Vaultwarden behind Caddy: RAM, sync times and hardening

services:
  vaultwarden:
    image: vaultwarden/server:1.37.4
    container_name: vw
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.lab.internal:8080"
      SIGNUPS_ALLOWED: "${SIGNUPS_ALLOWED:-false}"
    volumes:
      - vw_data:/data
  caddy:
    image: caddy:2.10
    container_name: caddy
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
volumes:
  vw_data:
  caddy_data:

#!/usr/bin/env bash
# vaultwarden: Vaultwarden 1.37.4 behind Caddy (internal CA). RAM, login/sync timings with 2,000 items, SQLite size,
# SIGNUPS_ALLOWED=false, and an argon2-hashed ADMIN_TOKEN. Items are synthetic and encrypted client-side by client.py.
set -uo pipefail
source "$(dirname "$0")/../_e/lib.sh"
T=vaultwarden; D="$ROOT/lab/tests/$T"; OUT="$ROOT/evidence/tests/$T"; RAW="$OUT/raw"; N=2000; REPS=3
rm -rf "$OUT"; mkdir -p "$RAW"
start_vm "${VMP:-e}-$T" || exit 1
collect_env "$OUT"
gx 'sudo apt-get install -y -qq python3-cryptography >/dev/null 2>&1; echo "127.0.0.1 vault.lab.internal" | sudo tee -a /etc/hosts >/dev/null; mkdir -p ~/w'
for f in compose.yml Caddyfile client.py; do vm scp-to "$D/$f" w/; done
vm scp-to "$ROOT/lab/tests/_e/sampler.py" w/
gx 'cd w && docker pull -q vaultwarden/server:1.37.4 >/dev/null && docker pull -q caddy:2.10 >/dev/null; docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" ' > "$RAW/images.txt"
# --- phase 1: signups on, plain token
T0=$(now_ms)
gx 'cd w && SIGNUPS_ALLOWED=true docker compose up -d 2>&1 | tail -2; for i in $(seq 1 120); do curl -fsk --resolve vault.lab.internal:8080:127.0.0.1 https://vault.lab.internal:8080/alive >/dev/null && echo "ready after ${i}s" && exit 0; sleep 1; done; exit 1' | tee "$RAW/01-up.txt"
echo "up_wall_ms=$(( $(now_ms) - T0 ))" >> "$RAW/01-up.txt"
gx 'docker cp caddy:/data/caddy/pki/authorities/local/root.crt ~/w/root.crt && openssl x509 -in ~/w/root.crt -noout -subject -issuer -dates' > "$RAW/02-caddy-root-ca.txt"
gx 'curl -sv --cacert ~/w/root.crt https://vault.lab.internal:8080/alive 2>&1 | grep -Ei "SSL connection|subject:|issuer:|HTTP/|expire date"' > "$RAW/03-tls-handshake.txt"
gx 'curl -s -o /dev/null -w "plain http to caddy port: %{http_code}\n" --max-time 5 http://127.0.0.1:8080/alive; true' > "$RAW/03b-http-on-tls-port.txt" 2>&1
gx 'curl -s --cacert ~/w/root.crt https://vault.lab.internal:8080/api/version; echo' > "$RAW/04-version.txt"
gx 'docker exec vw sh -c "cat /web-vault/version.json 2>&1; ls /web-vault | head -5"' > "$RAW/04b-web-vault-version.txt" 2>&1
CL='cd ~/w && SSL_CERT_FILE=$HOME/w/root.crt python3 client.py'
gx "$CL register" > "$RAW/05-register.txt" 2>&1
sleep 20
gx "sudo timeout 40 python3 w/sampler.py /tmp/mem.csv 2 || true; cat /tmp/mem.csv" > "$RAW/mem-idle-0-items.csv" 2>&1
gx 'sudo ls -l /var/lib/docker/volumes/w_vw_data/_data/ | grep sqlite; sudo du -sb /var/lib/docker/volumes/w_vw_data/_data' > "$RAW/db-size-0-items.txt"
S=$(now_ms)
gx "$CL seed $N" | tee "$RAW/06-seed.txt"
echo "seed_wall_ms=$(( $(now_ms) - S ))" >> "$RAW/06-seed.txt"
gx "$CL verify $N" > "$RAW/07-verify.txt" 2>&1
gx 'sudo sqlite3 -version >/dev/null 2>&1 || sudo apt-get install -y -qq sqlite3 >/dev/null 2>&1; sudo sqlite3 /var/lib/docker/volumes/w_vw_data/_data/db.sqlite3 "select count(*) from ciphers; select count(*) from users; pragma journal_mode;"; sudo ls -l /var/lib/docker/volumes/w_vw_data/_data/ | grep sqlite; sudo du -sb /var/lib/docker/volumes/w_vw_data/_data' > "$RAW/db-size-2000-items.txt"
sleep 30
gx "sudo timeout 40 python3 w/sampler.py /tmp/mem.csv 2 || true; cat /tmp/mem.csv" > "$RAW/mem-idle-2000-items.csv" 2>&1
# timed requests, 3 reps, with the sampler running
gx 'nohup sudo python3 w/sampler.py /tmp/memb.csv 1 >/dev/null 2>&1 & echo $! > /tmp/sampler.pid'
sleep 3
gx "$CL bench $REPS" > "$RAW/08-bench.json" 2>&1
sleep 3
gx 'sudo kill $(cat /tmp/sampler.pid); sleep 1; cat /tmp/memb.csv' > "$RAW/mem-during-bench.csv"
# RAM during a burst: 8 parallel sync loops
gx 'nohup sudo python3 w/sampler.py /tmp/memc.csv 1 >/dev/null 2>&1 & echo $! > /tmp/sampler.pid'
sleep 3
gx "$CL bench 1 >/dev/null; for i in 1 2 3 4 5 6 7 8; do ($CL bench 3 >/dev/null &) ; done; sleep 25" > /dev/null 2>&1
gx 'sudo kill $(cat /tmp/sampler.pid); sleep 1; cat /tmp/memc.csv' > "$RAW/mem-during-burst.csv"
# SQLite size after a clean stop (WAL folded into the main file), then start again
gx 'cd w && S=$(date +%s%3N); docker stop vw >/dev/null; RC=$?; echo "docker_stop_exit=$RC ms=$(( $(date +%s%3N) - S ))"; echo "## after clean stop" && sudo ls -l /var/lib/docker/volumes/w_vw_data/_data/ | grep sqlite; sudo du -sb /var/lib/docker/volumes/w_vw_data/_data; echo "## after PRAGMA wal_checkpoint(TRUNCATE) with vw stopped"; sudo sqlite3 /var/lib/docker/volumes/w_vw_data/_data/db.sqlite3 "pragma wal_checkpoint(truncate);"; sudo ls -l /var/lib/docker/volumes/w_vw_data/_data/ | grep sqlite; sudo du -sb /var/lib/docker/volumes/w_vw_data/_data; docker start vw >/dev/null' > "$RAW/db-size-2000-items-after-clean-stop.txt" 2>&1
# --- phase 2: signups off
gx 'cd w && SIGNUPS_ALLOWED=false docker compose up -d 2>&1 | tail -3; sleep 8; docker exec vw env | grep SIGNUPS' > "$RAW/09-signups-off-up.txt" 2>&1
gx "cd ~/w && SSL_CERT_FILE=\$HOME/w/root.crt VW_EMAIL=latecomer@lab.invalid python3 client.py trysignup" > "$RAW/10-signup-new-user-signups-off.txt" 2>&1
gx "$CL bench 1" > "$RAW/11-existing-user-still-logs-in.json" 2>&1
# --- phase 3: admin token, plain then argon2
vm scp-to "$D/admin.sh" w/
gx 'bash ~/w/admin.sh' > "$RAW/12-admin-token.txt" 2>&1
# --- screenshot: web vault with the 2,000 synthetic items
mkdir -p "$ROOT/public/shots/$T"
tunnel 18091 8080
( cd "$D" && node vault-shot.mjs "https://vault.lab.internal:18091/" "$ROOT/public/shots/$T" ) > "$RAW/15-shots.txt" 2>&1 || echo "shot failed" >> "$RAW/15-shots.txt"
untunnel
python3 "$D/summarize.py" "$RAW" "$OUT"