Bitwarden_rs died. Installing Vaulwarden with self signed SSLs on LAN only ...issues. reddit / selfhosted ---------------------------------------------------------------------- flanker_lock · 2023-12-20 23:31 My Bitwarden server is inaccessible from the chrome extension (still accessible if I go to the server through the webpage) and the assumption is that the deprecated docker container is no go anymore (not 100% sure, but I didn't change anything). I installed Vaultwarden on docker (in Synology) and obviously it is not letting me access it through https. Command line installing Vaultwarden: docker pull vaultwarden/server:latest docker run -d --name vaultwarden -v /data.location/:/data/ -p xxxx:80 vaultwarden/server:latest I VPN into my local network, so I don't need any reverse proxy and I don't want to open any ports to the outside. Prior to this issue Bitwarden worked fine with self signed SSLs. I am accessing this locally only, so I do not need any reverse proxy or domain name. PS, this is on a Synology docker container. Where does Vaultwarden need the SSLs to be? Any ideas ? ---------------------------------------------------------------------- rwilso03 · 2023-12-20 23:56 This should help. https://github.com/dani-garcia/vaultwarden/wiki/Enabling-HTTPS I run mine with a Caddy proxy anyway even with it only being on my LAN. Easy to setup. ---------------------------------------------------------------------- flanker_lock · 2023-12-21 14:59 ok, will try to run Vaultwarden with the Rocket variable. Did you issue your own certs and it worked ? >I run mine with a Caddy proxy anyway even with it only being on my LAN I might have to implement a reverse proxy at one point, I just don't want to get a domaine name and open ports to the outside. I find that tunneling through VPN into my server from the outside is the most versatile, safe and efficient way to do it! ---------------------------------------------------------------------- rwilso03 · 2023-12-21 15:34 To be honest, I never tried running the builtin Rocket server for my certs since it isnt technically recommended by the Vaultwarden team. I am sure it works just fine once setup properly and low risk if not opening up to the outside. Below also explains why I havent tried using Rocket... may or may not be useful in your situation. On the Caddy front, dont think of its purpose being just for connecting to the internet. I run about a dozen apps (including Vaultwarden) all in docker on the same host. I do have a domain name that I pay for, but it doesnt have any public routes available. I use it for internal use only. Why do I pay for that domain name? 1) future proofing... might want to do something public in the future with it and 2) allows me to to get official certs that are recognized by all devices through lets encrypt rather than self-signed ones that you always get flagged on by browsers and other tools. Owning a domain allows you to do a DNS verification to show you own it for lets encrypt to give you or renew the cert. That cert is a wildcard cert (think *.yourdomain.com), thus I put that one cert into caddy and it works for all my apps. With caddy then, I set each app to its own address such as app1.yourdomain.com and app2.yourdomain.com. Some apps require custom ports, caddy will allow me to do the port redirection so all I have to do is go to the app1.yourdomain.com instead of remembering port numbers and ip addresses (side note, great for the other family members too). Now... add in something like tailscale, and now I can still access my apps on all my devices from anywhere in the world, all without opening up any ports on my home lan and exposing anything to the internet while using my home lan dns to resolve these yourdomain.com addresses. My apologies, this was longer than I planned, but I tried to demonstrate how a reverse proxy can be a good future proofing capability and make things more convenient for you if you begin to add more apps... even without opening a single thing to the internet. Not trying to pressure you into doing it this way, but it is certainly an option to consider if you plan to grow into more areas of self hosting. Good luck! ---------------------------------------------------------------------- flanker_lock · 2023-12-21 22:45 No man, I really appreciate the info. So what did you end up opening up to the outside. Just one port for caddy? ---------------------------------------------------------------------- rwilso03 · 2023-12-21 23:19 On the local machine running caddy, just one. To get access to my LAN through the VPN, no ports are open. Tailscale in particular doesn't require any open ports. That is the main benefit of something like Tailscale rather than a regular VPN.