Selfhosting Pihole and password manager reddit / selfhosted ---------------------------------------------------------------------- Novel-Minute-1836 · 2023-11-19 15:34 Any security/privacy suggestions to securely host pihole with vaultwarden on a rpi? Looking at vaultwarden to use the TOTP features but not sure if its a good idea to have them in the same device or on separate containers? Thoughts? ---------------------------------------------------------------------- RydRychards · 2023-11-19 17:01 I went with keepass and having the db on Google drive because I was deadly afraid I'd lose my passwords due to faulty backups and What I am trying to say: you also need to have a solid backup strategy in place. ---------------------------------------------------------------------- SimonLeBonTon · 2023-11-19 18:17 you can put on the same machine (raspi): - pihole - vaultwarden - certbot (letsencrypt) - lighttpd Pihole and vaultwarden use HTTP socks, so no encryption That's why you install the SSL certificate through letsencrypt and setup the reverse proxy from lighttpd to accept only HTTPS connections and reverse them locally to pihole and vaultwarden. To backup vaultwarden just crontab copying the /data folder to somewhere useful, like Github or Gdrive ---------------------------------------------------------------------- neon5k · 2023-11-19 21:32 Can I docker it all? ---------------------------------------------------------------------- tech2but1 · 2023-11-19 21:35 If the VW server dies you still have all your passwords stored and accessible locally. It's arguably *more* resilient than KeePass and Google Drive. ---------------------------------------------------------------------- Novel-Minute-1836 · 2023-11-19 22:14 Awesome! Thanks. I was thinking running it all behind tor but maybe https encrypt is best? ---------------------------------------------------------------------- SimonLeBonTon · 2023-11-20 08:23 - sure you can docker pihole and vaultwarden, certbot is a single binary so no need of docker, although you can just install pihole from their site amd lighttpd with APT - pihole's admin panel runs on http, hence the reverse proxy to access it through ssl; but if you want to encrypt the DNS requests (highly recommended) you can use cloudflareD, a small utility that wraps DNS requests and sends them through httpS (it's called DoH - DNS over HTTPS) - no you won't need a domain - what do you mean "work without internet" ? ---------------------------------------------------------------------- SimonLeBonTon · 2023-11-20 08:23 well, it's faster for sure! ---------------------------------------------------------------------- RydRychards · 2023-11-20 09:07 If the service/server does, how are you accessing the pws? ---------------------------------------------------------------------- tech2but1 · 2023-11-20 09:11 > If the VW server dies you still have all your passwords stored and accessible locally. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-20 10:55 VW clients give you read only access. The way VW works is that the server is just storage for the encrypted file. The clients do all the work. If a client can’t contact the server it is still fully functional except it is read only. VW will output a backup file if you need it. You could just backup the database to say a thumb drive once a week plugged into the Pihole. Pihole is just a cache anyways…if you lose it the biggest hassle is setting it up again. Same with the others. With such a simple system not sure if dockerizing everything make sense. ---------------------------------------------------------------------- RydRychards · 2023-11-20 14:04 Ah, thanks, makes sense. The same is possible with kp. I was afraid of missing out on something.