From 6dbf2e6a55c57a7b1b5e5ee4e22293e4f8d970eb Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 18:45:21 +0100 Subject: [PATCH] Point vaultwarden's DOMAIN at APP_URL so it starts without a domain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by installing vaultwarden and one instance end to end. The template built DOMAIN as https://, and blanking host_setup on a box with no CFG_DOMAIN_n set (earlier in this branch) left it as a bare "https://". Vaultwarden validates that value and exits: Error validating domain: empty host DOMAIN variable needs to contain the protocol (http, https) APP_URL is already the address the app is reached at in both worlds — https://vault. behind Traefik, http://: without it — which is exactly what vaultwarden means by DOMAIN. Prior to the blanking the value was "https://." with a trailing dot, which started but pointed at a host that never resolved, so this was broken before too, just quietly. Verified: base and instance both come up and serve 200 on their own random ports, each with DOMAIN set to its own address, and with distinct IPs and admin tokens. Both were then removed; nothing left behind. Four other apps interpolate the same legacy DOMAINSUBNAME_DATA into env vars and get an empty value with no domain configured — gitea (DOMAIN, SSH_DOMAIN, ROOT_URL), mastodon (LOCAL_DOMAIN), owncloud (OWNCLOUD_DOMAIN), jitsimeet (PUBLIC_URL). They start rather than exit, so the breakage is quieter, and the fix is not uniform: ROOT_URL/PUBLIC_URL want a URL like this one, while DOMAIN/SSH_DOMAIN/LOCAL_DOMAIN want a bare host that APP_URL cannot supply. Left alone pending that decision. Co-Authored-By: Claude Opus 5 --- containers/vaultwarden/docker-compose.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/containers/vaultwarden/docker-compose.yml b/containers/vaultwarden/docker-compose.yml index 0b11a1f..f5c97b4 100755 --- a/containers/vaultwarden/docker-compose.yml +++ b/containers/vaultwarden/docker-compose.yml @@ -19,7 +19,13 @@ services: environment: - LOGIN_RATELIMIT_MAX_BURST=10 - LOGIN_RATELIMIT_SECONDS=60 - - DOMAIN=https://DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA + # APP_URL, not the bare subdomain: vaultwarden VALIDATES this and refuses to + # start without a protocol, so on a box with no CFG_DOMAIN_n set the old + # https:// form resolved to a bare "https://" and the container + # exited. APP_URL is already the address this app is reached at in both + # worlds — https://vault. behind Traefik, http://: + # without it — which is exactly what DOMAIN means here. + - DOMAIN=APP_URL_DATA #LIBREPORTAL|APP_URL_TAG|APP_URL_DATA - ADMIN_TOKEN=VAULTWARDEN_ADMIN_TOKEN_1_DATA #LIBREPORTAL|VAULTWARDEN_ADMIN_TOKEN_1_TAG|VAULTWARDEN_ADMIN_TOKEN_1_DATA - SIGNUPS_ALLOWED=VAULTWARDEN_SIGNUPS_ALLOWED_DATA #LIBREPORTAL|VAULTWARDEN_SIGNUPS_ALLOWED_TAG|VAULTWARDEN_SIGNUPS_ALLOWED_DATA labels: