alvis
0f9d83f3db
vaultwarden.js run() passed BW_PASSWORD as argv to `bw login`/`bw unlock`.
On any non-zero exit, execFileSync throws an Error whose message is
"Command failed: bw unlock <BW_PASSWORD> --raw", which propagated to
server.js's `console.error('Init failed:', e.message)` -> the master password
landed in container stdout / `docker logs` on every Vaultwarden init failure
(wrong password, server down, TLS reset). Empirically confirmed by a security
audit 2026-07-24.
run() now catches the exec error and re-throws with the argv stripped: only the
subcommand, exit code, and stderr survive, and BW_PASSWORD is scrubbed from
stderr defensively. Verified: a forced failure yields "bw unlock failed (exit 1)"
with no password substring.
Not yet active: the running agap-mcp container predates this file; a rebuild
(`docker compose build agap-mcp && docker compose up -d agap-mcp`) is needed to
deploy it. The live container is still vulnerable until then.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agap Home Server
Docker Compose configurations for the Agap self-hosted home server infrastructure.
Services
- Immich (
immich-app/) — Photo management and backup (port 2283) - Gitea (
gitea/) — Self-hosted Git server with web UI (port 3000, SSH 222) - Open WebUI (
openai/) — AI chat interface with Ollama, GPU-accelerated (port 3125)
Quick Start
Start Immich (main service)
docker compose up -d
Start Gitea (from gitea/ directory)
cd gitea
docker compose up -d
Start Open WebUI (from openai/ directory)
cd openai
docker compose up -d
Configuration
Environment variables are in the root .env file for Immich:
UPLOAD_LOCATION— where photo originals are storedTHUMB_LOCATION— thumbnail cache directoryENCODED_VIDEO_LOCATION— transcoded video cacheDB_DATA_LOCATION— Postgres database directoryDB_PASSWORD— Postgres password
Storage
Media is stored on:
/mnt/media/upload— Immich originals/mnt/ssd1/media/— Immich thumbnails, encoded video, and Postgres database/mnt/misc/gitea— Gitea repositories and data
GPU Support
For GPU acceleration (Open WebUI/Ollama, Immich ML):
- Install NVIDIA Docker runtime:
sudo ./nvidia-docker-install.sh - Install CUDA toolkit:
./install-cuda.sh
Documentation
See CLAUDE.md for detailed developer instructions and Gitea wiki integration guidelines.
See the Gitea wiki for infrastructure documentation (storage, network, services setup).