signups_allowed was drifted to true on prod and is now false in both
docker-compose.yml and data/config.json. config.json overrides the env var,
so setting the compose value alone has no effect.
The bouncer moved from @file to @docker because its API key is now a compose
label sourced from .env, keeping config.yml secret-free.
The vaultwarden-http router is removed as redundant: traefik.yml already
redirects the http entrypoint to https globally (verified: http returns 301).
- Added BACKUP.md with comprehensive backup/restore documentation
- Created backup-vaultwarden.sh for automated PostgreSQL and data backups
- Created restore-vaultwarden.sh for safe backup restoration
- Fixed HTTP response validation by configuring Vaultwarden-specific headers
- Set X-XSS-Protection: 0 (as required by Vaultwarden)
- Set X-Frame-Options: SAMEORIGIN for API calls
- Removed conflicting secure-headers@file middleware
- Added custom vaultwarden-headers middleware
- Updated .gitignore to exclude backups/ directory
Backup system:
- Backs up to /srv/backups/vaultwarden/ (configurable)
- Logs to /var/log/vaultwarden/backup.log
- 30-day retention policy
- Includes PostgreSQL database, RSA key, config, and .env
Note: Backup scripts should be moved to /srv/backups/scripts/ for production use
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Removed get_gmail_refresh_token.py (no longer needed)
- Removed emailproxy-config/ directory (already deleted)
- Added Claude Code settings for easier development
- Switched to Amazon SES for email delivery (configured in .env)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
