and groups link by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2947

use a custom 404 page by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2948

Increase privacy of masked config by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2963

Improve comments by @tessus in https://github.com/dani-garcia/vaultwarden/pull/2969

use black favicon for /admin by @tessus in https://github.com/dani-garcia/vaultwarden/pull/2970

Remove ctrlc crate and some updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2971

Fix org export (again) by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2973

Revert collection queries back to left_join by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2976

Fix recover-2fa not working. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2994

Disable groups by default and Some optimizations by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2995

Fix a panic during Yubikey register/login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/3006

New Contributors

@MFijak made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2846

@GeekCornerGH made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2859

@samueltardieu made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2910

@skid9000 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2911

@karbobc made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2928

@tessus made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2969

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.26.0...1.27.0
Source code(tar.gz)
Source code(zip)
1.26.0(Oct 14, 2022)
What's Changed

Updated web vault to v2022.10.0

Fix uploads from mobile clients (and dep updates) by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2675

Update deps and Alpine image by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2665

Add support for send v2 API endpoints by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2756

External Links | Optimize behavior by @Fvbor in https://github.com/dani-garcia/vaultwarden/pull/2693

Add Org user revoke feature by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2698

Change the handling of login errors. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2729

Added support for web-vault v2022.9 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2732

add not_found catcher for 404 errors by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2768

Fix issue 2737, unable to create org by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2738

Rename/Fix revoke/restore endpoints by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2739

Update CSP for DuckDuckGo email forwarding by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2812

check if data folder is a writable directory by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2811

Update build workflow by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2744

fix: tooltip typo by @djbrownbear in https://github.com/dani-garcia/vaultwarden/pull/2746

Update libraries and Rust version by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2758

Fix organization vault export by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2765

allow the removal of non-confirmed owners by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2772

v2022.9.2 expects a json response while registering by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2803

make invitation expiration time configurable by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2805

return more descriptive JWT validation messages by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2806

Add CreationDate to cipher response JSON by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2813

fix link of license badge by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/2816

New Contributors

@Fvbor made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2693

@djbrownbear made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2746

@stefan0xC made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2768

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.25.2...1.26.0
Source code(tar.gz)
Source code(zip)
1.25.2(Jul 27, 2022)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images will not receive any new updates any longer.

Important

An incompatibility between the format in which some Bitwarden clients upload attachments and sends could lead to those uploads being silently corrupted. We believe this is occurring only when using the mobile clients and only on the latest vaultwarden 1.25.1. To mitigate this issue, we're releasing this quick patch to make any upload that could lead to a corrupted file explicitly return an error, notifying the user of the problem. We recommend updating as soon as possible, and checking that any recently uploaded attachments can be downloaded and opened correctly (The corrupted uploads will return an error when downloading or download a very small file).

We've also fixed the docker volume check added in 1.25.1, if you previously needed to set I_REALLY_WANT_VOLATILE_STORAGE=true to start the container, please try again without it, and open an issue if it still won't start.

What's Changed

Fix persistent folder check within containers by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2631

Mitigate attachment/send upload issues by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2650

Fix issue with CSP and icon redirects by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2624

Update build workflow for CI by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2632

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.25.1...1.25.2
Source code(tar.gz)
Source code(zip)
1.25.1(Jul 16, 2022)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images will not receive any new updates any longer.

What's Changed

Updated included web vault to version 2022.6.2 by @dani-garcia

Sync global_domains.json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2555

Add TMP_FOLDER to .env.template by @fox34 in https://github.com/dani-garcia/vaultwarden/pull/2489

Allow FireFox relay in CSP. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2565

Fix hidden ciphers within organizational view. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2567

Add password_hints_allowed config option by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2586

Fall back to move_copy_to if persist_to fails while saving uploaded files. by @ruifung in https://github.com/dani-garcia/vaultwarden/pull/2605

Swap Websocket crate from ws to tungstenite, which is more maintained, supports async, and removes around 20 old duplicate versions of used crates by @dani-garcia

Fix armv6 issue with bullseye images by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2491

Add a persistent volume check. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2501, https://github.com/dani-garcia/vaultwarden/pull/2507

Adding "UserEnabled" and "CreatedAt" member to the json output of a User by @Lowaiz in https://github.com/dani-garcia/vaultwarden/pull/2523

Bump lettre to 0.10.0-rc.7 by @paolobarbolini in https://github.com/dani-garcia/vaultwarden/pull/2531

Small email sending code improvements by @paolobarbolini in https://github.com/dani-garcia/vaultwarden/pull/2532

A little depreciation change by @binlab in https://github.com/dani-garcia/vaultwarden/pull/2556

Fix identicons not always working by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2571

Small change in log-level for better debugging by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2577

Address inconsistency v{version} with and without a v in the version with most recent updates. by @nneul in https://github.com/dani-garcia/vaultwarden/pull/2595

Bump openssl-src from 111.21.0+1.1.1p to 111.22.0+1.1.1q by @dependabot in https://github.com/dani-garcia/vaultwarden/pull/2599

Add more clippy checks for better code/readability by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2611

Update deps, misc fixes and updates, small improvements on favicons and fix file-uploads by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2543, https://github.com/dani-garcia/vaultwarden/pull/2568, https://github.com/dani-garcia/vaultwarden/pull/2619

New Contributors

@fox34 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2489

@Lowaiz made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2523

@binlab made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2556

@nneul made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2595

@dependabot made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2599

@ruifung made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2605

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.25.0...1.25.1
Source code(tar.gz)
Source code(zip)
1.25.0(May 23, 2022)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images will not receive any new updates any longer.

What's Changed

Updated included web vault to v2.28.1

Update Rocket to 0.5 and async, and compile on stable by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/2276

Update async to prepare for main merge + several updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2292

Add IP address to missing/invalid password message for Sends by @jaen in https://github.com/dani-garcia/vaultwarden/pull/2313

Add support for custom .env file path by @TinfoilSubmarine in https://github.com/dani-garcia/vaultwarden/pull/2315

Added autofocus to pw field on admin login page by @taylorwmj in https://github.com/dani-garcia/vaultwarden/pull/2328

Update login API code and update crates to fix CVE by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2354

Several updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2379

disable legacy X-XSS-Protection feature by @Wonderfall in https://github.com/dani-garcia/vaultwarden/pull/2380

Fix building mimalloc on armv6 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2397

Remove u2f implementation by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2398

Sync global_domains.json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2400

Add /api/{alive,now,version} endpoints by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2433

Improve sync speed and updated dep. versions by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2429

Database connection init by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2440

Fix upload limits and disable color logs by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2480

Update Rust version in Dockerfile by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2481

New Contributors

@jaen made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2313

@TinfoilSubmarine made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2315

@taylorwmj made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2328

@Wonderfall made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2380

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.24.0...1.25.0
Source code(tar.gz)
Source code(zip)
1.24.0(Jan 30, 2022)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images will not receive any new updates any longer.

What's Changed

Add support for external icon services by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2158

Add config option to set the HTTP redirect code for external icons by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2188

Add support for legacy HTTP 301/302 redirects for external icons by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2218

Support all DB's for Alpine and Debian by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2172

Add support for API keys by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2245

Basic ratelimit for user login (including 2FA) and admin login by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/2165

Upgrade Feature-Policy to Permissions-Policy by @iamdoubz in https://github.com/dani-garcia/vaultwarden/pull/2228

Set Expires header when caching responses by @RealOrangeOne in https://github.com/dani-garcia/vaultwarden/pull/2182

Increase length limit for email token generation by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2257

Small changes to icon log messages. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2170

Bump rust version to mitigate CVE-2022-21658 by @dscottboggs in https://github.com/dani-garcia/vaultwarden/pull/2255

Fixed #2151 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2169

Fixed issue #2154 by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2194

Fix issue with Bitwarden CLI. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2197

Fix emergency access invites for new users by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2217

Sync global_domains.json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2156

Sync global_domains.json by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2171

New Contributors

@iamdoubz made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2228

@dscottboggs made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/2255

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.23.1...1.24.0
Source code(tar.gz)
Source code(zip)
1.23.1(Dec 14, 2021)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images will not receive any new updates any longer.

What's Changed

Add email notifications for incomplete 2FA logins by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2067

Fix conflict resolution logic for read_only and hide_passwords flags by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2073

Fix missing encrypted key after emergency access reject by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2078

Fix PostgreSQL migration by @jjlin in https://github.com/dani-garcia/vaultwarden/pull/2080

Macro recursion decrease and other optimizations by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2084

Enabled trust-dns and some updates. by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/2125

Update web vault to 2.25.0

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.23.0...1.23.1
Source code(tar.gz)
Source code(zip)
1.23.0(Oct 20, 2021)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images are deprecated and will stop being updated after 1.23.0.

Added emergency access feature

Can be disabled setting EMERGENCY_ACCESS_ALLOWED=false

Added support for single organization policy

Fixed incorrect webauthn origin

Enforce personal ownership policy on imports

Fixed issue using uppercase characters on emails

Updated web vault to 2.23.0

Added organization bulk user management actions (reinvite/confirm/delete)

Removed limmit that disabled sending ciphers with attachments

Disabled enforcing of two factor organization policy on users that haven't been accepted yet

Added tzdata to the alpine containers, to be able to set a different timezone to UTC

Updated icon fetching to make it work on unicode websites

Docker images are now built using Github Actions, and the base images have been updated

Added database connection check to /alive endpoint

Updated dependencies

Source code(tar.gz)
Source code(zip)
1.22.2(Jul 25, 2021)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images are deprecated and will stop being updated after 1.23.0.

Updated web vault to 2.21.1.

Enforce 2FA policy in organizations.

Protect send routes against a possible path traversal attack.

Disable show_password_hint by default, it still can be enabled in the admin panel or with environment variables.

Disable user verification enforcement in Webauthn, which would make some users unable to login.

Fix issue that wouldn't correctly delete Webauthn Key.

Added Edge extension support for Webauthn.

Source code(tar.gz)
Source code(zip)
1.22.1(Jun 29, 2021)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images are deprecated and will stop being updated after 1.23.0.

Fix alpine builds

Source code(tar.gz)
Source code(zip)
1.22.0(Jun 28, 2021)
⚠️ Reminder: If you are still using the bitwardenrs/server* Docker images, you need to migrate to the new vaultwarden image. Check https://github.com/dani-garcia/vaultwarden/discussions/1642 for an explanation. The old images are deprecated and will stop being updated after 1.23.0.

Added sends_allowed option to disable Send functionality.

Added support for hiding the senders email address.

Added Send options policy.

Added support for password reprompt.

Switched to the new attachment download API.

Send download links use a token system to limit their downloads.

Updates to the icon fetching.

Support for webauthn.

The admin page now shows which variables are overridden.

Updated dependencies and docker base images.

Now RSA keys are generated with the included openssl instead of calling to the openssl binary.

The web vault doesn't require accepting the terms are conditions now, which weren't applicable for a self hosted server.

Source code(tar.gz)
Source code(zip)
1.21.0(Apr 30, 2021)
Update 20201-04-30: This release has been pushed again to fix an issue with the Docker builds building an older revision of the project.

Project renamed to vaultwarden

Due to user confusion and to avoid any possible trademark/brand issues with the official server, this project is going to be renamed to vaultwarden. This rename might mean you will need to make some changes to your setup.

Docker users

If you are using any of the docker images, you will have to migrate to the new image under the vaultwarden organization:

vaultwarden/server

The new image is equivalent to the old one except for the name, so the upgrade is as simple as removing the old container and creating a new one with the new image, making sure the rest of parameters are the same. For example, if you used the default docker run command mentioned in the readme, and upgrade would be done like this:

# Stop and remove the old container docker stop bitwarden docker rm bitwarden # Start new container with the data mounted, make sure the path is the same as the previous one docker run -d --name vaultwarden -v /bw-data/:/data/ -p 80:80 vaultwarden/server:latest

Note that the old images aren't gone yet, just deprecated. They will keep being updated for another two releases after this one to avoid breakage, but it's recommended to migrate to the new image as soon as possible.

If you are still using the old database specific images (server-mysql and server-postgresql), they are also deprecated since the main server image supports all three databases at the same time, more info on release 1.17.0.

If you are using the startup scripts mounted inside the container (/etc/bitwarden_rs.sh and /etc/bitwarden_rs.d/*), they will now load with the vaultwarden name first and the bitwarden_rs name as a fallback for compatibility, but it's recommended to rename them as well.

Git users

If you are using the git repository, we've used this opportunity to rename the master branch to main, so make sure to have that in mind. The rest of the process is the same and GitHub will redirect the old remote URL to the new one, simply note that the binary generated by cargo is now named vaultwarden instead of bitwarden_rs.

Changelog

Add support for enabling auto-deletion of trash items after X days, disabled by default

Set TRASH_AUTO_DELETE_DAYS to a positive value to enable this functionality

You can also configure how often this process runs, using cron sintax with the variable TRASH_PURGE_SCHEDULE

Updates to the icon fetching, making it more reliable in detecting icon types

Updated admin page, improving version checks and SQLite backup feature

Source code(tar.gz)
Source code(zip)
1.20.0(Mar 28, 2021)
Implemented Send functionality

Updated web vault to 2.19.0

CORS fixes

Updated diagnostics page with more info

Updated dependencies

Source code(tar.gz)
Source code(zip)
1.19.0(Feb 6, 2021)
Updated the admin interface:

Added diagnostic and debug information.

Added option to sort users by date.

Added ability to modify a user's type in an organization and to delete the whole organization.

Added support for the Personal Ownership policy, which when enabled disables the use of the personal vault to non-admin users of an organization.

Improved shutdown behavior on Docker images, now should handle SIGTERM better.

Basic experimental support for LDAP import using the official Directory Connector.

Note that users can't be created by this tool, it only can add or remove them from an organization.

Autoimported users join the organization with user level and they need to be confirmed by an admin or owner from the web vault. If SMTP is enabled, users will need to accept the email invitation beforehand.

Important: enabling the checkbox "Overwrite existing organization users..." in the Directory Connector can cause already existing users from the organization to be removed when syncing if they aren't present in the LDAP server, while the official server differenciates between manually added and autoimported users, and won't delete the manually added ones. This only applies to the user level, and not to managers, admins or owners, and will probably be changed in the future to align with upstream.

Updated web vault to 2.18.1.

Docker images are now built with docker buildx, which results in correct platform metadata.

Added opencontainers.org labels to Docker images.

Synced global domains data with upstream.

Source code(tar.gz)
Source code(zip)
1.18.0(Dec 28, 2020)
Config values can now be defined in a file, use <CONFIG_NAME>_FILE to point to it.

For example, if you save the admin token to /etc/bitwarden_rs/token, you can use ADMIN_TOKEN_FILE=/etc/bitwarden_rs/token and it will read the file and set the token to it's contents.

Users can be enabled/disabled from the admin panel.

Implemented manager role.

Now the .env file parsing won't fail silently.

Fixes to the email format and processing, added option to enable debugging via SMTP_DEBUG, and added options to ignore certificate issues.

The user's last active device date is shown on the admin page.

Now cipher updates are validated when they provide a revision date, which will prevent multiple clients from overwriting each other's changes.

Updated web vault to 2.17.1.

Improved icon downloading in some edge cases.

Fixed key rotation during password change.

Make sure organization policies don't affect users that aren't a part of it or aren't confirmed.

Make sure removing a user from an org doesn't also remove them from accessing other orgs.

Return 404 when an icon is missing instead of a fallback, allowing the clients to use their own fallback icon.

Add missing admin endpoints for deleting ciphers.

Updated dependencies.

Source code(tar.gz)
Source code(zip)
1.17.0(Oct 10, 2020)
New docker multi database support and MySQL/PostgreSQL support for ARM 🎉

Only one image: bitwardenrs/server

It contains support for SQLite, MySQL and PostgreSQL all in one! Supports AMD64, ARMv6, ARMv7 and ARMv8 (Aarch64), and all architectures support all database backends!.

Note, the old separate images for MySQL and PostgreSQL will be kept updated for the time being, but it's recommended to migrate when possible.

Which tag to use:

bitwardenrs/server:latest: Tracks the latest released version (i.e., tagged with a version number). Recommended for most users, and generally the most stable.

bitwardenrs/server:testing: Tracks the latest commits to the source repository. Recommended for users who want early access to the newest features or enhancements. Generally pretty stable, but occasional issues are unavoidable.

bitwardenrs/server:x.y.z: Represents a specific released version. Prefer to use latest to keep up-to-date.

Note about ARMv6

Docker seems to have some issues with architecture detection on ARMv6, so if you have trouble in that case, use these tags instead: bitwardenrs/server:arm32v6, bitwardenrs/server:testing-arm32v6, bitwardenrs/server:x.y.z-arm32v6

Alpine base

bitwardenrs/server:alpine, bitwardenrs/server:testing-alpine, bitwardenrs/server:x.y.z-alpine: Functionally the same as the above images, but based on Alpine instead of Debian, which results in a smaller image. Only supported for SQLite and the AMD64 and ARMv7 architectures.

Changelog

Docker alpine image now also works for armv7.

Docker MySQL and PostgreSQL images now also work on armv6, armv7 and armv8-64.

Multiple database support, now you can compile with cargo build --features sqlite,mysql,postgresql or any combination of them.

Now the initial database connection doesn't fail instantly when there's an error, but retries for up to 15 times by default, adjustable with the DB_CONNECTION_RETRIES option.

Sessions are properly invalidated now when changing email, password or kdf parameters.

Items are not shown to organization admins in their user view when they don't have their collection selected. Note that they still appear in the organization view.

Allow multiple SMTP auth mechanisms.

Favorite status in organization items is now tracked at the user level.

Fix admin page when DOMAIN is not configured, or configured incorrectly.

Update web vault to 2.16.1

Add vendored_openssl feature, to statically link OpenSSL, disabled by default.

Updated dependencies and synced global domains file with upstream.

Source code(tar.gz)
Source code(zip)
1.16.3(Aug 8, 2020)
Fixed mysql and postgresql releases not building correctly

Added support for restricting org creation to certain users: Examples

Syncronized global_domains.json with upstream

Source code(tar.gz)
Source code(zip)
1.16.2(Aug 6, 2020)
Fixed issue unlocking vault in the desktop client.

Added back arm32v6 tag, because docker fails to select that image in ARMv6 devices.

Fixed websocket notifications when sending an item to the trash.

Source code(tar.gz)
Source code(zip)
1.16.1(Jul 26, 2020)
Log timestamps with milliseconds by default and added option LOG_TIMESTAMP_FORMAT to customize the format

Added back arm32v6 tag in docker images, because docker doesn't select the architecture correctly from the multiarch image (https://github.com/dani-garcia/bitwarden_rs/issues/1064)

This release is also using docker multiarch images, check the Wiki page or the 1.16.0 release notes for info on how to migrate to it.
Source code(tar.gz)
Source code(zip)

1.16.0(Jul 21, 2020)

New docker multiarch support, please read the following if you use the docker images:

The docker images have been modified to make use of the multiarch support, which means there's no need to use architecture specific tags anymore, and those will not be updated in the future.

Make sure you update your images correctly following the table at the end!

Changelog

Add support for hiding passwords in a collection
Allow postgres:// DATABASE_URL
Add option to set name during HELO in email settings
Add startup script to support init operations
Use local time in email notifications for new device logins
Updated dependencies and included web vault
Removed unstable dependencies in preparation for rocket stable
Docker multiarch support

Docker multiarch transition guide

Old	New	Comments
bitwardenrs/server	bitwardenrs/server:testing	This follows the latest commits to the repository. Should be pretty stable for most use cases.
bitwardenrs/server:latest
bitwardenrs/server:raspberry
bitwardenrs/server:armv6
bitwardenrs/server:aarch64
bitwardenrs/server:1.xx.x	bitwardenrs/server:latest	This follows the latest tagged release, a bit older than testing but a bit more stable as well. Can also use bitwardenrs/server:1.xx.x for a specific version (without the arch tag), but make sure to check for updates frequently.
bitwardenrs/server:1.xx.x-raspberry
bitwardenrs/server:1.xx.x-armv6
bitwardenrs/server:1.xx.x-aarch64

bitwardenrs/server:alpine	bitwardenrs/server:testing-alpine	Like the new bitwardenrs/server:testing, uses Alpine base.
bitwardenrs/server:1.xx.x-alpine	bitwardenrs/server:alpine	Like the new bitwardenrs/server:latest, uses Alpine base. Can also use bitwardenrs/server:1.xx.x-alpine for a specific version (without the arch tag), but make sure to check for updates frequently.

bitwardenrs/server-[mysql,postgres]	bitwardenrs/server-[mysql,postgres]:testing	Like the new bitwardenrs/server:testing, for the MySQL and Postgres databases.
bitwardenrs/server-[mysql,postgres]:latest	bitwardenrs/server-[mysql,postgres]:testing
bitwardenrs/server-[mysql,postgres]:1.xx.xx	bitwardenrs/server-[mysql,postgres]:latest	Like the new bitwardenrs/server:latest, for the MySQL and Postgres databases. Can also use bitwardenrs/server-[mysql,postgres]:1.xx.x for a specific version, but make sure to check for updates frequently.

Source code(tar.gz)
Source code(zip)

1.15.1(Jun 7, 2020)
Fixed error when cloning attachments with ciphers, note that attachments are not cloned

Fixed version check when a commit hasn't been made since the last release

Added openssl extern crate to fix some builds

Updated admin page, added attachments count per user and users count per organization and fixed issue with DNS not resolving

Source code(tar.gz)
Source code(zip)
1.15.0(Jun 2, 2020)
IMPORTANT: This is a required update when using newer clients, otherwise the delete functionality won't work

Added support for soft deletion of items (trash functionality)

Redesigned admin page:

Separated into multiple pages

Icon to indicate users verified emails, and counter of the number of items they have

Added diagnostics page

Updated web vault to 2.14

Added IP address to the logs on TOTP failure, alowing fail2ban use

Some email and domain whitelist fixes

Fixed issue deleting notes in PostgreSQL

Updated dependencies and other bug fixes

Source code(tar.gz)
Source code(zip)
1.14.2(Apr 11, 2020)
Fixed bug with sync error in mobile clients.

Update web vault to 2.13.2.

Fix websockets missing id.

Improvements to docker health check, including subdirectory support.

Allow changing the build version with BWRS_VERSION env variable during cargo build.

Other dependency updates and bug fixes.

Source code(tar.gz)
Source code(zip)
1.14.1(Mar 21, 2020)
Added support for organization policies

Added support for cloning ciphers

Update web vault to version 2.13

Allow the SMTP login mechanism to be provided without quotes or initial uppercase

Updated dependencies

Make panics loggable

Fix errors when importing into an org or accepting invites

Source code(tar.gz)
Source code(zip)
1.14(Mar 13, 2020)
Added support for running on subpath, simply add the subpath to the DOMAIN variable: DOMAIN=https://example.com/custom-path

Attachment size limits, per-user and per-organization, set USER_ATTACHMENT_LIMIT or ORG_ATTACHMENT_LIMIT to a value in kilobytes to apply it.

Updated U2F library which might solve some U2F certificate errors.

Added SMTP test button in the admin page.

Use web vault built by docker autobuild, using the hash to reference the image for extra security

Now accepting y/n, True/False, 1/0 as config options that are booleans.

Fixed error Unique constraint violation when using Two Factor and Postgres.

Fixed error with can_signup_user that didn't allow to change the email address.

Don't error if admin token is empty but disabled

Now email domains are converted to punycode before sending

Enable icons to be cached in the clients

Added option to change invitation org name

Enabled the sending of invitations from the admin panel, even when disabled

Dependency updates

Source code(tar.gz)
Source code(zip)
1.13.1(Jan 5, 2020)
New collapsed log messaging, filtering the useless stuff like static file accesses and removing duplicate error messages. To get a more complete logging, use a LOG_LEVEL value of debug or trace.

Fix crash when cipher page points to huge file

Addded config option to change client IP header, IP_HEADER, by default it's X-Client-IP for backwards compat reasons.

Printed current server time when failing TOTP, for easy debugging

Protected websockets server against panics

Add a logout button on the admin page

Add endpoint to delete specific U2F key

Updated dependencies

Source code(tar.gz)
Source code(zip)
1.13.0(Nov 30, 2019)
Implemented email verification, to disable users until the email is verified you can use SIGNUPS_VERIFY=true, default is false. There are also options to change the options for verification mail resending, check the .env.template file.

Also implemented welcome email, change email confirmation and account deletion confirmation.

Modified icon parsing to accept favicons using DataURLs

Updated dependencies

Source code(tar.gz)
Source code(zip)
1.12.0(Nov 20, 2019)
Improved error message when HIBP key is not set, include a link to the page.

Added check for both the previous and next timeslots in TOTP, which is more forgiving of time mismatches (1.5 minutes now vs 30 seconds before), can be disabled setting AUTHENTICATOR_DISABLE_TIME_DRIFT=true.

Made the domain icon blacklist be cached, improving performance.

Recovery codes are now generated when adding email and Duo 2FA.

Removed MySQL libraries from SQLite images.

Added configurable SMTP timeout, and reduced the default to 15 seconds.

Updated images to be able to be built with Podman.

Added option to allow signups from specific domains only (SIGNUPS_DOMAINS_WHITELIST=domain.com,example.org).

Updated web vault to fix twofactorauth.org integration.

Updated dependencies

Source code(tar.gz)
Source code(zip)
1.11.0(Oct 8, 2019)
Important note: If you are using the old mprasil/bitwarden image, you need to migrate to the newer bitwardenrs/server to access the new releases, the images are compatible so you can follow the instructions on updating the image from the wiki.

Initial support for PostgresSQL! 🎉 Currently still a bit untested and without docker images

To compile enable the postgresql feature (cargo build --features="postgresql")

Currently there are no migration guides available, but check the previous release for some tips about migrating to MySQL

Added new icon blacklisting option, to block all non global IPs (ICON_BLACKLIST_NON_GLOBAL_IPS)

Added SQLite binary in the SQLite images, to enable backup option

Admin page scripts are loaded locally instead of using a CDN

Added CORS support

Added docker healthcheck

Added email 2FA

Updated web vault to 2.12.0

Source code(tar.gz)
Source code(zip)
1.10.0(Aug 27, 2019)
This is a big one!

Important note: If you are using the old mprasil/bitwarden image, you need to migrate to the newer bitwardenrs/server to access the new releases, the images are compatible so you can follow the instructions on updating the image from the wiki.

MySQL Support! 🎉

To enable you need to use the bitwardenrs/server-mysql image, instead of the current one.

If you are self compiling, enable the mysql feature (cargo build --features="mysql")

A SQLite -> MySQL migration requires manual steps, the short version is:

Start the bitwarden_rs MySQL instance to generate the database tables (don't create any users). Wait until the log prints Rocket has launched from http://x.x.x.x:xx, then stop the service.

To move the data from SQLite to MySQL, for this you can use:

The sqlite and mysql command lines: https://github.com/dani-garcia/bitwarden_rs/issues/497#issuecomment-511827057

Navicat Premium (paid): https://github.com/dani-garcia/bitwarden_rs/issues/497#issuecomment-498036811

MySQL Workbench (untested): https://dev.mysql.com/doc/workbench/en/wb-migration-overview-supported.html

Other stuff

Added backup option in the admin panel for the SQLite backend, remember to transfer those copies to separate drives! -Updated HaveIBeenPwned API to V3, which requires a paid API key: https://www.troyhunt.com/authentication-and-the-have-i-been-pwned-api/

Added option in admin panel to remove users two factor authentication, in case of loss or bug

Allowed explicitly defining the SMTP authentication mechanism

Added notification email when a user logs in on a new device

Updated web vault to 2.11.0

Added proxy support for the icon fetching service

Other bug fixes

Source code(tar.gz)
Source code(zip)