Proposal: support .onion domains

[nick-tgcs]

I would like to propose and potentially contribute a PR to allow Vaultwarden to work cleanly with Tor onion service addresses.

There are two intended use cases:

1. Onion-only access, where DOMAIN is a .onion URL.
2. Clearnet plus Tor access, where DOMAIN remains the primary clearnet URL and one or more additional .onion URLs are configured for Tor access.

Example onion-only setup:

DOMAIN=http://<v3-onion-address>.onion

Example clearnet plus onion setup:

DOMAIN=https://vault.example.com
ADDITIONAL_ONION_DOMAINS=http://<v3-onion-address>.onion,http://<another-v3-onion-address>.onion

Proposed scope:

• allow valid v3 .onion URLs in DOMAIN;
• add support for one or more additional .onion URLs via a separate setting;
• allow http://*.onion;
• do not add support for arbitrary additional clearnet domains;
• preserve existing behaviour for ordinary clearnet HTTP URLs;
• use the matching incoming request host/proto where appropriate when generating links, redirects, canonical URLs, CORS, allowed origins, WebSocket origins, icons, attachments, and relevant web vault/API responses;
• keep email/template URLs based on DOMAIN, unless maintainers prefer request-matched links;
• add tests for .onion URL handling in both DOMAIN and additional onion domains;
• document expected behaviour and limitations when accessing the same Vaultwarden instance from clearnet and/or Tor.

Expected onion-only setup:

[Bitwarden Client / Web Vault]
        |
        | http://<v3-onion-address>.onion
        v
[User-provided Tor routing]
        |
        v
[Tor onion service]
        |
        | HiddenServicePort 80 -> reverse proxy / Vaultwarden
        v
[Vaultwarden]

Expected clearnet plus onion setup:

[Bitwarden Client / Web Vault]
        |
        | https://vault.example.com
        v
[Clearnet reverse proxy]
        |
        v
[Vaultwarden]


[Bitwarden Client / Web Vault]
        |
        | http://<v3-onion-address>.onion
        v
[User-provided Tor routing]
        |
        v
[Tor onion service]
        |
        | HiddenServicePort 80 -> reverse proxy / Vaultwarden
        v
[Vaultwarden]

The intended result is that Vaultwarden can be run either as onion-only, or with a normal clearnet DOMAIN plus explicitly configured .onion access URLs.

[stefan0xC]

That won't work because https:// is required by the clients and also Vaultwarden does not have multi-domain support yet. Other than that I don't see a reason why using an .onion domain would not work?

[nick-tgcs]

Will work on web only regardless, and also have a similar proposal with Bitwarden that will include clients - https://community.bitwarden.com/t/hidden-services/2535/8

You can also (poorly) overcome it with trusted self-signed certs

[nick-tgcs]

(Already have it working as a PoC)