Vaultwarden secured with NGINX
reddit / selfhosted

----------------------------------------------------------------------
Hyp3rax · 2023-12-16 15:08

Hi

I installed vaultwarden on a VPS. I have other services on this
machine so I created a subdomain vw.mydomain.com

​

To secure the website with certificate I asked a letsencrypt
certificate.

I then created this nginx configuration file:

    # /etc/nginx/sites-enabled/vw.mydomain.com
    server {
            listen 443 ssl;

            server_name vw.mydomain.com;

            ssl_certificate
/etc/letsencrypt/live/vw.mydomain.com/fullchain.pem;
            ssl_certificate_key
/etc/letsencrypt/live/vw.mydomain.com/privkey.pem;

            location / {
                    proxy_pass http://localhost:1234;
            }
    }

The connection between my browser and nginx site is secure, but what
about the upstream docker container running http?

In their [docs](https://github.com/dani-
garcia/vaultwarden/wiki/Enabling-HTTPS) they say *" (Recommended) Put
vaultwarden behind a* [*reverse
proxy*](https://en.wikipedia.org/wiki/Reverse_proxy) *that handles
HTTPS connections on behalf of vaultwarden.".*

Is my configuration good? If not, what can I do to secure it?

Thanks

----------------------------------------------------------------------
sniff122 · 2023-12-16 15:28

Yeah that's fine because it's only going to localhost/127.0.0.1,
however if it was reverse proxying to a different server (which you
aren't so you're fine) you would want to have that encrypted too

----------------------------------------------------------------------
thekrautboy · 2023-12-16 15:51

This is perfectly fine.

----------------------------------------------------------------------
Simplixt · 2023-12-16 15:59

That's fine.

However, I prefer running NGINX in a docker container and have an
separate network between NGINX and the app container, instead of
publishing any ports. If you publish any ports, make sure they are
bind to localhost / [127.0.0.1](https://127.0.0.1) and not
[0.0.0.0](https://0.0.0.0)

----------------------------------------------------------------------
utahbmxer · 2023-12-17 08:24

Lock /admin location down using access list, or look at the wiki for
more examples including a password in addition to the admin TOKEN.  I
have mine setup through OPNSense nginx plugin, but these are basics
for IP access list.

`location  /admin {`
`# IP ACL`
`allow` [`192.168.0.0/16;`](https://192.168.0.0/16;)
`deny all;`

   `proxy_pass` [`http://localhost:1234`](http://localhost:1234)`;`

`}`

You may want to turn on websockets as well.  There is something to do
with mobile notifications which enables clients to be notified of
sync.  May not need it in your use case, but but for me it helps when
I update a password on my mobile, then the desktop/browser clients get
notified of updates and sync automatically without having to manually
sync.

----------------------------------------------------------------------
blind_guardian23 · 2023-12-17 11:20

you could add minimum TLS version 1.2 (or even 1.3), HSTS and Ciphers
("{% ... %}" and "{{ ... }}" is jinja2 for ansible, just use the
cleartext-config für nginx!): [https://github.com/selfhostx/ansible/bl
ob/main/roles/vaultwarden/templates/nginx-vaultwarden.conf.j2](https:/
/github.com/selfhostx/ansible/blob/main/roles/vaultwarden/templates/ng
inx-vaultwarden.conf.j2)
taken from my ansible role:
https://github.com/selfhostx/ansible/tree/main/roles/vaultwarden