Can't get websockets working

[nathan-alden-sr]

I have read virtually every guide including the wiki in this repo, but I simply cannot get websockets working.

I am running Vaultwarden and Caddy in Docker on a Raspberry Pi 4 on my home network, accessible internally and from the internet. Everything works fine, including HTTPS connections and requests/responses; however, all wss:// URLs fail:

Firefox can’t establish a connection to the server at wss://vaultwarden.example.com/notifications/hub?access_token=...

Here is my docker-compose.yml:

version: "3"

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      WEBSOCKET_ENABLED: true
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data
    environment:
      - DOMAIN=vaultwarden.example.com
      - [email protected]
      - LOG_FILE=/data/access.log

Here is my Caddyfile:

{$DOMAIN}:443 {
  log {
    level INFO
    output file {$LOG_FILE} {
      roll_size 10MB
      roll_keep 10
    }
  }

  # Use the ACME HTTP-01 challenge to get a cert for the configured domain.
  tls {$EMAIL}

  # This setting may have compatibility issues with some browsers
  # (e.g., attachment downloading on Firefox). Try disabling this
  # if you encounter issues.
  encode gzip

  # The file size is set to 500MB to support the Vaultwarden (Bitwarden) Send feature.
  request_body {
    max_size 500MB
  }

  header {
    # Enable cross-site filter (XSS) and tell browser to block detected attacks
    X-XSS-Protection "1; mode=block"
    # Disallow the site to be rendered within a frame (clickjacking protection)
    X-Frame-Options "DENY"
    # Prevent search engines from indexing (optional)
    X-Robots-Tag "none"
    # Server name removing
    -Server
  }

  # The negotiation endpoint is also proxied to Rocket
  reverse_proxy /notifications/hub/negotiate vaultwarden:80

  # Notifications redirected to the WebSocket server
  reverse_proxy /notifications/hub vaultwarden:3012

  # Proxy everything else to Rocket
  reverse_proxy vaultwarden:80 {
    # Send the true remote IP to Rocket, so that vaultwarden can put this in the
    # log, so that fail2ban can ban the correct IP.
    header_up X-Real-IP {remote_host}
  }
}

Here's the line from the log I see when I run sudo docker compose up:

vaultwarden | [2022-09-19 01:07:48.658][vaultwarden::api::notifications][INFO] Starting WebSockets server on 0.0.0.0:3012

so I know the websockets server is running.

I am able to interact with Vaultwarden as long as I use the browser; extensions and apps all have trouble even logging in extensions and apps seem to be working now after I fixed the missing Server URL setting (it defaulted to http://localhost).

I thought that maybe wss:// URLs use a different port than 443, which is the only port I am allowing through my AT&T gateway; however, upon researching it it seems that port 443 is used for wss://, as well.

I am not sure how else I can diagnose this issue. Help!

Support string:

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.25.2
• Web-vault version: v2022.6.2
• Running within Docker: true (Base: Debian)
• Environment settings overridden: false
• Uses a reverse proxy: true
• IP Header check: true (X-Real-IP)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Database type: SQLite
• Database version: 3.35.4
• Clients used:
• Reverse proxy and version:
• Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": false,
  "_enable_yubico": false,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://***********.****.***********.***",
  "domain_origin": "*****://***********.****.***********.***",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 5 * * * *",
  "emergency_request_timeout_schedule": "0 5 * * * *",
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "password_hints_allowed": false,
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sends_allowed": false,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": null,
  "smtp_from": "",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": true,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

[Masgalor]

Hi @nathan-alden-sr .
I am not familiar with some of the components you use, but I may give some general advice.

I was about to write how you should use several different clients to test your websockets when I noticed this line.

I am able to interact with Vaultwarden as long as I use the browser; extensions and apps all have trouble even logging in.

As far as I know no client needs websockets to log you in, it is just about live-sync that may be available or not depending if your server offers websockets. So this indicates a different problem with your setup.

Could you discribe why you are not able to access your vault with other clients than the webvault?
You may also add your support-string, it might be helpfull.

[nathan-alden-sr]

I updated the post with the support string.

[nathan-alden-sr]

Also, I discovered that I was missing the Server URL setting, which was defaulting to http://localhost. After fixing that it seems I can log in from everywhere now. Websockets are still not working, however.

[nathan-alden-sr]

I keep experiencing intermittent connection issues. I am hosting Vaultwarden on my home network with an Arris BGW210 modem acting as the firewall. I suspect the firewall may not be handling stateful sessions properly, but unfortunately the firmware is crap and I have very little control over this. If anyone has attempted to do this and run into firewall issues, I'd love to hear your experiences.

[BlackDex]

I just tested Caddy my self, and it seems to work just fine for me.
My config is almost identical to yours, so that shouldn't be the issue here.

Anything in between could cause any issue of course.
You could try to use Wireshark to inspect the traffic or maybe F12 Developer console is giving some more info also.

[nathan-alden-sr]

Wireshark is a good idea.