Bitwarden_rs

[d19dotca]

@necrevistonnezr That’s fantastic! Very detailed. Glad you were able to make that work.

[fbartels]

@d19dotca said in Bitwarden_rs:

This already is a fork away from the official Bitwarden app

That is not quite right. A fork implies that at some point in time bitwarden_rs and the official server shared the same code, but have diverged since then. (And at at least one side won't include that changes of the other)

Bitwarden_rs is an implementation of a backend component that exposes the exact same API towards the frontend.

Some parts that require payment in the official server have been made available in _rs anyways. Other less heavily used parts are even missing.

@apatheticatitude said in Bitwarden_rs:

Is it possible the instance will break eventually

Possibly. All it takes is larger or unexpected change in the API. So far the bitwarden developer has been friendly towards third party implementations however.

[d19dotca]

@fbartels Ah yes, I guess technically "fork" wasn't really the right word there. The point I was trying to make is the same though... the source we are using for this app in Cloudron is already not the original/official Bitwarden server project to begin with.

[girish]

@d19dotca Yeah, I actually want to make the unofficial part a bit more clearer in our app description or maybe even our post install that Bitwarden. Also want to make sure that if paid features are being used, people take up a subscription with the upstream author. My understanding is that the main project is also a small indie company.

[yusf]

I take it that the mobile apps are incompatible with the former premium features in bitwarden_rs?

[d19dotca]

@yusf I guess it depends on what features you're referring to. Bitwarden_rs and the official Bitwarden clients (mobile apps, browser extensions, etc.) all support TOTP token storage and file storage, for example, which are both considered premium features (the $10/year if using official vault.bitwarden.com account). Any particular feature you're referring to?

[yusf]

@d19dotca Organisations, on the iOS client.

Would it work to first sign up for premium on their hosted service, somehow unlocking the app, then switch that to self-hosted?

[d19dotca]

@yusf It works with organization in the sense that items shared in an organization will show up and you can add new items to an existing organization. One limitation though in the mobile app is that you can’t create an organization, you have to do that in the web app. That’s a general Bitwarden limitation though, not Bitwarden_rs specifically.

Screenshot below shows the test item I created in a test org, and has a share icon next to it to signify its from a shared organization.

Screenshot below shows how to assign to an org. The org I have is called test. The scribbled out option is the personal account. Test is the org.

[yusf]

@d19dotca Oh, I see. I was looking for the organization as a folder, not as items. Good news.

[necrevistonnezr]

If a user signs up on my bitwarden instance, the email invite is not sent. Neither if I add a user to an organisation.

config.env looks like this:

# Export bitwarden rs environment variables here to ovveride the defaults
export SIGNUPS_ALLOWED=true
export INVITATIONS_ALLOWED=true
# To only allow users with the same email domain as where the app is installed:
# export SIGNUPS_DOMAINS_WHITELIST=ckfl.net
#export LOG_LEVEL=debug

Or is there a way to manually approve a user?

[doodlemania2]

That should be working. Check your outbound mail settings and logs to see if it is stuck somewhere?

[necrevistonnezr]

Indeed, the mail - relayed via sendgrid - was blocked by the recipient email provider mailbox.org:

554 5.7.1 Service unavailable; Client host [167.89.24.164] blocked by RBL; Blocked - see https://www.spamcop.net/bl.shtml?167.89.24.

[doodlemania2]

Strange that sendgrid got RBLed...but that's going to be something they will need to straighten out.

[necrevistonnezr]

@doodlemania2 said in Bitwarden_rs:

Strange that sendgrid got RBLed...but that's going to be something they will need to straighten out.

What's troubling IMHO that you don't get any notice on such rejected mails in the sender's mail account. You have to manually check https://app.sendgrid.com/suppressions/blocks

[doodlemania2]

Yup - that's a sendgrid thing - they do that to help keep spam down, but you may have to pay or something to get the reputation filters up or something?

[seeker]

So I am curious how bitwarden is working for folks?

[timconsidine]

@seeker Doing great !
I started using the free version from the official website, and did so for couple years.
I was nervous of moving to the self-hosted version, but it's indistinguishable in performance.

[jdaviescoates]

@seeker it's great! I prefer it to Last Pass which is what I was using before.

[seeker]

thank you. I am still a pretty big novice with all of this. Hard trusting myself as the system administrator of something that handles passwords.

[scooke]

@seeker Just be sure to take advantage of the auto-backup feature of Cloudron, and you'll be fine. One of my backup destinations is the free tier of Scaleway Object Storage, where you get 75GB free.

Plus, every now and then, pay for a cheap VPS for a few dollars a month for just the month, install cloudron on it, use a spare domain, and practice restoring from the backup. Then if something really goes wrong your panic level will be lower since you know how to restore from a backup.