76 lines
3.4 KiB
Markdown
76 lines
3.4 KiB
Markdown
# Vaultwarden
|
|
|
|
Password manager for both of us. Runs on the OptiPlex homeserver
|
|
(`192.168.30.20`) in `~/vaultwarden`, reachable only as
|
|
`https://vault.home.staffenberger.at` — at home or through the WireGuard VPN.
|
|
Clients are the official Bitwarden apps and browser extensions, set to the
|
|
self-hosted server URL.
|
|
|
|
## Network
|
|
|
|
The container publishes **no ports**. NPM reaches it on a shared Docker network
|
|
called `proxy`, so the only way in is HTTPS through NPM. Bitwarden clients
|
|
refuse plain HTTP anyway, and this stops anyone on the LAN from going around TLS.
|
|
|
|
One-time setup on the OptiPlex, before the first `docker compose up -d`:
|
|
|
|
```bash
|
|
docker network create proxy
|
|
```
|
|
|
|
Then recreate NPM so it joins the network (`cd ~/npm && docker compose up -d`).
|
|
|
|
## Setup
|
|
|
|
1. **Pi-hole Local DNS record:** `vault.home.staffenberger.at` → `192.168.30.20`,
|
|
on whichever Pi-hole the clients use right now.
|
|
2. **NPM proxy host:** `vault.home.staffenberger.at`, scheme `http`, forward
|
|
to `vaultwarden` port `80`, **Websockets Support on** (live sync between
|
|
devices), wildcard certificate, Force SSL, HTTP/2.
|
|
The forward host must be the **container name**, not `192.168.30.20`: the
|
|
host's port 80 is NPM itself, which caused a redirect loop
|
|
(`ERR_TOO_MANY_REDIRECTS`).
|
|
3. Open the URL and create **both accounts**. Each person picks their own
|
|
master password; it can't be reset, only changed while logged in.
|
|
4. Set `SIGNUPS_ALLOWED: "false"` and run `docker compose up -d`. Check that
|
|
"Create account" fails.
|
|
5. Turn on **two-step login (authenticator app)** for both accounts, and keep
|
|
the recovery codes outside the vault.
|
|
6. Create an **Organization** (e.g. "Home") with collections for shared logins,
|
|
invite the partner's account, then confirm them as owner.
|
|
No SMTP is configured, so no invite mail is sent: the partner accepts
|
|
in the web vault, then you confirm. Untested here, check while setting it up.
|
|
7. **Import** the old vaults (Tools → Import data; Bitwarden reads Enpass
|
|
JSON). Delete the plain-text export files afterwards and empty the trash.
|
|
|
|
## Backups
|
|
|
|
**Don't move real passwords in before this works.** Devices that are logged in
|
|
keep an encrypted offline copy, but that doesn't replace a backup.
|
|
|
|
- Contents of `./data` to keep: `db.sqlite3`, `attachments/`, `sends/`,
|
|
`rsa_key*` and `config.json` (if present).
|
|
- Copy the database with `sqlite3 db.sqlite3 ".backup ..."`, not `cp`,
|
|
since the file may be mid-write.
|
|
- Encrypted copy to the NAS, part of the OptiPlex off-box backup
|
|
(see [../../docs/todo.md](../../docs/todo.md)).
|
|
- Occasionally: an **encrypted** export from the web vault, kept offline.
|
|
- **Test a restore** once, onto a throwaway container.
|
|
|
|
## Using it away from home
|
|
|
|
The apps can fill passwords offline, but **saving or editing needs the
|
|
server**. Set the WireGuard app on both phones to connect automatically when
|
|
not on the home Wi-Fi, otherwise passwords for new sign-ups get lost.
|
|
The VPN is split-tunnel (Servers + IoT only), so normal browsing doesn't go
|
|
through it.
|
|
|
|
## Notes
|
|
|
|
- `/admin` is disabled (no `ADMIN_TOKEN`). If it is ever needed, set a
|
|
hashed token generated with `docker exec -it vaultwarden /vaultwarden hash`,
|
|
never a plain-text one.
|
|
- The image is pinned; check the release notes before bumping.
|
|
- Write down for the partner how to get at their passwords if the server
|
|
or I am unavailable: their master password, where the backups are, and how
|
|
to restore them.
|