Skip to content

vaultwarden — self-hosted Bitwarden server (password manager for Angel)

vaultwarden/server:latest (1.37.2 on 2026-09-10), service vaultwarden at the END of the torrentvpn compose file. Data ~/torrentvpn/vaultwarden/data/ (SQLite db.sqlite3, attachments, vaultwarden.log) — covered by docker-backup.sh nightly like every other stack dir.

Why this shape

Free, open-source, one container, every Bitwarden client (iOS/Mac/Windows/Linux/CLI) works against it. Chosen over Bitwarden cloud so the vault stays on the box; over KeePassXC because four devices would need manual file sync.

Shape

  • No host ports. Only NPM reaches it (http://vaultwarden:80 on the compose default network). TLS is NPM's job.
  • Name: vault.embeddedera.com — Cloudflare A record → 192.168.5.15 (DNS-only, private IP), Let's Encrypt cert via DNS-01 in NPM (cert id 1, expires 2026-12-09, auto-renews; the Cloudflare token — scoped Zone.DNS.Edit on embeddedera.com only — lives in NPM's db). Reachable on the LAN or over WireGuard only; nothing is exposed to the internet.
  • DOMAIN=https://vault.embeddedera.com, SIGNUPS_ALLOWED=false since 2026-09-10 (first account angelgdo7@gmail.com); invite others from /admin. ADMIN_TOKEN (plain, not argon2 — no argon2 CLI on the box) in ~/.config/credentials/vaultwarden.txt (0600). Admin panel /admin.
  • Health: docker exec npm curl -s http://vaultwarden/alive → 200.
  • Permissions (2026-10-26): vaultwarden/data/ is 700 angel:angel, and ~/torrentvpn/nginx-proxy-manager/ is too (NPM's db, keys.json and certs sit under it). The files inside are still 644 root, but other uids can no longer reach them. Proof: a container running as uid 65534 got denied on all of them.
  • Both containers run as root, so they are unaffected.
  • erp-backup reads db.sqlite3 as angel (sqlite3 .backup), so the files must not go 600 root.
  • filebrowser runs as 1000 and mounts all of ~, so its login can still reach these files.
  • Undo: ~/maintenance/audit-2026-10-26/perms-undo.txt.

Server key push (2026-10-26)

  • Account server@embeddedera.com (invited via /admin, member User / Can edit of org Plex Server, which Angel owns; it cannot see Angel's vault or the Embeddedera org). Its API key + password: ~/.config/vaultwarden-server/env (0600); bw CLI state ~/.config/vaultwarden-server/bw-data/.
  • ~/.local/bin/vault-push (nightly 02:47, vault-push.timer) writes one Secure Note per key file. 61 files on day one. Run by hand after adding a key; --dry-run lists changes.
  • Lose the server account: create a new one the same way; Angel still has every note through the org.

Connected to

  • owned-by: torrentvpn-stack
  • joins: npm (proxy host + cert), pihole (LAN DNS via upstream; *.lan wildcard not used here), wg-easy (remote access path)

If you change this

  • Hits: NPM proxy host + cert renewal (DNS-01 token must stay valid) · docker-backup.sh snapshot size (tiny) · the Cloudflare vault A record if the LAN IP changes.
  • Restart: docker compose up -d vaultwarden (named — never bare).
  • Restore: stop container, copy vaultwarden/data/ back from /mnt/storage/docker-backups/snapshots/<date>/vaultwarden/, start. Master password is never on the box; a lost master password = lost vault.