Exposing only the Vaultwarden "Send"-Feature via Cloudflare Tunnel
reddit / selfhosted

----------------------------------------------------------------------
redditor111222333 · 2023-11-30 20:31

Hey,

I am hosting vaultwarden with traefik in my homelab. I can connect via
tailscale from everywhere. Working fine.

The `Send` Feature sounds really cool to me, but it doesnt make sense
to have this behind tailscale (for sharing with others).

I am wondering if its secure to only publish the /send URL via
Cloudflare or if there is a way to get to my vault then.  I think
Cloudflare Page Rules would be the feature to use here.

----------------------------------------------------------------------
Simplixt · 2023-11-30 20:52

I'm not sure this will work for file-download, as the download url is
not in the subfolder, e.g. https://vault.my-
bitwarden.com/c252fd80-535f-5b85-4ce0-7ee4b4e85e82

----------------------------------------------------------------------
redditor111222333 · 2023-11-30 20:58

You mean only for files or also Text?

----------------------------------------------------------------------
Simplixt · 2023-11-30 21:03

For text at least the app data (e.g. css files, javascript, etc.) in
the /app folder must be accessible with your rules.

----------------------------------------------------------------------
NikStalwart · 2023-12-01 02:19

I think the upstream Bitwarden server will let you create separate
hosts for each feature of the stack, including a separate host for
sends.

----------------------------------------------------------------------
redditor111222333 · 2023-12-01 07:22

Do you have more information about this, can't really find anything
about that.

----------------------------------------------------------------------
redditor111222333 · 2023-12-01 07:29

[https://bitwarden.com/help/send-faqs/#q-can-send-be-used-on-an-
internal-network-to-share-outside-of-the-
network](https://bitwarden.com/help/send-faqs/#q-can-send-be-used-on-
an-internal-network-to-share-outside-of-the-network)


>Q: Can Send be used on an internal network to share outside of the
network?
A: Send is designed to be an end-to-end encrypted URL that can be
shared through the web. Using Send outside of an internal network will
require that ports 80 & 443 be opened. If you are using a reverse
proxy, the following variables must be added to ./bwdata/env/global-
override.env:


globalSettings\_\_attachment\_\_baseDirectory=/etc/bitwarden/core/atta
chments
globalSettings\_\_attachment\_\_baseUrl=https://YOURDOMAINHERE/attachm
ents
globalSettings\_\_send\_\_baseDirectory=/etc/bitwarden/core/attachment
s/send
globalSettings\_\_send\_\_baseUrl=https://YOURDOMAINHERE/attachments/s
end