1.29.0

[dani-garcia]

Major changes and New Features

• WebSocket notifications now work via the default HTTP port. No need for WEBSOCKET_ENABLED and a separate port anymore.
  Some proxy examples still need to be updated for this. Support for the old websockets port 3012 will remain for the time being.
• Mobile Client push notification support, see feat: Implement Push Notifications sync #3304 thanks @GeekCornerGH!
• Web-Vault updated to v2023.5.0 (v2023.5.1 does not add any improvements for us)
• The latest Bitwarden Directory Connector can be used now (v2022.11.0)
• Storing passkeys is supported, though the clients are not yet released. So, it might be we need to make some changes once they are released.
  See: feat: Support for storing passkeys in the vault #3593, thanks @GeekCornerGH!

What's Changed

• check if reset password policy is enabled by @stefan0xC in check if reset password policy is enabled #3427
• WebSockets via Rocket's Upgrade connection by @BlackDex in WebSockets via Rocket's Upgrade connection #3404
• Several config and admin interface fixes by @BlackDex in Several config and admin interface fixes #3436
• Fixed missing footer_text and a few inconsistencies in email templates by @kennymc-c in Fixed missing footer_text and a few inconsistencies in email templates #3439
• Small update to Rocket WebSockets by @BlackDex in Small update to Rocket WebSockets #3440
• inline static rsa keys by @vilgotf in inline static rsa keys #3475
• Update Rust and Crates by @BlackDex in Update Rust and Crates #3469
• Change String to &str for all Rocket functions and some other fixes by @BlackDex in Change String to &str for all Rocket functions and some other fixes #3491
• Use Rocket v0.5 branch to fix endpoints by @BlackDex in Use Rocket v0.5 branch to fix endpoints #3502
• Use fully qualified image names in Dockerfile by @gitouche-sur-osm in Use fully qualified image names in Dockerfile #3505
• policy data should be null not an empty object by @stefan0xC in policy data should be null not an empty object #3513
• update web-vault to v2023.4.2 by @stefan0xC in update web-vault to v2023.4.2 #3522
• Sync global_domains.json (Pinterest) by @jjlin in Sync global_domains.json (Pinterest) #3532
• Prevent 401 on main admin page by @BlackDex in Prevent 401 on main admin page #3547
• Update crates and GH Workflow by @BlackDex in Update crates and GH Workflow #3548
• Fix collection change ws notifications by @BlackDex in Fix collection change ws notifications #3546
• Update Rust and Crates by @tessus in Update Rust and Crates #3563
• feat: Implement Push Notifications sync by @GeekCornerGH in feat: Implement Push Notifications sync #3304
• Implement the Organization API Key support for the new Directory Connector v2022 by @BlackDex in Implement the Organization API Key support for the new Directory Connector v2022 #3568
• Add mobile push device filter to non-null push uuid by @quexten in Add mobile push device filter to non-null push uuid #3578
• Update crates and workflow by @BlackDex in Update crates and workflow #3603
• Add group import on invite by @farodin91 in Add group import on invite #3606
• Fix send access regression by @BlackDex in Fix send access regression #3608
• feat: Support for storing passkeys in the vault by @GeekCornerGH in feat: Support for storing passkeys in the vault #3593
• add user to collection during creation by @farodin91 in add user to collection during creation #3609
• Updated docker run command by @DenuxPlays in Updated docker run command #3620
• Added-External_id for Collections by @fashberg in Added-External_id for Collections #3623
• fix missing password check while manual reset password enrollment by @sirux88 in fix missing password check while manual reset password enrollment #3632
• Update crates and small clippy fix by @BlackDex in Update crates and small clippy fix #3649
• fix version when compiled at a specific commit by @tessus in fix version when compiled at a specific commit #3651
• Fix org creation regresion by @BlackDex in Fix org creation regresion #3659

New Contributors

• @kennymc-c made their first contribution in Fixed missing footer_text and a few inconsistencies in email templates #3439
• @vilgotf made their first contribution in inline static rsa keys #3475
• @gitouche-sur-osm made their first contribution in Use fully qualified image names in Dockerfile #3505
• @quexten made their first contribution in Add mobile push device filter to non-null push uuid #3578
• @DenuxPlays made their first contribution in Updated docker run command #3620
• @fashberg made their first contribution in Added-External_id for Collections #3623

Full Changelog: 1.28.1...1.29.0

---

This discussion was created from the release 1.29.0.

[EchoDev]

Thanks for the update! The push notification feature looks nice :)

Are websockets only used for notifications? I don't remember configuring websockets for my own setup in the past.

Are there any downsides/risks/footnotes when implementing push notifications on our own vaultwarden setup?

[BlackDex]

websockets are only used for notifications on cipher/send/settings updates where possible and supported by the clients.

In regards to push notifications, it does make your server connect to Bitwarden and send uuid's, but that's about it.

[mobeicanyue]

Thanks for the update!
could you please update the wiki？
i want to apply the upgrade but don't konw how to change my docker.yaml file.
:D

[mobeicanyue]

What a surprise, I actually got a reply
I saw the update that said there was no need to set port 3012
And the wiki seemed haven't the wiki about nginx configuration
I'd like to show you my docker compose configuration file to see if it's configured correctly
And I set up port forwarding in nginx to transfer port 666

version: '3'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    ports:
      - '666:80'    
    volumes:
      - ./vw-data:/data
    environment:
      DOMAIN: https://aaa.site
      WEB_VAULT_ENABLED: "true"
      SIGNUPS_ALLOWED: false

[BlackDex]

As stated in the changelog, you also need to change your reverse proxy, and for those items you need to go to https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples , but currently only 2 nginx examples are updated. I suggest if you want more help regarding this, is to open a new discussion and mention which reverse proxy you use and what the current config is.

[l4rm4nd]

So as traefik users we can just ommit the following labels:

  - traefik.http.routers.bitwarden-websocket.rule=Host(`bitwarden.domain.tld`) && Path(`/notifications/hub`)
  - traefik.http.routers.bitwarden-websocket.service=bitwarden-websocket
  - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012

and the new container version 1.29.0 will happily talk via the HTTP 80 port for websocket notifications? Plus disabling WEBSOCKET_ENABLED of course as mentioned in the release note. Would this be the correct approach?

[BlackDex]

I think traefik supports websockets by default, so yes :)

[l4rm4nd]

Yes it does. So it should be sufficient to just remove the deprecated router labels for websocket port 3012.

Thanks, will try!

[nemchik]

I'm excited to try out the new push notifications, but I haven't been successful.

I've updated the container to 1.29 (container logs show the correct version), included the new push variables (generated values using the link from #3304 ), running bitwarden Android app Version: 2023.5.0 (6330). I signed out of the mobile app and signed back in, enabled "approve login requests", and tapped "pending login requests" but that gave me an error saying "We are unable to process your request. Please try again or contact us." I double checked the devices table in phpmyadmin (using mariadb) and the push token and push uuid columns are null.

Edit:

Log file didn't have anything useful, but I don't have the log level turned up or anything.

p.s. I also switched my setup to use the new port 80 web sockets and adjusted my proxy, no issues there, the browser dev console seemed to indicate wss connection was good.

[BlackDex]

See #2469 for some details on how to try to get it to work.

[nemchik]

I read through it and saw a mention of deauthorizing devices. I did that (but only for my user, not for my family users, I confirmed the database table removed my phone though), logged back in with the app on my phone, and still no token or uuid in my database, and same message in the app when checking for pending login requests.

Was there something else in #2469 that I'm missing?

[kthchew]

enabled "approve login requests", and tapped "pending login requests" but that gave me an error

From my understanding, push notifications in this case allow changes from other devices to be automatically pushed to mobile clients so you don't need to manually resync them to pull the changes. Approving login requests seems to only be supported by the Bitwarden cloud server as of now (see the note at https://bitwarden.com/help/log-in-with-device/), so you'll have to wait for Bitwarden to enable it on self-hosted instances to use that feature (which could happen soon - https://community.bitwarden.com/t/login-with-device-on-self-hosted-instance/54775/2, though I'm not sure if vaultwarden will need to do anything else to support it). Edit: seems like there's currently an open vaultwarden PR about this

As for your null token, I did have that issue with some iOS devices and was able to fix that by uninstalling and reinstalling Bitwarden on the iOS devices. I did not have to deauthorize any devices manually, but simply logging out and back in did not work. I'm not sure if Android will act any differently.

[nemchik]

Uninstall and reinstall seemed to work. Kind of annoying to have to do (thinking about having to tell family). Anyway, if there's no other way, at least it does work when uninstalling and reinstalling the app.

[farodin91]

Organization API key doesn't work for me:

[2023-07-10 06:07:55.877][panic][ERROR] thread 'rocket-worker-thread' panicked at 'Error creating organization API Key: Error saving organization.

[CAUSE] DatabaseError(

    Unknown,

    "there is no unique or exclusion constraint matching the ON CONFLICT specification",

)': src/api/core/organizations.rs:2960

DB: PostgreSQL

Any idea?

[BlackDex]

Yea, that's a buggy. Fixed it quickly via #3678.
It needs to merge first of course, and we probably release a patch version/minor release later in case some more issues arise.
Once merged, you could use testing of course to have it fixed.

[BlackDex]

@farodin91 (and others affected) could you use the current testing tagged image just build. That should solve your issue. It currently only contains the fix for that issue, the rest is just the same as stable.

[simon-verbois]

Hello,

If I understand correctly, it is now possible to use the Directory Connector to synchronize AD users with Bitwarden?https://github.com/bitwarden/directory-connector/releases/tag/v2022.11.0

Thanks ;)

[BlackDex]

Yes it is :)

[simon-verbois]

Ok great news, there is a documentation on the wiki ?

[BlackDex]

Regarding? You just need to create an organization api key and use that.

All documentation in regards to Bitwarden can be found at Bitwarden.
https://bitwarden.com/help/directory-sync/

[simon-verbois]

How ok, but it's related to an organization ? Is the user automatically added to that organization ?

I will look at it after, but I got a problem (not related), some of my users accounts were automatically deleted, and I don't know why :p

[BlackDex]

If they have an external-id, and are not part of the sync they will be deleted

[iljur]

Big thanks for the update!

Is there any need for exposing port 3012 via the Dockerfile anymore?

[BlackDex]

Not if you update your reverse proxy config to pass through web-socket upgrade headers.
Depending on your reverse proxy you may need to do nothing and just pass / to Vaultwarden and be done with it, or with others like nginx or apache you need to make some adjustments.

[iljur]

That is what I thought. So the EXPOSE 3012 instruction in the official Dockerfiles is just for legacy reasons...?

[BlackDex]

That is still needed for people running the legacy way. So until we fully remove that way of working it needs to be there.
We can't just remove that. People first need to update there config's and we still support that way.

We might even consider to remove all the code regarding that, but if someone has WEBSOCKET_ENABLED configured just run Vaultwarden also on port 3012 besides port 80.

[nemchik]

I notice the /admin page Read-Only Config section still lists Websocket port as 3012 even after removing WEBSOCKET_ENABLED. Is this expected? I already adjusted my proxy to use port 80 (this is the proxy I'm using https://github.com/linuxserver/reverse-proxy-confs/blob/c51e31e661f53d2b32f67a23f06553b8f4e51fa1/vaultwarden.subdomain.conf.sample#L85 with that line modified to use 80).

P.S. I plan to update the proxy samples swag ships to use 80 instead of 3012 maybe after the next release of VW to give people enough time to get updated, unless there are plans to remove backwards compatibility using 3012 in the next release (your other comments seem to indicate that's not the plan currently).

[BlackDex]

The admin settings page show all available settings, doesn't matter if you have feature flags true or false.

Regarding the removal of port 3012. I have been running using the Rocket implementation for a long time already (since it was available in testing) and did not noticed any issues as of yet.

But i can understand that people do not read release notes etc, and then also do not update there config and reverse proxy config.
We don't want those setups to break during an update of stable.

So, we always try to provide some warnings and notices so that people change this, but that normally takes a while.
Also, since this is the first release with this feature enabled, there might be some issues which everybody using testing did not encountered or noticed yet.

If all seems stable, I'm for a next migration to pass on 3012 to the same endpoint if enabled.
And after that it will be removed i think.

[nemchik]

Just to clarify, is it expected that the admin settings page would show 3012 instead of 80?

[BlackDex]

That setting is only used for the separate websocket feature.
You can run both at the same time.

Those settings will be removed in the future, and only ROCKET_PORT will be used

[Peronia]

I'm a little bit worried about that. Before I was using port 3012, when I remove that from my env file, the admin page says that the feature is off and the default port is 3012. So we have 2 websockets? One on default on and default port 80 (or ROCKET_PORT) and one that we can configure with the WEBSOCKET vars (that one will be removed in the future)?

[Peronia]

I don't know if this is a feature:
When push notifications are enabled and I create in the web gui a new folder, it doesn't get synced to the mobile app. I must do a manually sync, then it appaers (even if I created a new entry in that folder). When I create a new entry in a known folder, it get immediately synced.

[2nistechworld]

Hello, I edited the Wiki for the Mobile push configuration
https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification