![vaultwarden.png](/static/img/2043a7edd0936df4a9c4e88a6ec74ce5.vaultwarden.webp)

# 1. 关于Vaultwarden

Bitwarden是一个Vault软件，将你所有的信息都存储在一个加密的保险库里。它不仅可以可以管理密码，可以添加笔记和文件。这些都是加密存储的，通过一个主密码来解锁保险库。它有免费的版本，可以在它官网上注册，并且有苹果和安卓的客户端。



Bitwarden也是可以私有部署，但是它的组件非常多，部署极为复杂，并且非常占用资源。因此，Vaultwarden出现了。它是一个Bitwarden的替代方案，体验和Bitwarden几乎是一样的，兼容Bitwarden的客户端。它的docker镜像只有一个，部署难度很低，且资源占用很低，2核2G的轻量服务器可以流畅运行。[Github项目地址](https://github.com/dani-garcia/vaultwarden)。

# 2. 部署Vaultwarden

最简单的方式就是使用Docker部署。本身作为一个要求安全性的软件，官方推荐部署在一个代理后面，代理负责处理HTTPS的流量。

## 2.1 Vaultwarden的容器配置

- 因为部署在Nginx后面，所以不需要发布端口到服务器上，暴露端口80作为提示作用。
- 挂载持久存储`/data`，这里面有Vaultwarden的数据库文件，默认是SQLite。
- 首次运行要允许注册 `SIGNUPS_ALLOWED=true`，也就是注册第一个admin账号。在需要的账号的注册都注册完之后，改成`false`关闭新用户注册。
- 首次运行添加`ADMIN_TOKEN`来管理Admin界面来设置整体应用。设置完之后，将这一行注释掉。
- `network`是让Vaultwarden只可以和Nginx进行交互。我是有一个单独的Nginx来代理很多的应用。每次用新应用就直接attach新的容器到Nginx的网络里。但是可以将Nginx和Vaultwarden放到一个Docker Compose文件里。这样也不需要额外的Docker网络。

```yaml
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    expose:
      - 80
    volumes:
      - ./vw-data:/data
    environment:
      - SIGNUPS_ALLOWED=true
      - WEBSOCKET_ENABLED=true
      - ADMIN_TOKEN='sA3uL1kwrhXEZOu7BIAopdvLL3P99g4qxcN62IKI62HgpN/BQ+ilVjJc6G+oRpaZ'
      - DOMAIN=https://password.example.com
    networks:
      - nginx-reverse-proxy

networks:
  nginx-reverse-proxy:
    external: true
```

## 2.2 Nginx的容器配置

- Nginx监听80和443端口。
- 数据卷挂载:
  - Nginx的配置文件
  - Nginx的log文件
  - SSL的证书
  - 本地的时间
- Nginx网络只用于转发流量到不通的应用
- Internet网络用于Nginx和Internet流量的交互

```yaml
services:
  nginx:
    image: nginx:latest
    container_name: nginx-reverse-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./log:/var/log/nginx
      - /etc/letsencrypt/live/zenseek.site/fullchain.pem:/etc/nginx/certs/fullchain.pem:ro
      - /etc/letsencrypt/live/zenseek.site/privkey.pem:/etc/nginx/certs/privkey.pem:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - nginx-reverse-proxy
      - internet
    restart: always

networks:
  nginx-reverse-proxy:
    external: true
  internet:
    external: true
```

## 2.3 应用的Nginx配置文件

- 如果有域名就监听域名，没有可以使用IP加其他端口。
- 流量转发到`http://vaultwarden:80`，因为容器之间通信，只需要HTTP就可以了。而这个容器名可以在docker network里看到它的名字和IP。在YAML文件里设置了`container_name`，那就不会错了。

```nginx
server {
    listen 443 ssl;
    server_name password.example.com;

    # Add this line to increase the limit
    client_max_body_size 100M;

    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    # SSL/TLS Security Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Enable HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass http://vaultwarden:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://vaultwarden:3012;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /notifications/hub/negotiate {
        proxy_pass http://vaultwarden:80;
    }
}
```

在Nginx的容器内查看新的配置文件是否正确并重启Nginx。

```bash
root@b2f567d4689b:/# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
root@b2f567d4689b:/# nginx -s reload
```

# 3. 访问并设置Vaultwarden

访问地址就是`https://password.example.com`. Nginx会终结HTTPS，将HTTP流量转到Vaultwarden容器。在允许注册的情况，页面会让你输入邮箱地址和用户名，然后下一步到设置主密码。

Docker部署Vaultwarden

![wordpress.jpg](/static/img/b1a17add0bee72a61233d0a4f4f08204.wordpress.webp)
# 1. 问题描述

我的Wordpress是部署是通过Docker Compose与MySQL部署在一起的，网站的访问是通过Nginx反向代理给Wordpress的容器的。更换新域名后，我添加了新的解析，并重新生成了证书。在更新了Nginx的配置文件后，网站无法正常访问。



# 2. 连接到数据库

我先把MySQL的3306接口给发布出来，这样我可以从宿主机直接访问，因为MySQL容器里并没有MySQL的Client。

```bash
#YAML文件的端口映射
    ports:
      - "3306:3306"
      - "33060:33060"

# 宿主机上连接到MySQL容器。
mysql -h 127.0.0.1 -P 3306 -u root -p
```

# 3. 更新WP Options里的主页设置

切换到Wordpress的数据库，然后更新`WP Options`里的`Home`和`URL`。

```bash
mysql> use wordpress_db;

Database changed

mysql> UPDATE wp_options SET option_value = 'https://collections.zenseek.site' WHERE option_name = 'siteurl';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

mysql> UPDATE wp_options SET option_value = 'https://collections.zenseek.site' WHERE option_name = 'home';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

```

# 4. 更新文章，页面，链接，图片链接等里旧域名

先按这个命令查一遍。这是更新之后的结果，没更新前会有很长的输出。

```bash
mysql> SELECT ID, guid FROM wp_posts WHERE guid LIKE '%OLD_DOMAIN%';
Empty set (0.00 sec)

mysql> SELECT post_id, meta_key, meta_value FROM wp_postmeta WHERE meta_value LIKE '%OLD_DOMAIN%';
Empty set (0.00 sec)

mysql> SELECT ID, post_title, post_content FROM wp_posts WHERE post_content LIKE '%OLD_DOMAIN%';
Empty set (0.06 sec)
```

替换数据库里的旧域名。提示有多少个match和多少个changed了。之后再查一遍就跟上面的输出一样了。

```bash
mysql> UPDATE wp_posts SET post_content = REPLACE(post_content, 'OLD_DOMAIN', 'zenseek.site');
Query OK, 100 rows affected (0.30 sec)
Rows matched: 330  Changed: 100  Warnings: 0

mysql> UPDATE wp_posts SET guid = REPLACE(guid, 'OLD_DOMAIN', 'zenseek.site');
Query OK, 329 rows affected (0.00 sec)
Rows matched: 330  Changed: 329  Warnings: 0

mysql> UPDATE wp_postmeta SET meta_value = REPLACE(meta_value, 'OLD_DOMAIN', 'zenseek.site');
Query OK, 5 rows affected (0.00 sec)
Rows matched: 473  Changed: 5  Warnings: 0
```

# 5. 其他思考
在没更新域名解析和生成新的证书前，可以在Wordpress的后台更改主页地址。其他的更新可以通过`wp search-replace 'https://your-old-domain.com' 'https://your-new-domain.com' --all-tables`来直接替换旧的域名。但是Wordpress的容器里进行了精简，并没有`wp`的命令。其次，在进行任何的数据库的操作之前，可以对数据库先进行备份。我是在别处还有一样的实例，所以这一步就略过了。

![wp_home_url.jpg](/static/img/93690f754ee88d0f98dbc8d429dd3463.wp_home_url.webp)

Wordpress更换域名后无法访问

![certbot.jpg](/static/img/1dce2fdb6df5638bae4ecc7c18de74bd.certbot.webp)
# 1. 安装Certbot

```bash
sudo apt install certbot -y

certbot --version
certbot 2.9.0
```



# 2. 域名验证

泛域名的验证采用DNS01的验证方式，通过在域名DNS记录中添加特定TXT记录（如_acme-challenge）完成验证。

```bash
certbot certonly --manual --preferred-challenges dns \
-d "*.zenseek.site" -d "zenseek.site" --email brain_07@163.com --agree-tos

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.zenseek.site and zenseek.site

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.zenseek.site.

with the following value:

Za59txFdRj3s0I3v_fFxCy7jRN1erVai9j3285XXXXX

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
```

从其他的Linux Terminal来验证DNS的TXT解析是否成功。能看见解析出来的字符串和Certbot给的一样就算是成功了。

```bash
dig TXT _acme-challenge.zenseek.site +short
"Za59txFdRj3s0I3v_fFxCy7jRN1erVai9j3285XXXXX"
```

这时我们按回车键，会继续验证一遍。提示特意强调不要删除之前的challenge。同一个名的记录可以对应两个TXT值。


```bash
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.zenseek.site.

with the following value:

71QWlJFQnx-KseIECTqhPCbisU2b2wbq9rWre3XXXXX

(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.zenseek.site.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
```

我们在`dig`一遍，有时候发现会有两个值。


```bash
dig TXT _acme-challenge.zenseek.site +short
"71QWlJFQnx-KseIECTqhPCbisU2b2wbq9rWre3XXXXX"
"Za59txFdRj3s0I3v_fFxCy7jRN1erVai9j3285XXXXX"
```

# 3. 取得域名

这时我们再次按下回车键，就会提示你的证书生成成功了。


```bash
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/zenseek.site/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/zenseek.site/privkey.pem
This certificate expires on 2025-10-03.
These files will be updated when the certificate renews.

NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
```
再之后，就可以把证书挂到Nginx下了。