lhahnandClaude Opus 5.5
2c8d9f7907
docker compose based vaultwarden, bound to 127.0.0.1, sign ups off, admin panel only with an argon2 token, SMTP via mailcow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
730 B
Markdown
12 lines
730 B
Markdown
# cloud-vaultwarden
|
|
|
|
Ansible role to setup vaultwarden (Bitwarden compatible password manager) via docker compose.
|
|
|
|
- listens on `127.0.0.1:<vaultwarden_http_port>` only; expose it with the nginx role (TLS)
|
|
- sign ups are disabled by default; invite family members from an organization instead
|
|
- the admin panel is disabled unless `vaultwarden_admin_token` (argon2 PHC string) is set;
|
|
block `/admin` in the public nginx site and reach it through an SSH tunnel
|
|
- do NOT put a forward-auth (e.g. authentik) in front of it, the Bitwarden clients talk to the API directly
|
|
- data lives in `vaultwarden_data_location`; back up `db.sqlite3` with `sqlite3 .backup`, plus
|
|
`attachments`, `sends`, `config.json` and the `rsa_key*` files
|