Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
Brand Logo

Cloudron Forum
  1. Cloudron Forum
  2. Vault

Vault

4 Topics 118 Posts
  • girishG

    Vault - Package Updates

    Pinned Locked
    100
    0 Votes
    100 Posts
    70k Views
    Package UpdatesP
    [1.83.4] Update vault to 2.0.3 Full Changelog auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling. core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule. core: Use constant-time recovery token comparison core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on path "kv/*" { deny } could be bypassed for LIST kv/private/ if a broader allow path "kv/*" also existed. Policies relying on the previous (incorrect) behavior may now be denied. core: Vault will now redirect non-canonicalized paths (containing /./, /../, or //) to a cleaned path, instead of rejecting these requests AI Agent Support (Beta/Enterprise): Adds beta support for first-class AI agents. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token. core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance. secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL. secrets/transit: Add managed key support to Transit rewrap endpoint. storage/raft: reject performance_multiplier values less than or equal to zero
  • girishG

    Vault - OIDC Support

    5
    0 Votes
    5 Posts
    2k Views
    C
    @joseph I agree. I looked at some of the implementation requirements and it takes effort. With each Cloudron app update and server reboot, it requires a process to "turn on" the server. That involves presenting several keys to unlock the server. For large companies with dev ops resources, this is doable. But for smaller companies, it is too much effort with a huge risk of bringing down applications if you miss a secrets server reboot.
  • scookeS

    Vaultwarden vs Vault

    8
    1 Votes
    8 Posts
    8k Views
    marcusquinnM
    @scooke Think of Vault as kinda like Bitwarden but for code to lookup with. Unless you're coding access to things, I don't think you'd need it.
  • M

    Vault process running out of memory--plenty of memory available.

    Moved oom
    5
    0 Votes
    5 Posts
    3k Views
    girishG
    @mastadamus I will bump up the memory limit for vault. https://learn.hashicorp.com/tutorials/vault/reference-architecture says 4-8GB is recommended. Currently, the cloudron package runs at 256MB! Also, as you guessed, it's only the vault container that is dying and the server is not affected (I guess that's one of the main benefits of running in containers, a single app cannot bring down a system).