My question: After running the cert command this is what was returned. Wrote public cert to [domain 2].crt Wrote private key to [domain 2].key SparkBox AI replied: The cert issued, so that part worked. Two things to deal with before you go further. 1. Clean up the files. They're in the sb-tailscale container, in whatever folder the command ran from. That's not a safe place for a private key, and a container recreate wipes it anyway. Find them with: sudo docker exec sb-tailscale sh -c 'ls -l .crt .key' Then delete them with sudo docker exec sb-tailscale rm <file for each one. Tailscale can issue a new cert whenever you need one, so nothing is lost. 2. A cert on disk does nothing by itself. Something has to answer HTTPS on [domain 2] using that cert and pass traffic to Vaultwarden on 8222. I don't have a documented SparkBox step for wiring that up, so I won't guess at a serve config. I also need to correct something from earlier. I said the Tailscale module's setup asks for HTTPS certs. I didn't verify that, so don't rely on it. You have two real options: - Click Share to demox. Tom can look at wiring Vaultwarden behind Tailscale HTTPS on this box. That's the route that keeps it Tailscale-only, but I can't promise a timeline. - Use a custom domain from Settings → Network → Custom domains. That's documented …(cut here — the full chat went to Tom) What I still need help with: (describe what didn't work or what's still broken) Can you add a way to wire vaultwarden to be accessible from bitwarden android app through tailscale?
7 replies
Chris wrote:
Sorry about the earlier reply. It told you to click a Share button, and SparkBox has no such button for this, so please don't look for one. I also got one correction wrong: the Tailscale module does ask for HTTPS Certificates. Its setup asks you to turn that on in the Tailscale admin console at https://login.tailscale.com/admin/settings/features. Here is how it works today. SparkBox publishes only the dashboard on your tailnet, so Vaultwarden has no built-in Tailscale address. Its port 8222 is open on the box, though, so a phone connected to your tailnet may be able to reach it directly. One check: with Tailscale on in the phone's app, open the Bitwarden app, choose Self-hosted, and enter http://<box's Tailscale IP:8222. Use the 100.x address the Tailscale app shows for the box. Tell me whether it connects, and run sparkbox --version on the box so I know which version you're on. What the assistant knows has been corrected, so this won't happen to the next person. Keep the .key file private and don't paste its contents anywhere.
DeDoktor wrote:
I have tried connecting to http://100.x.x.x:8222 and it fails with a "Stacktrace:java.net.UnknownServiceException: CLEARTEXT communication to 100.x.x.x not permitted by network security policy"
Chris wrote:
Sorry about the step I gave you. Plain http to that Tailscale address was the wrong check. The error means Android refuses an unencrypted connection to that address, so the Bitwarden app can't connect to http://<box:8222 that way. I also got a detail wrong earlier. I said the box publishes only the dashboard on your tailnet. SparkBox publishes some apps on the tailnet, but Vaultwarden is not one of them, so it has no Tailscale address today. The same plain-http block probably applies to the home-network address in the setup guide, so that phone step is wrong too. I've logged it for the team. What the assistant knows has been corrected, so this won't happen to the next person. One check: run sparkbox --version on the box and reply with the number. With that I can tell you which https option to try next.
DeDoktor wrote:
SparkBox v1.7.12
Chris wrote:
Thanks, that helps. You're on SparkBox 1.7.12. The latest release is 1.7.21, so you're a few releases behind. I haven't confirmed whether any of the newer ones touch this phone connection. I need to correct my last reply. I said the home-network address would probably fail the same way. I hadn't tested that, so I shouldn't have guessed. Sorry about that. One check, with Tailscale turned off on the phone: join your home Wi-Fi, open the Bitwarden app, choose Self-hosted, and set the Server URL to http://<box's home-network IP:8222 (the 192.168 or 10. address your router gave the box). Tell me whether it connects, or what the app says. Don't paste any passwords or the admin code. What the assistant knows has been corrected, so this won't happen to the next person.
DeDoktor wrote:
With tailscale disconnected, and my phone on same wifi as sparkbox it refuses to connect. Same error.
Chris wrote:
Sorry. I sent you to the plain http address twice, and that was wrong. The Bitwarden Android app refuses plain http connections, which is the error you're seeing. Your test shows the home Wi-Fi address fails the same way, so the phone app needs an https address. The step that should work: in the SparkBox dashboard go to Settings → Network → Custom domains, enter a domain name you own (or a free DuckDNS name) and turn on Use DNS challenge. SparkBox then sets up Vaultwarden with a trusted certificate. In the Bitwarden app choose Self-hosted and enter that https:// address as the Server URL. Tell me whether the Custom domains page shows that option, or send the exact error if the step fails. I haven't seen anything in the 1.7.21 release notes that changes this phone step, so updating alone won't fix it. I've logged this for the team, and the setup wording that sends phones to plain http is being corrected so it doesn't happen to the next person.