Skip to content

vaultwarden — self-hosted Bitwarden server (password manager for Angel)

vaultwarden/server:latest (1.37.2 on 2026-09-10), service vaultwarden at the END of the torrentvpn compose file. Data ~/torrentvpn/vaultwarden/data/ (SQLite db.sqlite3, attachments, vaultwarden.log) — covered by docker-backup.sh nightly like every other stack dir.

Why this shape

Free, open-source, one container, every Bitwarden client (iOS/Mac/Windows/Linux/CLI) works against it. Chosen over Bitwarden cloud so the vault stays on the box; over KeePassXC because four devices would need manual file sync.

Shape

  • No host ports. Only NPM reaches it (http://vaultwarden:80 on the compose default network). TLS is NPM's job.
  • Name: vault.embeddedera.com — Cloudflare A record → 192.168.5.15 (DNS-only, private IP), Let's Encrypt cert via DNS-01 in NPM (cert id 1, expires 2026-12-09, auto-renews; the Cloudflare token — scoped Zone.DNS.Edit on embeddedera.com only — lives in NPM's db). Reachable on the LAN or over WireGuard only; nothing is exposed to the internet.
  • DOMAIN=https://vault.embeddedera.com, SIGNUPS_ALLOWED=false since 2026-09-10 (first account angelgdo7@gmail.com); invite others from /admin. ADMIN_TOKEN (plain, not argon2 — no argon2 CLI on the box) in ~/.config/credentials/vaultwarden.txt (0600). Admin panel /admin.
  • Health: docker exec npm curl -s http://vaultwarden/alive → 200.

Connected to

  • owned-by: torrentvpn-stack
  • joins: npm (proxy host + cert), pihole (LAN DNS via upstream; *.lan wildcard not used here), wg-easy (remote access path)

If you change this

  • Hits: NPM proxy host + cert renewal (DNS-01 token must stay valid) · docker-backup.sh snapshot size (tiny) · the Cloudflare vault A record if the LAN IP changes.
  • Restart: docker compose up -d vaultwarden (named — never bare).
  • Restore: stop container, copy vaultwarden/data/ back from /mnt/storage/docker-backups/snapshots/<date>/vaultwarden/, start. Master password is never on the box; a lost master password = lost vault.