Quartz 4

04 - Vaultwarden Password & Secret Vault

4 min read

Vaultwarden Password & Secret Vault

Overview

Vaultwarden is a self-hosted, lightweight implementation of the Bitwarden API written in Rust. It serves as our secure vault for personal passwords, financial credentials, passkeys, 2FA authenticator seeds, and infrastructure secrets at https://vault.ganeshr.me.

1. Why Vaultwarden Instead of Official Bitwarden?

The official Bitwarden backend is built with enterprise .NET and Microsoft SQL Server, requiring at least 2 GB to 4 GB of RAM.

Our Oracle Cloud Free Tier Micro VM has only 1 GB of total physical RAM:

  • Vaultwarden uses ~35 MB of RAM (less than 1/50th of official Bitwarden).
  • It uses a fast, reliable SQLite database stored in ./vw-data/db.sqlite3.
  • It is 100% compatible with all official Bitwarden client apps (iOS, Android, Chrome, Firefox, Safari, CLI).

2. Zero-Knowledge Cryptographic Architecture

flowchart TD
    subgraph ClientDevice ["Your Device (Browser Extension / Mobile App)"]
        Plaintext["Your Secret Passwords (Plaintext)"]
        MasterKey["Master Password + Argon2id"]
        EncryptedBlob["Encrypted Ciphertext (AES-256-CBC)"]
        
        Plaintext -->|Encrypted on Device| EncryptedBlob
        MasterKey -->|Generates Local Key| EncryptedBlob
    end

    subgraph VaultServer ["Vaultwarden Server (Oracle Cloud VM)"]
        DB["vw-data/db.sqlite3 (Encrypted Storage)"]
    end

    EncryptedBlob -->|Transfers ONLY Encrypted Blobs| DB
    DB -->|Master Password NEVER Sent to Server| EncryptedBlob

Zero-Knowledge Guarantee

Your master password is never transmitted across the network, and the server never sees your unencrypted passwords. Decryption happens purely inside the memory of your phone or browser.

3. Container Configuration (docker-compose.yml)

vaultwarden:
  image: vaultwarden/server:latest
  container_name: vaultwarden
  restart: always
  environment:
    - DOMAIN=https://vault.ganeshr.me
    - SIGNUPS_ALLOWED=true
    - WEBSOCKET_ENABLED=true
    - ADMIN_TOKEN=$$argon2id$$v=19$$m=65536,t=3,p=4$$bXlzYWx0MTIzNDU2Nzg5MA$$UT2bdRqGlgMSffoXC/42ZQYnD2Ixt/0GkdjiAkEPpGk
    - IP_HEADER=X-Real-IP
  volumes:
    - ./vw-data:/data
  networks:
    - internal

Key Parameters:

  • WEBSOCKET_ENABLED=true: Enables real-time sync via WebSockets. When you add a new login on your computer, your phone updates within seconds without manual pulling.
  • ADMIN_TOKEN: The password for the administrative console (/admin), hashed with Argon2id so plaintext secrets aren’t exposed in Docker Compose files.
  • SIGNUPS_ALLOWED=true: Once you have created your primary household account, you can change this to false to completely disable new user registrations from the public web.

4. The Golden Vault Backup (ganesh-hq-bitwarden-import.json)

To prevent loss of critical infrastructure secrets, a standardized Bitwarden JSON export is maintained in the root of the repository:

  • File: ganesh-hq-bitwarden-import.json
  • Target Folder: Ganesh HQ Infrastructure

Included Credentials & Notes:

  1. Oracle Cloud VM (Ganesh HQ Host): Host IP 144.21.49.153, SSH key paths, and sudo credentials.
  2. Termius SSH Profile: Mobile and desktop SSH connection config.
  3. Vaultwarden Admin Portal: Admin panel URL and tokens.
  4. Authelia SSO Portal: Master admin credentials and cryptographic keys.
  5. Cloudflare Zero Trust & Tunnel: Account ID, Zone ID, and tunnel secret tokens.
  6. Daily Encrypted Backup: Google Drive target, Rclone config, and AES-256 encryption password.
  7. Cockpit Linux Console: Browser console URL and access credentials.
  8. Homepage Dashboard: Dashboard links and parameters.
  9. GitHub ganesh-hq Repo: Personal Access Token and repository links.
  10. Trading 212 API (Ganesh ISA): API key and secret.
  11. Trading 212 API (Rekha ISA): API key and secret.
  12. Chip Financial (Rekha ISA): Smart Cash ISA rate, interest schedule, and worker path.
  13. Mumbai Real Estate (Flats 208 & 209): Carpet areas, cost basis, FMVs, and LIC mortgage linkage.

How to Import in 30 Seconds:

  1. Log into your vault at https://vault.ganeshr.me.
  2. Go to Tools in the top navigation bar.
  3. Click Import Data.
  4. Set File Format to: Bitwarden (json).
  5. Select ganesh-hq-bitwarden-import.json from your machine.
  6. Click Import Data. All items will instantly populate under the dedicated folder!

5. Connecting Mobile Apps & Extensions

To use the official Bitwarden apps on iPhone, Android, or browser extensions:

  1. Download the official Bitwarden app from the App Store or extension store.
  2. On the very first login screen, do not enter your email yet.
  3. Tap the Settings Gear Icon (⚙️) at the top-left or bottom.
  4. In the Server URL field, enter: 
    https://vault.ganeshr.me
  5. Click Save.
  6. Now enter your account email and master password to log in.

6. Daily Operations Cheatsheet

Check Vaultwarden Container Status

sudo docker ps | grep vaultwarden

View Live Vaultwarden Logs

sudo docker logs -f vaultwarden

Accessing the Administration Console

  • URL: https://vault.ganeshr.me/admin
  • Admin Password: Use the master administrative password stored in SECRETS.md.
  • Capabilities: View registered accounts, invite family members, view active WebSocket connections, or adjust server settings.

7. Next Steps & Related Links

Graph View

Backlinks