Vaultwarden
Vaultwarden: a first setup, important settings, verification, and recovery considerations.
Working directory: ~/homelab/apps/passwords. Follow the common setup workflow first. This is a setup note based on the linked documentation, not a copy of my live configuration or a runtime verification of this full stack.
Start here
Vaultwarden is an independent implementation compatible with Bitwarden clients. Treat it as a sensitive service, not your first container exercise. Start with a test vault containing invented credentials and follow the current deployment and backup instructions. Do not migrate your only password copy yet.
Settings and data
Persist /data. Use HTTPS for normal client access, control signups, and protect or disable the administration interface as documented. Keep administrator access separate from a vault user's master password. A reverse-proxy login is not a replacement for vault authentication.
Check it
Create a test item, synchronize it to a supported client, and verify unlock after restarting the server. Test encrypted export and a full server restore in an isolated instance. Confirm attachments as well as text items; recovery must include more than the container image.
When something fails
If a client cannot connect, check HTTPS trust, server URL, and client configuration before changing encryption settings. Never post vault exports, admin tokens, or full logs containing credentials. Store recovery information outside the same vault so an outage does not lock you out of your own recovery plan.