NGINX proxy changes for v1.30

[vdias]

I'm currently using Vualtwarden 1.29.2-bc26bfa5 and Nginx wihtout any problem, just saw the v1.30 notice and not quite clear what changes i need on my nginx proxy configuration.

Could some one help on this?

Actual nginx conf:

server {
    listen 80;
    server_name vault.XXXXXXXXXXX.com;
    return 301 https://$host$request_uri;
    server_tokens off;
    more_set_headers 'Server: MyServer';
        }

server {
        listen 443 ssl;
        http2 on;
        server_name vault.XXXXXXXXXXX.com;

        modsecurity  on;
        modsecurity_rules_file  /usr/local/nginx/conf/modsecurity.conf;
        server_tokens off;
        more_set_headers 'Server: MyServer';

        ssl_certificate /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/fullchain.pem;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
        add_header Content-Security-Policy "default-src 'self';" always;

        client_max_body_size 128M;

        ssl_dhparam /usr/local/nginx/ssl/dhparam.pem;

        ssl_session_cache               builtin:1000  shared:SSL:10m;
        ssl_protocols                   TLSv1.2 TLSv1.3;
        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
        ssl_prefer_server_ciphers off;

        access_log                      /var/log/nginx/vault.XXXXXXXXXXX.com.access.log;

        location / {
                proxy_set_header        Host $host;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
                proxy_set_header        X-Frame-Options "SAMEORIGIN";
                proxy_set_header        X-XSS-Protection "1; mode=block";

                modsecurity_rules '
                    SecRuleRemoveById 941120
                    SecRuleRemoveById 911100
                    SecRuleRemoveById 920120
                ';

                proxy_pass          http://192.168.200.6:8000;
                proxy_read_timeout  200;
                proxy_redirect      http://192.168.200.6:8000 https://vault.XXXXXXXXXXX.com;
                    }
}

[BlackDex]

I would suggest to checkout the wiki examples for one: https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples

But items which i see are known to causes issues is at least the add_header Content-Security-Policy, that line should be removed. Vaultwarden sends those headers when and where needed.

You also have a few proxy_set_headers which are totally useless, since the server (Vaultwarden) will not do anything with those:

• X-Frame-Options
• X-XSS-Protection

Further, ModSecurity tends to break a lot of other items also, so use that at your own risk.
And, i'm missing the crucial part for getting websocket connections to work.

Add this outside of the server{} block:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

Add this inside the location{} block:

      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;

[vdias]

Thanks, I added ModSecurity because i have the vault exposed on Internet... Only found 3 false positive so far...

One last question, do i need the following part?

upstream vaultwarden-default {
  zone vaultwarden-default 64k;
  server 127.0.0.1:8080;
  keepalive 2;
}

Based on your suggestion the new nginx conf should be like:

upstream vaultwarden-default {
  zone vaultwarden-default 64k;
  server 192.168.200.6:8000;
  keepalive 2;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

server {
    listen 80;
    server_name vault.XXXXXXXXXXX.com;
    return 301 https://$host$request_uri;
    server_tokens off;
    more_set_headers 'Server: MyServer';
        }

server {
        listen 443 ssl;
        http2 on;
        server_name vault.XXXXXXXXXXX.com;

        modsecurity  on;
        modsecurity_rules_file  /usr/local/nginx/conf/modsecurity.conf;
        server_tokens off;
        more_set_headers 'Server: MyServer';

        ssl_certificate /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/vault.XXXXXXXXXXX.com/fullchain.pem;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

        client_max_body_size 256M;

        ssl_dhparam /usr/local/nginx/ssl/dhparam.pem;

        ssl_session_cache               builtin:1000  shared:SSL:10m;
        ssl_protocols                   TLSv1.2 TLSv1.3;
        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
        ssl_prefer_server_ciphers off;

        access_log                      /var/log/nginx/vault.XXXXXXXXXXX.com.access.log;

        location / {
                proxy_http_version     1.1;
                proxy_set_header        Upgrade $http_upgrade;
                proxy_set_header        Connection $connection_upgrade;

                proxy_set_header        Host $host;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;

                proxy_pass http://vaultwarden-default;
                proxy_read_timeout  600;

                modsecurity_rules '
                    SecRuleRemoveById 941120
                    SecRuleRemoveById 911100
                    SecRuleRemoveById 920120
                ';
                         }
}