Projects/Vaultwarden Self-Hosted Password Vault Deployment
Tools

Vaultwarden Self-Hosted Password Vault Deployment

Deploy Vaultwarden on a NAS using Docker, and provide an HTTPS password vault via Cloudflare, frpc, and NPM.

中文版 ↗← Back

Vaultwarden is a lightweight password vault service compatible with Bitwarden clients. In this project, vaultwarden/server:latest (1.37.4) is deployed with Docker on a NAS (.164), mapping host port 8091 to container port 80, storing data in /opt/web/vaultwarden-data, and integrating with sync.sh for daily backups. Externally, it provides access at https://vault.xiejun-server.top through a Cloudflare DNS-only A record, frpc web-https/web-http proxies, and an NPM reverse proxy, reusing a Let's Encrypt multi-domain certificate, supporting WebSocket, and with an upload size limit of 525M. This allows duplicate/weak passwords for NPM, Gitea, Memos, PhotoPrism, Open WebUI, the blog admin, the Windows host, and the router to be centralized and changed to random strong passwords, with TOTP gradually enabled. The site and API have currently been verified as working properly, the first account has been registered, SIGNUPS_ALLOWED has been disabled, and only invitation-based registration remains enabled; changing the master password and migrating service passwords are still to-do.

Features

  • 自建 Bitwarden 兼容密码库，Web Vault 与 API 已验证正常
  • Docker 部署，数据目录持久化并纳入每日备份
  • Cloudflare、frpc、NPM 全链路 HTTPS 访问
  • NPM 反代支持 WebSocket，上传体积上限 525M
  • 管理面板通过 ADMIN_TOKEN 登录
  • 注册关闭后保留邀请注册能力

Stack: Vaultwarden · Docker · Cloudflare · frpc · Nginx Proxy Manager · Let's Encrypt · SQLite

Deployment and Usage Steps

  1. DNS: In Cloudflare, add an A record for vault pointing to 38.76.200.139, and keep it DNS only (grey cloud).
  2. Container: On NAS .164, prepare the data directory /opt/web/vaultwarden-data, use the image vaultwarden/server:latest, and map port 8091:80. Set the environment variables DOMAIN=https://vault.xiejun-server.top, SIGNUPS_ALLOWED=true (for initial registration), INVITATIONS_ALLOWED=true, and TZ=Asia/Shanghai, and put ADMIN_TOKEN in /root/.vaultwarden-admin-token (permissions 600). For the specific startup command, follow the existing Docker configuration.
  3. Reverse proxy: Create a new proxy in NPM. Port 80 uses ACME, and port 443 reverse-proxies to 127.0.0.1:8091. Enable WebSocket and set client_max_body_size 525M; the configuration file is located at /opt/web/npm-data/nginx/proxy_host/23-vault.conf.
  4. Intranet penetration: In frpc.toml on .164, add vault.xiejun-server.top to web-https / web-http.
  5. Certificate: Reuse the Let's Encrypt multi-domain certificate for xiejun-server.top, and configure renew_hook to execute docker exec npm nginx -s reload.
  6. Verification and initialization: Accessing https://vault.xiejun-server.top/ should return 200; check the domain in /api/config; after registering the first account, change SIGNUPS_ALLOWED to false and restart the container. Access the admin panel at /admin and log in with ADMIN_TOKEN.
  7. Usage: Change existing service passwords one by one to random strong passwords and store them in Vaultwarden; enable TOTP for important services; confirm weekly that backups include vaultwarden-data.