selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 15: offboarding waits out the Vaultwarden admin rate limit, fail2ban exception only on the provider host

Browse source 
Measured clean run: Pocket ID disable alone left 12 of 14 ways open, the
script (0.9 s, 9 of 9 steps) left 1 of 14.
This commit is contained in:
Maximilian Grimm 2026-09-23 12:08:08 +02:00
parent 12542ecb19
commit 54ab43dac7
3 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
offboarding/offboard.py
View file

@ -125,9 +125,15 @@ def outline(email):
def vaultwarden(email):
jar = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()))
base = f"http://{ip('vaultwarden')}"
s, _ = call("POST", f"{base}/admin", {"token": CFG["VAULTWARDEN_ADMIN_TOKEN"]}, form=True, opener=jar)
if s != 200: # 429: the admin login allows only a few tries per 5 minutes
return step("vaultwarden", f"admin login refused (HTTP {s}), run again in 5 minutes", False)
# The admin login is rate-limited (a few tries per 5 minutes). On 429 wait and retry.
for attempt in range(6):
s, _ = call("POST", f"{base}/admin", {"token": CFG["VAULTWARDEN_ADMIN_TOKEN"]}, form=True, opener=jar)
if s != 429:
break
step("vaultwarden", f"admin login rate-limited (429), waiting 60 s, try {attempt + 2} of 6", True)
time.sleep(60)
if s != 200:
return step("vaultwarden", f"admin login refused (HTTP {s})", False)
s, users = call("GET", f"{base}/admin/users", opener=jar)
hits = [u for u in (users if s == 200 else []) if u["email"] == email]
if not hits: