I run it through an nginx proxy that runs cloudflared through my domain, giving https access with limited worry of various security concerns. Probably not the best setup but was relatively easy to do.
For backups, I have two storage VPSes (one in Los Angeles and one with a completely different provider in Canada), and have an individual backup to each one. I’m using Borgbackup for that.
Borg lets you enable an “append only” mode for particular clients such that even if an attacker were to gain access to your client system, they couldn’t delete your backups. This is a common issue with rsync/rclone solutions.
Borg dedupes across all backups, so you can have months of daily backups without using a lot more disk space. Neither rsync nor rclone can do this.
Don’t forget to test your backups by doing a data recovery run - act as if your data was lost, and try to set everything up again, maybe on a VM or something. If the backups aren’t tested, you don’t really have backups :)
I just periodically export my vault every few months, it’s compatible with bitwarden. Absolute worst case scenario I can just sign up and import my vault, and maybe lose a password or 2,whoch can most likely just be reset anyways.
Actually on premise self hosting email is just stupid these days. I do have my domain email set up with a local provider, but I don’t use it. Again, email is crucial and I don’t trust myself
My wife was the type to use the same password evey where. I switched to bitwarden for the ios app to get my household to use it. Worth the extra complexity imo
Not really, no. I have an HDD and an SSD both in a same machine. Data in SSD gets copied to HDD everyday. I don’t have any remote backup yet. How do you do your remote backup?
I regularly hear it’s great. Has anyone moved from KeePass? I haven’t read anything that makes me think I should move on from KeePass. I have maybe ~4-5 clients and merging databases has been very easy since no client is offline for too long.
I tried it but reverted back to KeePass. I didn’t see any advantage with Vaultwarden and having it exposed so brazenly didn’t fill me with confidence. When I tried to run in parallel I found that you can’t sync vault warden with a keepass DB file. You can import it, but once it’s imported you can’t keep them in sync. Re-do an import and you end up with everything duplicated - but updated entries… which is the up to date one? If it had better syncing I could see myself using keepass on mobile and vaultwarden on PC. But at the end KeePass is just brilliant as it is and that’s fine with me.
Yes. It was the “save it somewhere” I was wondering what people do.
If you keep it in the same building as the server, a fire could render backups useless.
I ended up storing it on a separate online service from backblaze
I do this, but on B2 I upload encrypted restic repo. Password manager backup is one of those instances where it’s totally worth to have historical copies (for example, 1 weekly copy for the last 6 months), as it consumes very little space while saving the day in case of accidental overwrite or deletion.
I’ve been using it for a few months now and love it. I have it on 2 VMs. 1 at home and 1 on my dedicated server in the cloud.
I have a horribly written script that stops the vaultwarden container on the home VM, it copies the db.sqlite3 files to the VM in the cloud using SCP, copies everything inside the attachments folder using SCP and then starts the container again. I then have the same type of script on the cloud VM that stops the container, grabs the db and attachments from the temp folder and moves them to the correct directories and starts the container.
I only use the instance on the VM at home, the cloud VM is only used if something has happened to the VM at home. I do the same with my netbox instance.
I also don’t expose anything to the internet. Everything is behind WireGuard. I have my phone setup with Tasker to automatically connect the tunnel when my phone disconnects from my home WiFi SSID.
I tried Vault warden, but I didn’t find it better than KeePass which I have syncing over nextcloud to storage that is mounted over NFS for my desktop and laptop. There are plenty of clients so you can use windows, linux, android etc.
I ran Keepass synced through my Nextcloud for a long time as well, but I switched to Vaultwarden after loosing Passwords due to sync issues.
Almost got locked out of an important account. Luckily I noticed it early enough to recover it through my Nextcloud’s versioning. But since then I’m too paranoid to rely on a password manager without a reliable syncing mechanism built-in if I’m gonna use it daily on a range of different devices.
You may have just inspired me to do the same lol, I’m self hosting most of my other things… For some reason, keeping my own data safe with bitwarden is kinda freaking me out too lol
TOTP function is what really made it happen. It brings me so much joy to have one, self hosted service to do everything login related compared to using Authy too. I was way too invested in Authy which was never comfortable for me. I now found peace.
It is discouraged but with a very strong non-reused primary password for your home instance, you’d be hard pressed to have problems with hackers even if they dump your database. It’s still a better idea to use a hardware key but that’s understandably annoying to carry/use.
One thing you could do is setup a second vaultwarden instance running on a separate machine ideally on a separate network and keep only TOTP connections on it, with its own backups and storage. But that is probably just as annoying.
It still defends against one failure mode (the website gets hacked but you’re ok) but yeah, obviously if you get hacked and the hacker knows how to get your vault out then you’re 100% screwed.
My suggestion is always hardware 2FA, even though it’s not as mature as the other systems. Personally I have two Yubikeys (in case one breaks/gets lost) but it does mean that I need to add TOTPs to both of them each time I add a new 2FA.
I’m fairly certain hardware based 2fa has been around since the early 90s maybe even earlier. It’s not the maturity that’s the issue, as I’m fairly certain its significantly older than application based, but that it’s extremely inconvenient for the user to have to buy a physical key and keep it safe
I use vaultwarden as my bitwarden backup. I pay for bitwarden premium because it’s too critical of a service for me to not pay for access/support the service, or to expect my self hosted option will be sufficiently reliable enough.
That said, as a backup option, I run the vaultwarden addon in home assistant and just periodically do a manual export from bitwarden and import to vaultwarden. This is usually good enough for me, but glad to see this thread with some other options. Will be exploring some of these too!
Oooh, I like this idea… I’ve thought about running vaultwarden but like you I pay for bitwarden premium because I think it’s critical for me and I like the service and want to see them continue. Using it as a backup, then I can still support them and run my own backup.
The nice thing about syncing services like Vaultwarden is that all your synced devices kind of act like backups. You should still keep proper backups too, of course, but this makes me sleep a bit better at night at least.
I don’t trust vaultwarden, only on the basis that it’s unofficial and not as strictly audited. I use the container stack provided by bitwarden behind a cloudflare tunnel and backup the data directory with duplicati to S3. Should be able to do the same with vaultwarden, just try a backup test.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
How do you approach remote access?
Not OP, but you could setup a wireguard vpn in your home network.
It would require opening up a port on your router for wireguard. and probably use a dynamic dns provider ( duckdns.org or similar ) to get an url.
I run it through an nginx proxy that runs cloudflared through my domain, giving https access with limited worry of various security concerns. Probably not the best setup but was relatively easy to do.
Simple way to build confidence in your backups… test your restores regularly.
I ran it for a while but ultimately didn’t trust myself to harden it enough.
For backups, I have two storage VPSes (one in Los Angeles and one with a completely different provider in Canada), and have an individual backup to each one. I’m using Borgbackup for that.
Borg lets you enable an “append only” mode for particular clients such that even if an attacker were to gain access to your client system, they couldn’t delete your backups. This is a common issue with rsync/rclone solutions.
Borg dedupes across all backups, so you can have months of daily backups without using a lot more disk space. Neither rsync nor rclone can do this.
Don’t forget to test your backups by doing a data recovery run - act as if your data was lost, and try to set everything up again, maybe on a VM or something. If the backups aren’t tested, you don’t really have backups :)
I don’t trust myself with Vaultwarden honestly. I will just pay for Bitwarden if I need to.
Same. Like, I’m relatively confident in the systems I have running, but not so confident that I’d trust them with my most important passwords.
I just periodically export my vault every few months, it’s compatible with bitwarden. Absolute worst case scenario I can just sign up and import my vault, and maybe lose a password or 2,whoch can most likely just be reset anyways.
agree … one of the services which is just to critical for me to selfhost
Same for email. I can’t afford it to be down for days while I stress out about fixing whatever it was that I broke.
Actually on premise self hosting email is just stupid these days. I do have my domain email set up with a local provider, but I don’t use it. Again, email is crucial and I don’t trust myself
deleted by creator
My wife was the type to use the same password evey where. I switched to bitwarden for the ios app to get my household to use it. Worth the extra complexity imo
deleted by creator
how are you doing your backups now? are you using the 3-2-1 backup strategy?
Not really, no. I have an HDD and an SSD both in a same machine. Data in SSD gets copied to HDD everyday. I don’t have any remote backup yet. How do you do your remote backup?
encrypted Rsync to a free Backblaze account. be sure to test your backups tho
I regularly hear it’s great. Has anyone moved from KeePass? I haven’t read anything that makes me think I should move on from KeePass. I have maybe ~4-5 clients and merging databases has been very easy since no client is offline for too long.
I went from KeePass to pass to vaultwarden. Sharing passwords is way easier.
I tried it but reverted back to KeePass. I didn’t see any advantage with Vaultwarden and having it exposed so brazenly didn’t fill me with confidence. When I tried to run in parallel I found that you can’t sync vault warden with a keepass DB file. You can import it, but once it’s imported you can’t keep them in sync. Re-do an import and you end up with everything duplicated - but updated entries… which is the up to date one? If it had better syncing I could see myself using keepass on mobile and vaultwarden on PC. But at the end KeePass is just brilliant as it is and that’s fine with me.
Set up a Backblaze B2 account. Make regular backups via RSync (and use encryption.)
10GB free, and dirt cheap after that.
Where do you backup the decryption? Is it a memorized password, or a key?
B2 gives you an API key, you put that into rclone.
You setup encryption with rclone which you can make a passkey for, or let it generate. Just make sure to save it somewhere.
Yes. It was the “save it somewhere” I was wondering what people do. If you keep it in the same building as the server, a fire could render backups useless.
I ended up storing it on a separate online service from backblaze
I keep it as a “secure note” in my password manager.
Though I host that myself and back it up to B2…
Well I’m sure I’d be able to use one of many devices I have that has the vault cached if things go to hell.
I do this, but on B2 I upload encrypted restic repo. Password manager backup is one of those instances where it’s totally worth to have historical copies (for example, 1 weekly copy for the last 6 months), as it consumes very little space while saving the day in case of accidental overwrite or deletion.
I’ve been using it for a few months now and love it. I have it on 2 VMs. 1 at home and 1 on my dedicated server in the cloud.
I have a horribly written script that stops the vaultwarden container on the home VM, it copies the db.sqlite3 files to the VM in the cloud using SCP, copies everything inside the attachments folder using SCP and then starts the container again. I then have the same type of script on the cloud VM that stops the container, grabs the db and attachments from the temp folder and moves them to the correct directories and starts the container.
I only use the instance on the VM at home, the cloud VM is only used if something has happened to the VM at home. I do the same with my netbox instance.
I also don’t expose anything to the internet. Everything is behind WireGuard. I have my phone setup with Tasker to automatically connect the tunnel when my phone disconnects from my home WiFi SSID.
I tried Vault warden, but I didn’t find it better than KeePass which I have syncing over nextcloud to storage that is mounted over NFS for my desktop and laptop. There are plenty of clients so you can use windows, linux, android etc.
I ran Keepass synced through my Nextcloud for a long time as well, but I switched to Vaultwarden after loosing Passwords due to sync issues. Almost got locked out of an important account. Luckily I noticed it early enough to recover it through my Nextcloud’s versioning. But since then I’m too paranoid to rely on a password manager without a reliable syncing mechanism built-in if I’m gonna use it daily on a range of different devices.
You may have just inspired me to do the same lol, I’m self hosting most of my other things… For some reason, keeping my own data safe with bitwarden is kinda freaking me out too lol
TOTP function is what really made it happen. It brings me so much joy to have one, self hosted service to do everything login related compared to using Authy too. I was way too invested in Authy which was never comfortable for me. I now found peace.
Is having your passwords and TOTP in one place recommended? I would’ve thought that having both separate would be more secure.
It is discouraged but with a very strong non-reused primary password for your home instance, you’d be hard pressed to have problems with hackers even if they dump your database. It’s still a better idea to use a hardware key but that’s understandably annoying to carry/use.
One thing you could do is setup a second vaultwarden instance running on a separate machine ideally on a separate network and keep only TOTP connections on it, with its own backups and storage. But that is probably just as annoying.
It still defends against one failure mode (the website gets hacked but you’re ok) but yeah, obviously if you get hacked and the hacker knows how to get your vault out then you’re 100% screwed.
My suggestion is always hardware 2FA, even though it’s not as mature as the other systems. Personally I have two Yubikeys (in case one breaks/gets lost) but it does mean that I need to add TOTPs to both of them each time I add a new 2FA.
I’m fairly certain hardware based 2fa has been around since the early 90s maybe even earlier. It’s not the maturity that’s the issue, as I’m fairly certain its significantly older than application based, but that it’s extremely inconvenient for the user to have to buy a physical key and keep it safe
I use vaultwarden as my bitwarden backup. I pay for bitwarden premium because it’s too critical of a service for me to not pay for access/support the service, or to expect my self hosted option will be sufficiently reliable enough.
That said, as a backup option, I run the vaultwarden addon in home assistant and just periodically do a manual export from bitwarden and import to vaultwarden. This is usually good enough for me, but glad to see this thread with some other options. Will be exploring some of these too!
Oooh, I like this idea… I’ve thought about running vaultwarden but like you I pay for bitwarden premium because I think it’s critical for me and I like the service and want to see them continue. Using it as a backup, then I can still support them and run my own backup.
The way I justify self hosting is that every device I use it on has an offline backup so downtime isn’t overly important.
The nice thing about syncing services like Vaultwarden is that all your synced devices kind of act like backups. You should still keep proper backups too, of course, but this makes me sleep a bit better at night at least.
Yeah, this too… like… I have Bitwarden synced in different computers/phones, so at least most of the passwords will still be somewhere.
I don’t trust vaultwarden, only on the basis that it’s unofficial and not as strictly audited. I use the container stack provided by bitwarden behind a cloudflare tunnel and backup the data directory with duplicati to S3. Should be able to do the same with vaultwarden, just try a backup test.
VW is FOSS, so that is not an issue. I trust them, but I don’t trust myself