selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 15: offboarding waits out the Vaultwarden admin rate limit, fail2ban exception only on the provider host

Browse source 
Measured clean run: Pocket ID disable alone left 12 of 14 ways open, the
script (0.9 s, 9 of 9 steps) left 1 of 14.
This commit is contained in:
Maximilian Grimm 2026-09-23 12:08:08 +02:00
parent 12542ecb19
commit 54ab43dac7
3 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
offboarding/README.md
View file

@ -7,7 +7,7 @@ Measured on the demo box, with a test employee who had the access a real one has
| --- | --- |
| Forgejo login prohibited (Forgejo was the SSO provider) | **10 of 13**, unchanged for 45 minutes |
| Pocket ID account disabled, nothing else | **12 of 14** |
| `./offboard.py <user>` (about one second) | **1 of 14**: the vault copy on their laptop |
| `./offboard.py <user>` (0.9 s, all 9 steps ok) | **1 of 14**: the vault copy on their laptop |
What stayed open with only the SSO switched off: the wiki session (valid for
three months) and its API key, the vault sync (Forgejo kept handing out fresh
@ -65,7 +65,8 @@ give every key an expiry, and renew them on purpose.
without a JSON content type is not a 403, it is a 404, and it looks exactly
like "user not found".
- **Vaultwarden rate-limits the admin login** (a handful per five minutes). Two
test runs back to back and the third one gets 429. The script says so.
test runs back to back and the third one gets 429. The script now waits 60 s
and retries, up to six times, and prints each wait.
- **An old n8n API key cannot delete users.** Keys created before scopes
existed, or with the wrong ones, get 403. Create one with `user:delete`.
- **Forgejo tokens:** an admin can list a user's tokens (`Sudo:` header) but