"SIGNUPS_ALLOWED: false" is not working on raspberry pi #2917

New Issue

MrUnknownDE · 2026-04-06T04:18:27+02:00

MrUnknownDE commented

2026-04-06 04:18:27 +02:00

Originally created by @FastHogi on 6/9/2020

First of all, thank you for this great project. Bitwarden_rs is running perfectly on my Pi2. Keep up your great work. This is my first post here, so please be patient.

Subject of the issue

I wanted to harden my bitwarden_rs on my pi and I followed your Harding Guide. By the way, thanks for the perfect wiki documention of all security aspects. I set "signups_allowed" to false in the admin panel and also with the alternative way with the env variable. But both ways do not hide the "Create Account" button in the web vault.

I already have 2 users created successfully. I mention this, because I read in the doc somewhere, that with no users created at first, the button is always visible to be able to create at least 1 user. I want to use bitwarden only for my family and don't need any additional user accounts.

I also installed and setup fail2ban, which I tested successfully. I'm receiving email notifications with customized mail bodys and the banned IP's details from the bitwarden log. So it seems to be (relativly) safe right now.

Your environment

Bitwarden_rs version: 1.15.0-52ed8e4d
Bitwarden web vault version: 2.14.0
Install method: Docker image for the raspberry
Browsers used: Firefox and Edge
Reverse proxy and version: none
Version of mysql/postgresql: none
Other relevant information: latest and up-to-date 32-bit raspbian with kernel 5.4.44

Steps to reproduce

My config.json in /data looks like this:

[...]
"domain": "{removed-mydomain-here}",
"disable_icon_download": false,
"signups_allowed": false,
"signups_verify": true,
"signups_verify_resend_time": 3600,
"signups_verify_resend_limit": 6,
"invitations_allowed": false
[...]

I start the docker container like this:

docker run -d --name bitwarden
-e ROCKET_TLS='{certs="/ssl/live/{removed-mydomain-here}/fullchain.pem",key="/ssl/live/{removed-mydomain-here}/privkey.pem"}'
-e LOG_FILE=/data/bitwarden.log
-e TZ="Europe/Berlin"
*-e SIGNUPS_ALLOWED=false
-e INVITATIONS_ALLOWED=false *
-v /etc/letsencrypt/:/ssl/
-v /bw-data/:/data/
-p 4001:80 bitwardenrs/server:raspberry

Expected behaviour

In my expectation the "Create Account" button should not be visible when you set SIGNUPS_ALLOWED to false:

Relevant logs

"docker logs bitwarden" shows the following:

[WARNING] The following environment variables are being overriden by the config file,
[WARNING] please use the admin panel to make changes to them:
[WARNING] SIGNUPS_ALLOWED, INVITATIONS_ALLOWED

But this is clear, because as I said I tried both ways at the same time and so the env variable setting will be overwritten with the setting in the config.json file (with the same "false" value). So, the env variable is recognized correctly, but has no effect. If I only use the config.json setting without the env variable, that warning is of course gone.

*Originally created by @FastHogi on 6/9/2020*  First of all, thank you for this great project. Bitwarden_rs is running perfectly on my Pi2. Keep up your great work. This is my first post here, so please be patient. ### Subject of the issue I wanted to harden my bitwarden_rs on my pi and I followed your [Harding Guide](https://github.com/dani-garcia/bitwarden_rs/wiki/Hardening-Guide). By the way, thanks for the perfect wiki documention of all security aspects. I set "signups_allowed" to false in the admin panel and also with the alternative way with the env variable. But both ways do not hide the "Create Account" button in the web vault. I already have 2 users created successfully. I mention this, because I read in the doc somewhere, that with no users created at first, the button is always visible to be able to create at least 1 user. I want to use bitwarden only for my family and don't need any additional user accounts. I also installed and setup fail2ban, which I tested successfully. I'm receiving email notifications with customized mail bodys and the banned IP's details from the bitwarden log. So it seems to be (relativly) safe right now. ### Your environment  * Bitwarden_rs version: 1.15.0-52ed8e4d * Bitwarden web vault version: 2.14.0 * Install method: Docker image for the raspberry * Browsers used: Firefox and Edge * Reverse proxy and version: none * Version of mysql/postgresql: none * Other relevant information: latest and up-to-date 32-bit raspbian with kernel 5.4.44 ### Steps to reproduce  My config.json in /data looks like this: [...] "domain": "{removed-mydomain-here}", "disable_icon_download": false, **"signups_allowed": false,** "signups_verify": true, "signups_verify_resend_time": 3600, "signups_verify_resend_limit": 6, **"invitations_allowed": false** [...] I start the docker container like this: docker run -d --name bitwarden \ -e ROCKET_TLS='{certs="/ssl/live/{removed-mydomain-here}/fullchain.pem",key="/ssl/live/{removed-mydomain-here}/privkey.pem"}' \ -e LOG_FILE=/data/bitwarden.log \ -e TZ="Europe/Berlin" \ **-e SIGNUPS_ALLOWED=false \ -e INVITATIONS_ALLOWED=false \** -v /etc/letsencrypt/:/ssl/ \ -v /bw-data/:/data/ \ -p 4001:80 bitwardenrs/server:raspberry ### Expected behaviour  In my expectation the "Create Account" button should not be visible when you set SIGNUPS_ALLOWED to false: ![grafik](https://user-images.githubusercontent.com/41678833/84184803-49e45480-aa8e-11ea-9bdf-b4beb7c4c038.png) ### Relevant logs  "docker logs bitwarden" shows the following: [WARNING] The following environment variables are being overriden by the config file, [WARNING] please use the admin panel to make changes to them: [WARNING] SIGNUPS_ALLOWED, INVITATIONS_ALLOWED But this is clear, because as I said I tried both ways at the same time and so the env variable setting will be overwritten with the setting in the config.json file (with the same "false" value). So, the env variable is recognized correctly, but has no effect. If I only use the config.json setting without the env variable, that warning is of course gone.

MrUnknownDE closed this issue

2026-04-06 04:18:27 +02:00

MrUnknownDE referenced this issue

2026-04-06 05:27:37 +02:00

[META] Feature Requests #3692

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#2917