compatibility with Bitwarden offline setup

[tfboy]

compatibility with Bitwarden offline setup

[jjmmfi]

Push notifications to Mobile app require online access to push.bitwarden.com You might want SMTP as well.

[tfboy]

Push notifications to Mobile app require online access to push.bitwarden.com You might want SMTP as well.

Sorry, to clarify, this is an offline in the sense that it's firewalled from the Internet. But SMTP is available and working (internally). Good point about push notifications, but this isn't required in this case. Could be disabled.

[vijaymodha]

This seems to break because the url used in build.sh to determine $BW_VERSION no longer works:

$ curl -vvv https://go.btwrdn.co/bw-sh-versions
* processing: https://go.btwrdn.co/bw-sh-versions
* Could not resolve host: go.btwrdn.co
* Closing connection
curl: (6) Could not resolve host: go.btwrdn.co

To workaround: hardcode the value to the Bitwarden installed version. For my install, it's "2023.10.2".

Here's a patch for build.sh for Bitwarden v2023.10.2:

# git diff
diff --git a/build.sh b/build.sh
index 4371c0c..7349e3e 100755
--- a/build.sh
+++ b/build.sh
@@ -3,6 +3,7 @@
 DIR=`dirname "$0"`
 DIR=`exec 2>/dev/null;(cd -- "$DIR") && cd -- "$DIR"|| cd "$DIR"; unset PWD; /usr/bin/pwd || /bin/pwd || pwd`
 BW_VERSION=$(curl -sL https://go.btwrdn.co/bw-sh-versions | grep '^ *"'coreVersion'":' | awk -F\: '{ print $2 }' | sed -e 's/,$//' -e 's/^"//' -e 's/"$//')
+BW_VERSION="2023.10.2"
 echo "Building BitBetter for BitWarden version $BW_VERSION"

[tfboy]

Actually, I wonder if this could make installations simpler.
Initially, I had a normal self-hosted installation but I then wanted to sandbox it and remove internet connectivity. But my containers were always unhealthy. I reached out fo their support team and they said it won't work and I need to do the proper offline install.

However, part of the offline install requires you creating your identity server for signing the certificates (something you don't do with a normal install as I believe it checks against the online servers which is why there's the modified bitbetter containers impersonating the identity servers).

As you have your own local identity servers, can you not use these instead of the modified bitbetter ones to sign the licence? If this worked, then it would remove the need for these modified servers and simplify the process.

I'm playing around seeing if I can get it to work.

[tfboy]

Just to add, I've had a look and cannot get it working with the off-line install. I did put a post up in the Discussions section.

If we could get the "offline" version to work, I think it could be a lot simpler and wouldn't require changing / using any modified containers, just using the identity.pfx certificate generated on install.