v1.4.0

What's Changed

• feat(handlers): say why a secret lookup failed, in the log only by @Turbootzz in #43
• chore: use a documentation address in examples and tests by @Turbootzz in #44
• build(runtime): embed the IANA tzdata in the binary by @guisea in #49
• fix(docker): build a per-platform binary, not amd64 for every arch by @guisea in #50
• fix(ci): stop an older commit from publishing :latest over a newer one by @Turbootzz in #54
• test: pass on fasthttp v1.7x, which refuses smuggled forwarding headers by @Turbootzz in #55
• chore(deps): bump the go-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #46
• chore(docker): bump golang from 1.26-alpine to 1.27-alpine by @dependabot[bot] in #45
• Printable-ASCII secret names, SSH key items, rename to Vaultwarden Secrets API by @Turbootzz in #56

New Contributors

• @guisea made their first contribution in #49

Full Changelog: v1.3.1...v1.4.0

v1.3.1

What's Changed

• fix(realip): trust the whole proxy chain behind a CDN by @Turbootzz in #41
• fix(realip): recognise CDN edges without configuration by @Turbootzz in #42

Full Changelog: v1.3.0...v1.3.1

v1.3.0

What's Changed

• chore(docker): bump alpine from 3.23 to 3.24 by @dependabot[bot] in #18
• chore(ci): bump actions/checkout from 6 to 7 in the actions-dependencies group by @dependabot[bot] in #19
• chore(ci): bump actions/setup-go from 6 to 7 in the actions-dependencies group by @dependabot[bot] in #21
• chore(deps): bump the go-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #17
• fix(sync): stop serving trashed items and survive server-side token invalidation by @Turbootzz in #23
• fix(sync): retain undecryptable ciphers, drop dead config, gofmt sweep by @Turbootzz in #27
• fix(security): resolve client IP right-to-left, harden secret lookup by @Turbootzz in #33
• fix(sync): treat value decrypt failures as failed ciphers by @Turbootzz in #39

Full Changelog: v1.2.0...v1.3.0

v1.2.0

What's Changed

• feat: add organization vault support by @Turbootzz in #3
• chore: multi-arch Docker build (amd64, arm64, armv7) by @Turbootzz in #4
• chore(docker): bump golang from 1.25-alpine to 1.26-alpine by @dependabot[bot] in #7
• chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.9 to 2.52.11 in the go-dependencies group by @dependabot[bot] in #6
• chore(docker): bump alpine from 3.21 to 3.23 by @dependabot[bot] in #5
• chore(ci): bump the actions-dependencies group with 4 updates by @dependabot[bot] in #11
• Filtering of synchronized secrets on collection, organization, and/or folder by @ars3nid3 in #12
• chore(deps): bump the go-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #10
• Harden API-key model: per-key scoping + revocable keys, and configurable/whitelist-aware rate limiting by @Turbootzz in #16

New Contributors

• @dependabot[bot] made their first contribution in #7
• @ars3nid3 made their first contribution in #12

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's Changed

• Security: Redact secret names from production logs & bind port to localhost by @Turbootzz in #1
• feat: Native Go API client — remove Bitwarden CLI dependency by @Turbootzz in #2

Full Changelog: v1.0.0...v1.1.0

v1.0.0

🎉 Vaultwarden API v1.0.0 - Production-ready with IP whitelisting

First stable release - Production-ready Vaultwarden API proxy with IP whitelisting and CLI authentication

📦 Download

Docker (Recommended):

docker pull turboot/vaultwarden-api:latest

Build from source:

git clone https://github.com/thijsherman/vaultwarden-api.git
cd vaultwarden-api
git checkout v1.0.0
make build

---

✨ What's New

🔒 Security Enhancements

• IP Whitelisting - Restrict API access by IP address or CIDR range

  • Support for single IPs, multiple IPs, and CIDR notation
  • Automatic validation of IP/CIDR entries
  • GitHub Actions IP range support (auto-updates every 24h)
  • Duplicate IP detection and removal

• Trusted Proxy Configuration - Proper client IP detection behind reverse proxies

  • Validates proxy IPs to prevent misconfiguration
  • Supports Cloudflare, Nginx Proxy Manager, Traefik
  • Extracts real client IP from X-Forwarded-For header

• Input Validation - Secure validation of secret names to prevent injection attacks

🔑 Authentication Improvements

• Bitwarden CLI Integration - More reliable authentication
  • API key authentication (recommended) - never expires
  • Automatic login and unlock on startup
  • Bypasses 2FA for API access
  • Fallback to session tokens for compatibility
  • Exponential backoff retry logic with proper error handling

🐛 Bug Fixes

• Fixed double cleanup of IP update goroutines
• Fixed IP detection showing Docker gateway IPs instead of real client IPs
• Fixed health check being blocked by IP whitelist
• Removed unused code (279 lines) for better maintainability
• Fixed error message capitalization to follow Go conventions

📝 Documentation

• Comprehensive IP whitelisting guide
• Detailed authentication setup instructions
• Enhanced troubleshooting section
• Updated configuration table with all environment variables
• Security best practices reorganized by priority

🧹 Code Quality

• Added package-level documentation comments
• Removed 366 lines of dead code (auth.go, unused functions)
• Added 87 lines of improvements
• Better code organization and structure
• Go conventions properly followed

---

🚀 Key Features

• ✅ Secure - API key authentication, IP whitelisting, constant-time comparison
• ✅ Lightweight - ~15MB Docker image, minimal resource usage
• ✅ Fast - Built-in caching with configurable TTL (default 5 minutes)
• ✅ Production-ready - Rate limiting (30 req/min), health checks, graceful shutdown
• ✅ Easy to deploy - Docker support with multi-arch builds (amd64, arm64)

---

📋 Requirements

• Vaultwarden instance (self-hosted Bitwarden)
• Docker (recommended) or Go 1.25+
• Reverse proxy (recommended for HTTPS)

---

🔧 Quick Start

1. Pull the Docker image

docker pull turboot/vaultwarden-api:1.0.0

2. Create environment file

# Generate a strong API key (32+ characters)
openssl rand -base64 32

# Create .env file
cat > .env << 'EOF'
API_KEY=<your-generated-api-key>
VAULTWARDEN_URL=https://vault.yourdomain.com
VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
VAULTWARDEN_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
VAULTWARDEN_PASSWORD=your-master-password
ALLOWED_IPS=<your-ip-address>
TRUSTED_PROXY_IP=172.16.0.0/12
EOF

3. Run the container

docker run -d \
  --name vaultwarden-api \
  --env-file .env \
  -p 8080:8080 \
  turboot/vaultwarden-api:1.0.0

4. Test the API

# Health check (public endpoint)
curl http://localhost:8080/health

# Get a secret (requires API key and whitelisted IP)
curl -H "Authorization: Bearer YOUR_API_KEY" \
     http://localhost:8080/secret/DATABASE_URL

---

📊 Configuration

Required Environment Variables

Variable	Description
API_KEY	API key for authentication (min 32 chars)
VAULTWARDEN_URL	Your Vaultwarden instance URL
VAULTWARDEN_CLIENT_ID	API client ID from Vaultwarden
VAULTWARDEN_CLIENT_SECRET	API client secret from Vaultwarden
VAULTWARDEN_PASSWORD	Your Vaultwarden master password

Optional Security Variables

Variable	Default	Description
ALLOWED_IPS	(empty)	Comma-separated IPs/CIDRs to whitelist
ENABLE_GITHUB_IP_RANGES	false	Allow GitHub Actions IPs
TRUSTED_PROXY_IP	localhost	Trusted reverse proxy IPs/CIDRs

Other Variables

Variable	Default	Description
API_PORT	8080	Port to listen on
ENVIRONMENT	development	Environment (production/development)
CACHE_TTL	5m	Cache duration
CORS_ALLOWED_ORIGINS	localhost:3000	CORS origins
DEBUG	false	Enable debug logging

See .env.example for full configuration.

---

🔒 Security Recommendations

Production Deployment Checklist

• Use HTTPS via reverse proxy (Nginx, Traefik, Cloudflare)
• Enable IP whitelisting (ALLOWED_IPS)
• Configure trusted proxies (TRUSTED_PROXY_IP)
• Set ENVIRONMENT=production
• Use strong API keys (32+ characters)
• Use API key authentication (not session tokens)
• Restrict CORS to specific domains
• Monitor logs for blocked IP attempts
• Regular security updates (rebuild monthly)

---

📖 Full Documentation

• README: https://github.com/thijsherman/vaultwarden-api
• Setup Guide: docs/SETUP_GUIDE.md
• Docker Hub: https://hub.docker.com/r/turboot/vaultwarden-api

---

🔄 Upgrading from Pre-1.0 Versions

Breaking Changes

⚠️ Authentication method changed - Session tokens are now optional, CLI authentication is recommended.

Before (v0.x):

VAULTWARDEN_ACCESS_TOKEN=your-session-token

After (v1.0):

VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
VAULTWARDEN_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
VAULTWARDEN_PASSWORD=your-master-password

Migration Steps

1. Stop the current container

   docker stop vaultwarden-api

2. Update your .env file with new authentication variables

3. Pull the new image

   docker pull turboot/vaultwarden-api:1.0.0

4. Update environment variables in Portainer or docker-compose

5. Start the container

   docker start vaultwarden-api

6. Verify logs for successful authentication

   docker logs -f vaultwarden-api

Note: Session tokens (VAULTWARDEN_ACCESS_TOKEN) still work but are deprecated and will be removed in v2.0.

---

🐛 Known Issues

• None at this time

---

📝 Changelog

Added

• IP whitelisting with CIDR support
• GitHub Actions IP range auto-update
• Trusted proxy configuration with validation
• Bitwarden CLI authentication
• Input validation for secret names
• Debug logging mode
• Comprehensive documentation
• Package-level comments for all modules

Changed

• Authentication now uses Bitwarden CLI (more reliable)
• Health check endpoint is now public (no IP whitelist)
• Improved error messages for configuration issues
• Security best practices reorganized by priority

Fixed

• Double cleanup of IP update goroutines
• IP detection showing proxy IPs instead of client IPs
• Health check blocked by IP whitelist
• Error message capitalization (Go conventions)

Removed

• Unused AuthManager and OAuth code (142 lines)
• Unused NewClientWithAuth function
• Unused logger sanitization functions
• Unused config fields (VaultwardenClientID, VaultwardenSecret)
• Dead code and imports

Security

• Invalid proxy IPs are now validated and logged
• IP/CIDR validation prevents misconfiguration
• Proper X-Forwarded-For parsing for reverse proxy setups
• Constant-time API key comparison
• No sensitive data in logs

---

🙏 Acknowledgments

• Built with Go and Fiber
• Uses Bitwarden CLI
• Inspired by the Vaultwarden project

---

📄 License

MIT License - See LICENSE file for details