vaultwarden's admin panel was never on: AUTH_TOKEN is not an env var #127

Merged

lament merged 1 commit from vaultwarden-admin-token into main 2026-08-27 02:51:57 -05:00

Conversation 0 Commits 1 Files changed 1 +3 -3

lament commented 2026-08-27 02:06:41 -05:00

Owner

Copy link

the vaultwardenToken secret has been setting AUTH_TOKEN= since it was added, which isn't a vaultwarden env var at all - the one that gates /admin is ADMIN_TOKEN. unknown keys in an environmentFile are ignored silently, so vaultwarden booted clean the whole time with the admin panel simply never enabled. surfaced while looking for a per-user premium flag to explain missing TOTP codes in the web vault (there isn't one - vaultwarden reports premium unconditionally, there's no such column in the users table, and TOTP was already working).

• renames the key to ADMIN_TOKEN; the value is untouched, so nothing is rotated
• no module change - vaultwarden.nix already feeds the secret in as environmentFile, the key name lives inside the secret

/admin stays VPN-only via the existing ROCKET_ADDRESS = internal bind. note that the panel's settings page writes /var/lib/vaultwarden/config.json, which overrides the nix config block and survives deploys - delete it to hand authority back to the flake.

the `vaultwardenToken` secret has been setting `AUTH_TOKEN=` since it was added, which isn't a vaultwarden env var at all - the one that gates `/admin` is `ADMIN_TOKEN`. unknown keys in an `environmentFile` are ignored silently, so vaultwarden booted clean the whole time with the admin panel simply never enabled. surfaced while looking for a per-user premium flag to explain missing TOTP codes in the web vault (there isn't one - vaultwarden reports premium unconditionally, there's no such column in the users table, and TOTP was already working). - renames the key to `ADMIN_TOKEN`; the value is untouched, so nothing is rotated - no module change - `vaultwarden.nix` already feeds the secret in as `environmentFile`, the key name lives inside the secret `/admin` stays VPN-only via the existing `ROCKET_ADDRESS = internal` bind. note that the panel's settings page writes `/var/lib/vaultwarden/config.json`, which overrides the nix `config` block and survives deploys - delete it to hand authority back to the flake.

lament added 2 commits 2026-08-27 02:06:41 -05:00

drop redundant fail2ban systemd-python override ... fa8461944e

upstream systemd-python now builds against full systemd (withCompression)
by default - its default.nix even carries the exact 'Not systemdLibs:
journal reading silently returns no entries' comment we hit. the override
that forced compression is now both redundant and broken: the arg it set
(systemdLibs) was renamed to systemd, so .override throws unexpected-arg
and athena stopped evaluating on the new lock. stock pkgs.fail2ban is
correct again.

fix vaultwarden admin token env var name ... 422c1502db

AUTH_TOKEN isn't a vaultwarden env var - it was silently ignored, leaving
/admin disabled. renamed to ADMIN_TOKEN; value unchanged.

lament added the

fix

service

labels 2026-08-27 02:06:46 -05:00

lament force-pushed vaultwarden-admin-token from 422c1502db to 5a61ea4084 2026-08-27 02:43:27 -05:00 Compare

lament merged commit 5a61ea4084 into main 2026-08-27 02:51:57 -05:00

lament deleted branch vaultwarden-admin-token 2026-08-27 02:51:58 -05:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

chore

lockfile bumps, CI, reorg, docs, formatting

  

desktop

niri, theming, browser, WM/terminal, gaming

  

dropped

This is a dropped feature

  

fix

This fixes a problem

  

fleet

This is a fleet issue

  

networking

WG, DNS/kresd, NAT, firewall, site-mesh

  

security

auth, identity, secrets, hardening

  

service

new or changed app services

No labels

chore

desktop

dropped

fix

fleet

networking

security

service

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

lament/pantheon!127

No description provided.