Skip to main content

Vaultwarden

vaultwarden-host is a small Hetzner Cloud server (CX23, 91.99.99.28) that runs the team's password vault at vault.abair.ie. Vaultwarden is a self-hosted server that works with the standard Bitwarden apps and the bw CLI.

Address91.99.99.28 (alias vaultwarden-host, user ansible-control)
Hetzner accounta separate Hetzner Cloud project and account, not the one hetzner-main or Secops use
Playbooksansible/vaultwarden/
Make targetssetup-vaultwarden-host, setup-vaultwarden-host-firewall, lock-root-vaultwarden, setup-vaultwarden, update-vaultwarden, setup-vaultwarden-backup, enroll-wazuh-vaultwarden-host

Why it's on its own server​

The vault holds the credentials for everything else, so it's the most valuable target in the estate. It isn't on Secops, because Gitea and Rocket.Chat have both had public remote-code-execution vulnerabilities in the past. It has its own machine, its own cloud account, and no network link to production.

What runs on it​

  • Vaultwarden (vaultwarden/server:latest), SQLite-backed, in /opt/vaultwarden-stack, listening on 127.0.0.1:8080. Sign-ups are off, so accounts are created by invitation from the admin panel. The admin token comes from Vaultwarden Admin Token.
  • nginx and Certbot on the host. The server gets its own *.abair.ie certificate and terminates TLS itself. vault.abair.ie points straight at 91.99.99.28 (proxied by Cloudflare). The webserver is not involved.
  • Borg backup every night at 22:30. See Backups.
  • Wazuh agent, reporting to Secops.

Firewall and access​

make setup-vaultwarden-host-firewall writes an nftables ruleset: SSH on 22, and ports 80 and 443 from anywhere. Everything else is dropped. It uses the same commit-confirm process. Confirm with ssh vaultwarden-host sudo touch /etc/nftables.confirmed.

The first run of make setup-vaultwarden-host needs ANSIBLE_USER=root, because only root exists at that point. Once the ansible-control user works, make lock-root-vaultwarden removes root's SSH keys and sets PermitRootLogin no.

One-way step

lock-root-vaultwarden has no automatic undo. Before you run it, check that ssh vaultwarden-host and sudo whoami both work. If you lock yourself out afterwards, the only way back is the Hetzner Cloud console.

What the vault holds​

  • Infrastructure secrets that make targets fetch with bw get password '<item>': registry, Cloudflare, Hugging Face, Gitea, Wazuh, Borg and others. The Makefile Reference lists which target uses which item.
  • App .env files, as Secure Notes named <app> .env. Each one is in the Vaultwarden collection for its project. If you're not a member of that collection, bw get notes returns nothing and the deploy stops.
  • The team roster: Secure Notes users.json (people, roles and SSH public keys) and teams.json (which team works on which project). These control who gets Grafana access and who can use the Amergin testing sandbox. They aren't kept in the repo.

Two-factor authentication is required for all users. See Admin Services.