Help hosting Vaultwarden local only reddit / selfhosted ---------------------------------------------------------------------- infinitay_ · 2023-10-28 05:11 Hello, I've been looking at many guides but I'm having trouble understanding how to selfhost VaultWarden locally. Could someone help me understand how I could achieve this considering, - I don't have a domain - It would be nice to do something like vaultwarden.local or vaultwarden.homelab.local instead of typing in the homelab's pc static ip and the port vaultwarden is on - I don't want to expose anything outside of my local network - Security reasons - I am now well versed in networking so I don't want to risk leaving an entry point for unwanted users or hackers I also learned that I would need to sign certificates to be able to access it on some browsers and the additional security. I learned that Traefik offers self-signed certificates, but every video I have seen starts talking about needing a domain and cloudflare tunneling and I get lost. It would be nice if I could get help or advice from the r/selfhosted community because I am new to all of this but want to learn and host more applications and services locally. Thank you. ---------------------------------------------------------------------- acbadam42 · 2023-10-28 05:31 Why don't you have a domain That's kind of how it's meant to work. ---------------------------------------------------------------------- acbadam42 · 2023-10-28 05:37 I have a static IP address at both my business and my home and have three domains I bought for 12 bucks each. I don't use cloudfare as I seem to have no use for it I think that's only for people that have problems exposing ports or something. One domain is for the main website of my business which is a .com address, another for everything I expose externally at my business which is a .net address. And then one that exposes everything externally at home which is another .com address. From there everything is in subdomains so I could go to mysite.com for overseerr requests or pass.mysite.com for vaultwarden, cctv.mysite.com for blue iris, photo.mysite.com for photoprism, cloud.mysite.com for nextcloud, and so on. ---------------------------------------------------------------------- mckunekune · 2023-10-28 05:45 For a proper trusted certificate you’re best to have a domain. That doesn’t mean you need to expose anything to the internet. If you have Traefik or HAproxy they can auto issue certificates from LetsEncrypt with the right config. Just don’t allow external access to those front ends. I have the same sort of thing setup with pfsense and the site is internal only via HAproxy to the docker container. Works great. ---------------------------------------------------------------------- infinitay_ · 2023-10-28 06:01 I don't have a domain because I don't want to host anything publicly. I assume that with a domain that anyone could have public access. ---------------------------------------------------------------------- infinitay_ · 2023-10-28 06:02 > That doesn’t mean you need to expose anything to the internet Really? How do you do this? Do you just not forward any of the ports on your router? If that's the case then I'll go ahead and purchase a domain and get started. ---------------------------------------------------------------------- acbadam42 · 2023-10-28 06:03 no, there are logins ---------------------------------------------------------------------- geo38 · 2023-10-28 06:09 http://traefik.me Download certs from here. Access your server via http://192-168-1-125.traefik.me or whatever your IP address is. The Traefik DNS servers will return the right IP address given that name. Your server will be using their *.traefik.me wildcard cert, and everyone's happy. ---------------------------------------------------------------------- mckunekune · 2023-10-28 06:14 Correct. Depending on how you do the certificate verification process (prove you own the domain) you may need to allow something there but you can also do this with DNS record updates outside your environment. This is very much an “it depends” situation. You also need to have something like pihole for internal DNS that you can add the myhost.mydomain.com record to point to your internal IP address. ---------------------------------------------------------------------- Lanten101 · 2023-10-28 06:34 I'm using the cloudfare tunnel. That way i don't have to deal with any certificate. ---------------------------------------------------------------------- [deleted] · 2023-10-28 06:41 [removed] ---------------------------------------------------------------------- esturniolo · 2023-10-28 07:14 This is not true. You can host you own instance with a valid domain without exposing it to the world. With some local DNS resolver (Adguard/Pihole has it. Bonus: you will not have any ad in your network) and a reverse proxy (hello nginx) you can achieve this. And if you want to expose the service using a VPN (the only way that I accept to expose something), Tailscale will be your friend too. Specifically Vaultwarden needs a valid domain because it must have a valid HTTPS certificate to work (yes Let’s Encrypt I’m looking at you. C’mon start to move because you’ll enter the game too). A self signed I think (repeat, “I think”) that is not allowed. If you not have HTTPS in your instance, Vaultwarden will not work by design. I know that I mentioned several piece of software that requiere some experience but once you learned it, you will put and remove new services in your stack in seconds. ---------------------------------------------------------------------- NoTransportation8854 · 2023-10-28 07:15 Can try duckdns ---------------------------------------------------------------------- Victorioxd · 2023-10-28 07:34 Btw if you want a really cheap domain search 1.111B class XYZ domains, these consist on [6to8numbers.xyz] and cost less than a USD a year ---------------------------------------------------------------------- Ziomal12 · 2023-10-28 07:45 DuckDNS provides you with xxx.duckdns.org for free and gives you ability to generate wildcard certificates. What I suggest you do is 1a) host VW locally only 1b) host it so that is accessible only with VPN. 2. In duckdns set ip to you local ip that VW is being hosted on (ie 192.168.1.20) or vpn ip 2. Use Traefik or NPM (or any other reverse proxy) to generate wildcard certificate with dns challange 3. Use Traefik or NPM to point on your device to the port VW is accessible on ---------------------------------------------------------------------- Nassiel · 2023-10-28 07:45 For that, use dns challenge and get a let's encrypt cert. Then, in your pihole or dns solution point the public domain to a private ip. Problem solved. ---------------------------------------------------------------------- Ziomal12 · 2023-10-28 07:48 If you never set up Traefik I suggest you use Nginx Proxy Manager, it's waaaay easier to set up, especially if you don't need the flexibility of Traefik. ---------------------------------------------------------------------- CrazyShipTed · 2023-10-28 07:56 Your router is exposed to public internet as long as it gets a public ip address. Domain is just an alias of ip easy to remember. Set strong policy on router will protects your local network on most scenarios. What I did on self hosting is: * Purchase a domain, add record pointing to my router's public ip. * Expose ports for non-sensitive or authentication-capable application on home server. Those apps can be accessed from anywhere using public domain directly in browser. * Deploy an OpenVPN server on home server, generate SSL certificates, install OpenVPN client and import certificates on my devices. Then set series of policies on router, to let data packets from OpenVPN's subnet can be routered to home server with certain ports. Whenever a sensitive app or app without login portal need to be accessed (from public internet), just start OpenVPN client at first. * Make sure some critical apps could only be access from local network, even not for OpenVPN's subnet, such router's portal. If you're bothered to tweak config on router, you could also use Cloudflare's tunnel, to manually add second level domain record for each service, if there are not many. Besides, I use caddy to auto regenerate Let's Encrypt's certificate. It default requires that 80 port of you network is accessiable, not blocked by ISP. Or you can use dns verification in Let's Encrypt's config, just provide your domain provider's API credential to it. ---------------------------------------------------------------------- usrdef · 2023-10-28 08:36 Another option which I've used in the past is that you can set your domain up with Cloudflare and then either utilize a Tunnel, or restrict the domain to your own IP address and it will block all external traffic. I've utilized it for several projects and it has always worked flawlessly. Haven't tried the Traefik / HAproxy method. But Certbot / LetsEncrypt is extremely easy to use. ---------------------------------------------------------------------- NikStalwart · 2023-10-28 10:26 Not necessarily. A domain points to an IP address. You can point your domain to an internal IP address (like 192.168.1.4) and nobody outside of your local network will be able to access that instance. Problem solved! ---------------------------------------------------------------------- kevdogger · 2023-10-28 12:31 Had openvpn set-up but honestly found it way easier to use wireguard. I found wireguard today be quicker but that might be part of my lack of knowledge of how to setup all the openvpn options. I was spending a lot of time trying to configure openvpn for tls 1.3 traffic only and using specific cipher algorithms. A lot of documentation from random sites on the internet with examples however many apply to older settings and such. Been pretty happy with wireguard as it integrates really easy on my router. ---------------------------------------------------------------------- kevdogger · 2023-10-28 12:35 I tried npm and it's good for simple things...however with anything complex you actually have to know nginx pretty well which at that point I'd just use the swag container. I agree traefik is much more complex to learn initially..like I struggled for days until like finally a lighbulb went on and I kind of figured it out. It would be tough to start out with traefik without some background configuring a different reverse proxy. A lot of users sware by caddy so to its ease of use but then again it doesn't provide a gui. I do really enjoy traefiks dashboard as to verify the configuration is set appropriately however ---------------------------------------------------------------------- Ziomal12 · 2023-10-28 12:47 Isn't it the case here though? IMHO op should just use NPM, setting it up takes literally 5 minutes and forget about it. ---------------------------------------------------------------------- angelfalse19 · 2023-10-28 12:50 If you don't want to buy a domain I recommend you use to [nip.io](https://nip.io) as temporary ---------------------------------------------------------------------- SagaciousZed · 2023-10-28 15:46 I see many people advocating for a publicly trusted cert, but if you want to get some practice using privately signed certs it is also an option. Many companies have private CAs so you might as well get in some practice. Technically, you don't need a domain or a cloud flare tunnel. You do however need to make sure the certificate you generate and the name you use to connect to you. You will need to add the local authority as a trusted root if you do not obtain publicly trusted certificates. Reverse proxies like Caddy can also act as their own CA. It also makes it easy to configure the name. As long as you add it as a trust root to your clients, any certificate generated by Caddy will be trusted by the client. This way, you don't need an external domain name. ---------------------------------------------------------------------- toolski · 2023-10-28 16:24 [https://drfrankenstein.co.uk/2023/05/20/vaultwarden-bitwarden-in- container-manager-on-a-synology- nas/](https://drfrankenstein.co.uk/2023/05/20/vaultwarden-bitwarden- in-container-manager-on-a-synology-nas/) is a great guide if you have Synology ---------------------------------------------------------------------- natermer · 2023-10-28 17:25 Let's Encrypt uses what is called "ACME protocol" for proof of owner when generating certificates. There are various challenges they use to prove ownership of the domain. The default one just places a special file on your web server that Let's Encrypt then reads. However there are a number of different types of challenges. If you don't want to expose anything to the internet then a common one to use is 'DNS Challenge'. With DNS challenge the certbot uses your DNS server/provider's API to update DNS records as a response to the challenge. Let's Encrypt reads the special TXT response and verifies that you own the domain. So to use this you need two things: 1. A DNS domain 2. A DNS domain provider that has a API that certbot can use. AWS Route53 is a good one to use. But I have used Digital Ocean's free DNS Service, Bind servers, Njalla, and other things. Most commonly used DNS providers are supported one way or the other. You can also get fancy and designate sub domains or other domains to respond to the challenges. So if your DNS is locked down you can still add a record to point to a different one on a different server. The big win for going with DNS Challenge is that you can do wildcard certificates. So say you are setting up a reverse proxy that will serve vault.home.example.com, fileshare.home.example.com, torrent.home.example.com, and a bunch of others... all you need to do is configure your reverse proxy with a single *.home.example.com cert and it'll handle anything you throw at it. You can't do that with the normal http challenge. Which makes doing the DNS challenge worth it, IMO, even if you do have a public-facing web server. ---------------------------------------------------------------------- KyroPaul · 2023-10-28 17:35 Look up "vaultwarden caddy" setup it's what you need. Would still limit access to inside your network by IP address. It will be the lowest entry point, nginx would be good as well. Depending on your network hardware and setup you could set DNS records (pihole should allow this) such that you can have an internal alias for vaultwarden that points to caddy. ---------------------------------------------------------------------- dotinho · 2023-10-28 18:08 That is the right thing, I use the same. ---------------------------------------------------------------------- soul_soup · 2023-10-28 19:20 This. ---------------------------------------------------------------------- DrKoks99 · 2023-10-29 00:09 1. buy some cheap domain 2. point an a record to the private ip of your Bitwarden server 3. Get your LE Certificate with DNS-Challenge ---------------------------------------------------------------------- proghoti · 2023-10-29 00:42 ~$9/year for a domain, get one Tailscale has their alias domain + https for your vaultwarden, try one ---------------------------------------------------------------------- CrazyShipTed · 2023-10-29 02:01 I use openwrt with default config for luci-openvpnserver, nothing much to config, just change cipher to aes-256-gcm. And I try to set only use tls1.3 on both my device's client, it still works. Wireguard does provide higher bandwidth and minimum latency. There is also a wireguard plugin installed on my router, maybe I can try it the other day. ---------------------------------------------------------------------- Not_your_guy_buddy42 · 2023-10-29 02:51 totally worked for me when i tried it last week, with traefik ---------------------------------------------------------------------- BadGroundbreaking243 · 2023-10-29 02:56 Yup. I'm having a pretty bad time learning traefik / haproxy, ends up staying with NPM for simplicity. ---------------------------------------------------------------------- Ziomal12 · 2023-10-29 07:31 Don't worry, as your homelab grows you might feel a need for something more and then you'll learn Traefik at your own pace. It took me 3 attempts to finally grasp it myself.