github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-26 11:55:50 -05:00
Code Issues 534 Packages Projects Releases 86 Wiki Activity

Help needed: HAProxy-Config for bitwardenrs dockerimage on Synology DSM #4112

New Issue
Closed
opened 2026-03-07 19:29:42 -06:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-03-07 19:29:42 -06:00
Owner
Copy Link
Copy Source

Originally created by @abysso2 on GitHub (Nov 3, 2019).

Hi there,
i am running several http services behind a haproxy on my openwrt-router. I also try to reach an on premise installation of the bitwarden docker image on my synology nas.

I tried the following config of haproxy:

# global parameters

global
maxconn 2048
ulimit-n 65535
uid 0
gid 0
daemon
nosplice
nbproc 2
# custom ssl options

ssl-default-bind-options no-sslv3 no-tls-tickets force-tlsv12
ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM
tune.ssl.default-dh-param 2048
# definiton of frontends

frontend main-https

mode http
bind 192.168.0.1:444 ssl crt /etc/haproxy.pem ciphers EECDH+AESGCM:EDH+AESGCM force-tlsv12 no-sslv3
reqadd X-Forwarded-Proto:\ https
http-response set-header Strict-Transport-Security max-age=31536000
http-response set-header X-Frame-Options SAMEORIGIN
http-response set-header X-Content-Type-Options nosniff
# nextcloud caldav / carddav acls

acl caldav-endpoint path_beg /.well-known/caldav
http-request set-path /remote.php/dav if caldav-endpoint
use_backend nextcloud-http if caldav-endpoint
acl carddav-endpoint path_beg /.well-known/carddav
http-request set-path /remote.php/dav if carddav-endpoint
use_backend nextcloud-http if carddav-endpoint
# bitwarden domain acl

acl bitwardendomain hdr_dom(host) -i bitwarden.mydomain.dom
use_backend synology-bitwarden if bitwardendomain

default_backend nextcloud-http
# definiton of backends
# nextcloud cluster backend

backend nextcloud-http

mode http
balance first
server next1 192.168.0.11:80 check
server next2 192.168.0.12:80 check
# bitwarden backend (docker config redirects port 8080 to 80, all firewallrules on synology are set)

backend synology-bitwarden

mode http
server synology 192.168.0.13:8080 check

Issue

I reach the login page, but after i fill in my credentials and try to login, i get a error message after “An unexpected error occurred” after aprox. 10 seconds.

I can not find any relevant information within the router and haproxy logs or within the docker image.

If i access the docker image via http://192.168.0.13:8080, everything works like a charm, so it seems to be a haproxy issue.

Any helping hands here?

Regards,
A.

Originally created by @abysso2 on GitHub (Nov 3, 2019). Hi there, i am running several http services behind a haproxy on my openwrt-router. I also try to reach an on premise installation of the bitwarden docker image on my synology nas. I tried the following config of haproxy: ``` # global parameters global maxconn 2048 ulimit-n 65535 uid 0 gid 0 daemon nosplice nbproc 2 # custom ssl options ssl-default-bind-options no-sslv3 no-tls-tickets force-tlsv12 ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM tune.ssl.default-dh-param 2048 # definiton of frontends frontend main-https mode http bind 192.168.0.1:444 ssl crt /etc/haproxy.pem ciphers EECDH+AESGCM:EDH+AESGCM force-tlsv12 no-sslv3 reqadd X-Forwarded-Proto:\ https http-response set-header Strict-Transport-Security max-age=31536000 http-response set-header X-Frame-Options SAMEORIGIN http-response set-header X-Content-Type-Options nosniff # nextcloud caldav / carddav acls acl caldav-endpoint path_beg /.well-known/caldav http-request set-path /remote.php/dav if caldav-endpoint use_backend nextcloud-http if caldav-endpoint acl carddav-endpoint path_beg /.well-known/carddav http-request set-path /remote.php/dav if carddav-endpoint use_backend nextcloud-http if carddav-endpoint # bitwarden domain acl acl bitwardendomain hdr_dom(host) -i bitwarden.mydomain.dom use_backend synology-bitwarden if bitwardendomain default_backend nextcloud-http # definiton of backends # nextcloud cluster backend backend nextcloud-http mode http balance first server next1 192.168.0.11:80 check server next2 192.168.0.12:80 check # bitwarden backend (docker config redirects port 8080 to 80, all firewallrules on synology are set) backend synology-bitwarden mode http server synology 192.168.0.13:8080 check ``` # Issue I reach the login page, but after i fill in my credentials and try to login, i get a error message after “An unexpected error occurred” after aprox. 10 seconds. I can not find any relevant information within the router and haproxy logs or within the docker image. If i access the docker image via http://192.168.0.13:8080, everything works like a charm, so it seems to be a haproxy issue. Any helping hands here? Regards, A.
GiteaMirror commented 2026-03-07 19:29:43 -06:00
Author
Owner
Copy Link
Copy Source

@pboesch commented on GitHub (Nov 5, 2019):

Hi,
My haproxy configuration for bitwarden:

backend vm_bitwardenrs
  mode http
  balance source
  option forwardfor
  hash-type consistent
  log global
  timeout connect 30000
  timeout server 30000
  server bitwarden192.168.1.3:80
@pboesch commented on GitHub (Nov 5, 2019): Hi, My haproxy configuration for bitwarden: ``` backend vm_bitwardenrs mode http balance source option forwardfor hash-type consistent log global timeout connect 30000 timeout server 30000 server bitwarden192.168.1.3:80 ````
GiteaMirror commented 2026-03-07 19:29:44 -06:00
Author
Owner
Copy Link
Copy Source

@abysso2 commented on GitHub (Nov 6, 2019):

Thanks a lot but i still get the same error ... i have to dig deeper :-)

@abysso2 commented on GitHub (Nov 6, 2019): Thanks a lot but i still get the same error ... i have to dig deeper :-)
GiteaMirror commented 2026-03-07 19:29:44 -06:00
Author
Owner
Copy Link
Copy Source

@pboesch commented on GitHub (Nov 7, 2019):

You could try to comment these lines:

reqadd X-Forwarded-Proto:\ https
http-response set-header Strict-Transport-Security max-age=31536000
http-response set-header X-Frame-Options SAMEORIGIN
http-response set-header X-Content-Type-Options nosniff
@pboesch commented on GitHub (Nov 7, 2019): You could try to comment these lines: ``` reqadd X-Forwarded-Proto:\ https http-response set-header Strict-Transport-Security max-age=31536000 http-response set-header X-Frame-Options SAMEORIGIN http-response set-header X-Content-Type-Options nosniff ```
GiteaMirror commented 2026-03-07 19:29:44 -06:00
Author
Owner
Copy Link
Copy Source

@dani-garcia commented on GitHub (May 13, 2020):

Closed due to inactivity.

@dani-garcia commented on GitHub (May 13, 2020): Closed due to inactivity.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#4112