# cloud-vaultwarden

Ansible role to setup vaultwarden (Bitwarden compatible password manager) via docker compose.

- listens on `127.0.0.1:<vaultwarden_http_port>` only; expose it with the nginx role (TLS)
- sign ups are disabled by default; invite family members from an organization instead
- the admin panel is disabled unless `vaultwarden_admin_token` (argon2 PHC string) is set;
  block `/admin` in the public nginx site and reach it through an SSH tunnel
- do NOT put a forward-auth (e.g. authentik) in front of it, the Bitwarden clients talk to the API directly
- data lives in `vaultwarden_data_location`; back up `db.sqlite3` with `sqlite3 .backup`, plus
  `attachments`, `sends`, `config.json` and the `rsa_key*` files