Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
Brand Logo

Cloudron Forum
  1. Cloudron Forum
  2. Vault

Vault

4 Topics 119 Posts
  • girishG

    Vault - Package Updates

    Pinned Locked
    101
    0 Votes
    101 Posts
    73k Views
    Package UpdatesP
    [1.83.5] Update vault to 2.0.4 Full Changelog containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps. acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints. core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed. secrets: Added ability to view secrets in YAML format auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener. Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles. audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured. auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs. core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as ?list=true, potentially changing the result of the request. secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
  • girishG

    Vault - OIDC Support

    5
    0 Votes
    5 Posts
    2k Views
    C
    @joseph I agree. I looked at some of the implementation requirements and it takes effort. With each Cloudron app update and server reboot, it requires a process to "turn on" the server. That involves presenting several keys to unlock the server. For large companies with dev ops resources, this is doable. But for smaller companies, it is too much effort with a huge risk of bringing down applications if you miss a secrets server reboot.
  • scookeS

    Vaultwarden vs Vault

    8
    1 Votes
    8 Posts
    8k Views
    marcusquinnM
    @scooke Think of Vault as kinda like Bitwarden but for code to lookup with. Unless you're coding access to things, I don't think you'd need it.
  • M

    Vault process running out of memory--plenty of memory available.

    Moved oom
    5
    0 Votes
    5 Posts
    3k Views
    girishG
    @mastadamus I will bump up the memory limit for vault. https://learn.hashicorp.com/tutorials/vault/reference-architecture says 4-8GB is recommended. Currently, the cloudron package runs at 256MB! Also, as you guessed, it's only the vault container that is dying and the server is not affected (I guess that's one of the main benefits of running in containers, a single app cannot bring down a system).