Solved Vaultwarden in Bastille jail - No HTTPS

bratak

bratak

Hi all

I'm still new to FreeBSD. But I torture my Home-Lab as much as I can, to learn as much as possible.
I started learning about Jails.It's a great concept, and now I use Bastille to manage Jails and in general it works superb.

Here's my new goal I set for myself:
1. Setup a FreeBSD server on my old laptop (192.168.0.40)

2. Configure pf on server according the docs from Bastille to allow ssh and dynamic rdr for the Bastille Jails
(doublechecked and works)

3. Create a Jail with Bastille, 10.0.0.50 (bwarden, as synonym for the Bitwarden aka Vaultwarden)

4. Install Vaultwarden in the "bwarden" Jail, enable & start vaultwarden service.
Checked listening port with sockstat -4, which shows me that Vaultwarden is listening on port 8000
OK, so far so good. Next:

5. On the server, route the incoming traffic at port 8000 to the bwarden jails port 8000, where vaultwarden is listening
(bastille rdr bwarden tcp 8000 8000) and restart the jail.
Check with "curl 10.0.0.50:8000", jep, returns the vaultwarden homepage HTML code, so it works.

From FireFox, accessing the server (192.168.0.40:8000), I get to the vaultwarden sign-up page.
So, that all is working fine and I'm very happe so far ;-)

New Challange:

Pre-Information:
- my pfsense with HAProxy & DNS-Server: 192.168.10.1
- my WLAN Router: 192.168.0.1 (GW: 192.168.10.1)
- my FreeBSD-Server with the vaultwarden Jail: 192.168.0.40 (it's the Laptop on WLAN)
- my Clients, accessing the FBSD-Server: 192.168.0.50 / 192.168.10.20

OK, now, I want to secure the connection to HTTPS by the HAProxy on my pfsense.
I explicitly don't want to use Nginx or any other proxy like caddy or rocket from within the vaultwarden jail.

I have setup already multiple services within pfsense and I use DNS and HAProxy successfully in my Home-Lab.
For example, I have SSL-Offloading for my Docker projects and an OpenMediaVault server.
So, in general I know how to create HTTPS connections, and how to use DNS, with pfsense.

Except for the new vaultwarden in the bwarden Bastille Jail, I have the following problem:
Even though I have configured everything in pfsense to redirect port 8000 (pfsense FrontEnd) to SSL-Offload and forward it to the FBSD-Server at Port 8000 in the pfsense-BackEnd, I only get the unencrypted HTTP page from vaultwarden. So, the chain looks like this:

From any client in my Network (FireFox, Chrome, Safari)
>> bwarden.mydomain.com:8000
>> is picked up by
>> pfsense HAProxy FrontEnd (SSL-Offloading) which uses
>> pfsense HAProxy Backend, to forward to
>> FBSD Server at 192.168.0.40:8000, which redirects (bastille rdr...) port 8000 to the
>> Bastille jail:8000 and get picked up by
>> vaultwarden on Port 8000

I'm floored, because every other service I've setup, like Docker, or Non-Docker is working perfectly with the pfsense DNS/HAProxy config.
I hope someone can enlighten me and fill the gap in my understanding.

Many thanks in advance.
 
I had the idea, to take a conversation with ChatGPT ;-)

He said, that I need a reverse proxy in front of the Jail, to terminate SSL at the server level.
Because HTTPS is not routed through to the Jail with the following command:

bastille rdr bwarden tcp 8000 8000

If this is correct, then I would not need the pfsense HAProxy.
At least, I would have learned something :)

Is this true what AI say?

And if so, why do I not need a proxy for my Docker Services? Why does it work when pfsense HAProxy is forwarding port, lets say 8080 to 8080, and then 8080 in Docker to 80 for the service?

I don't understand it, because my Docker Services don't have any reverse-proxy in front of them.
Or is Docker handling the SSL-Forwarding automatically?

Geee....so much to learn

tnx all for any enlightenment.
 
Today I followed a guide to find a temporary solution with rocket:
https://www.bsdbox.de/artikel/vaultwarden/vault-lokal

The fact that It works now, that the traffic to the Jail is encrypted, supports the conversation with ChatGPT (see prior post).
The termination of SSL needs to be at the endpoint. Now, my pfsense HAProxy is obsolete for this Jail, which I really don't like.

If anyone has a solution, or can clarify the fact, why or how it is possible to have SSL-Offloading into a Jail, routed by the server(bastille rdr jailname tcp 8000 8000) where the Jail lives, I would be very thankful.

Have a happy new week all.
 
bratak said:
why or how it is possible to have SSL-Offloading into a Jail
Click to expand...
Popular choices are running HAProxy (my personal favorite) or nginx on the host to do the SSL offloading and reverse proxy.

bratak said:
routed by the server(bastille rdr jailname tcp 8000 8000)
Click to expand...
You seem to misunderstand what a reverse proxy is and how it works.
 
Thanks SirDice

I understand the reverse proxy as an intermediate server, which handles the requests and forwards it to a specific service(s), with the possibility to encrypt the traffic in the front-end, so that traffic to the back-end doesn't necessarily has to be encrypted.

I hope that's right so far...otherwise I need a "reset" in this part of my brain ;-)

I think that the "bastille rdr..." part is not forwarding HTTPS to the Jail.
And that's the problem why SSL is not terminated in vaultwarden within the Jail....I think ;-)

So, there has to be
a) another proxy, on the server
or
b) in the jail
...to foward SSL to the vaultwarden service?

Me <--- willing to learn
 
jbo@ said:
Shameless self-advertisement: https://blog.insane.engineer/post/freebsd_simple_hosting/
As usual: Don't trust random blog posts - but probably still better than trusting the bullshit generator :)
Click to expand...

Sorry, I butchered your graphic.
But I think this is better explaining what I wanted to accomplish.

pfsense HAProxy >>> FBSD-Server >>> Jail

Screenshot from 2024-02-19 15-55-10.png
 
Finally....I found the solution and learned about Jails Networking.

The solution is, to attach the Jails NW-Adapter directly to the Servers NW-Adapter, so that the Jail is in the same Network like the server, instead in a separate network, where routing from the server to the Jail has to occur - as I understand it:

bastille create -V jailname xx.y-RELEASE ip/24 Servers-NW-Adapter

Found at: https://github.com/BastilleBSD/bastille/issues/163

Now, the Jail and it's service is accessible directly from the LAN-network, from pfsense-HAProxy, which then terminates the SSL-Offloading at the vaultwarden service in the Jail.

Of course I had to change the ip in pfsense-HAProxy to the new Jails ip, instead of the ip of the server.

Thanks for the help and I hope this is of value for others too.

sys 43162 ;)
 
Glad to hear that you found a solution satisfying your need.
Please mark this thread/topic as solved accordingly.
 
You must log in or register to reply here.
Back
Top