Compose-Files/Docker-Compose/Vaultwarden/vaultwarden

Install VaultWarden

https://www.techaddressed.com/tutorials/vaultwarden-docker-compose/

Docker Compose yml file
version: '3'

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
      - /home/miker/vaultwarden/data/:/data/
    ports:
      - 9050:80
    environment:
      - DOMAIN=https://vault.mikeandrebel.com
      - LOGIN_RATELIMIT_MAX_BURST=10
      - LOGIN_RATELIMIT_SECONDS=60
      - ADMIN_RATELIMIT_MAX_BURST=10
      - ADMIN_RATELIMIT_SECONDS=60
      - ADMIN_TOKEN=create_token
      - SENDS_ALLOWED=true
      - EMERGENCY_ACCESS_ALLOWED=true
      - WEB_VAULT_ENABLED=true
      - SIGNUPS_ALLOWED=false
      - SIGNUPS_VERIFY=true
      - SIGNUPS_VERIFY_RESEND_TIME=3600
      - SIGNUPS_VERIFY_RESEND_LIMIT=5
      - SIGNUPS_DOMAINS_WHITELIST=example.us,example1.com
      - SMTP_HOST=mail.mcfetridge.us
      - SMTP_FROM=vaultwarden@example.us
      - SMTP_FROM_NAME=Vaultwarden
      - SMTP_SECURITY=starttls
      - SMTP_PORT=587
      - SMTP_USERNAME=vaultwarden@example.us
      - SMTP_PASSWORD= !password
      - SMTP_AUTH_MECHANISM="Login"


Create docker-compose.yml

We’re ready now to create the docker-compose.yml file that will hold your Vaultwarden docker configuration. In this tutorial I’m making use of the nano text editor and will give instructions specific to it. If you have a preference for a different editor, however, you’re free to use it instead.

To begin, let’s enter nano:

nano docker-compose.yml

If by some chance your system doesn’t already have nano available already, you can install it on Debian / Ubuntu based systems with this command:

sudo apt install nano -y

When you’ve entered nano, you should start with a blank file. Your editor should look like the screenshot, below.
Blank docker-compose.yml file in nano
Blank docker-compose.yml file in nano

Instead of typing in the entire configuration, I recommend copying the entire configuration – found under the Putting It All Together heading – and pasting it into nano and then making the necessary changes. When you’ve finished making modifications, press CTRL + O then ENTER on your keyboard to save the file then press CTRL + X to exit nano.
The Basics

The contents of the docker-compose.yml file can be a bit much to take in at once. To make it easier to understand, I’ve divided it into smaller sections.

Let’s start with the bare minimum configuration required to get Vaultwarden running – though I would NOT deploy a system using only these basic settings.

version: '3'

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
      - ./data/:/data/
    ports:
      - XXXX:80

Let’s examine what these settings do.

    container_name

This is the name that your container will be identified as in Docker. This can be anything you wish it to be, however, I’d recommend just keeping it as vaultwarden to make it easy to identify.

    image

The image setting informs docker which container image to use and which version. Here we’ve specified vaultwarden/server and then specified to always use the latest version.

    restart

This tells Docker when to restart this container if it’s not running. While there are other values you could specify, I’d recommend leaving it as I’ve specified. Using unless-stopped will always restart your container when it’s not running unless you’ve stopped it yourself.

    volumes

This is where we tell Docker how to map the data directory we created to be used inside the container. If you created a directory other than the one I specified earlier in this tutorial, you’ll want to be sure to modify the value on the. If you followed my directions, you can leave this as-is.

    ports

This is where we map a port on the host system to the necessary port used inside the container. Inside the Vaultwarden container the software uses port 80. Specify which port you’re using on the host on the left where I’ve specified XXXX. Any valid port should work fine. IMPORTANT – you’ll need to note which port you’ve chosen to open it in your firewall and specify it in your reverse proxy’s settings.
Environment Variables

Now let’s add the environment variables we’ll be adding into the file to help customize our Vaultwarden configuration. Note, these are not the only possible variables Vaultwarden has available for us to use. These are simply the ones I find the most necessary. You can consult the Vaultwarden environment variable documentation, if you wish, for additional options.
System Settings

This collection of settings deal with the configuration of Valutwarden itself.

      - DOMAIN=https://subdomain.yourdomain.com
      - LOGIN_RATELIMIT_MAX_BURST=10
      - LOGIN_RATELIMIT_SECONDS=60
      - ADMIN_RATELIMIT_MAX_BURST=10
      - ADMIN_RATELIMIT_SECONDS=60
      - ADMIN_TOKEN=YourReallyStrongAdminTokenHere
      - SENDS_ALLOWED=true
      - EMERGENCY_ACCESS_ALLOWED=true
      - WEB_VAULT_ENABLED=true

Again, let’s look at what each individual settings does.

    DOMAIN

This is the domain you wish to associate with your Vaultwarden instance.

    LOGIN_RATELIMIT_MAX_BURST

This is the maximum number of requests allowed in a burst of login / two-factor attempts while maintaining the average specified in LOGIN_RATELIMIT_SECONDS.

    LOGIN_RATELIMIT_SECONDS

This is the average number of seconds between login requests from the same IP before Vaultwarden rate limits logins.

    ADMIN_RATELIMIT_MAX_BURST

This is the same as LOGIN_RATELIMIT_MAX_BURST, only for the admin panel.

    ADMIN_RATELIMIT_SECONDS

This is the same as LOGIN_RATELIMIT_SECONDS, only for the admin panel.

    ADMIN_TOKEN

This value is the token (a type of password) for the Vaultwarden admin panel. For security, this should be a long random string of characters. The admin panel is disabled if this value is not set.

    SENDS_ALLOWED

This setting determines whether users are allowed to create Bitwarden Sends – a form of credential sharing.

    EMERGENCY_ACCESS_ALLOWED

This setting controls whether users can enable emergency access to their accounts. This is useful, for example, so a spouse can access a password vault in the event of death so they can gain access to account credentials. Possible values: true / false.

    WEB_VAULT_ENABLED

This setting determines whether or not the web vault is accessible. Stopping your container then switching this value to false and restarting Vaultwarden could be useful once you’ve configured your accounts and clients to prevent unauthorized access. Possible values: true/false.
Signup Settings

Finally, we’ll look at settings used to control account signups in Vaultwarden. I think it’s safe to assume that you don’t want just anyone to be able to create an account on your server and that you’d like to add some sensible settings to improve security.

      - SIGNUPS_ALLOWED=false
      - SIGNUPS_VERIFY=true
      - SIGNUPS_VERIFY_RESEND_TIME=3600
      - SIGNUPS_VERIFY_RESEND_LIMIT=5
      - SIGNUPS_DOMAINS_WHITELIST=yourdomainhere.com,anotherdomain.com

Let’s look at the individual settings.

    SIGNUPS_ALLOWED

This setting controls whether or not new users can register for accounts without an invitation. Possible values: true / false.

    SIGNUPS_VERIFY

This setting determines whether or not new accounts must verify their email address before being able to login to Vaultwarden. Possible values: true / false.

    SIGNUPS_VERIFY_RESEND_TIME

If SIGNUPS_VERIFY is set to true, this value specifies how many seconds a user must wait before another verification email can be sent.

    SIGNUPS_VERIFY_RESEND_LIMIT

If SIGNUPS_VERIFY is set to true, this value specifies the maximum number of times an email verification may be re-sent.

    SIGNUPS_DOMAINS_WHITELIST

This setting is a comma separated list of domains that can register for Vaultwarden accounts, even if SIGNUPS_ALLOWED is set to false. This is useful for when your Vaultwarden accounts are to be used specifically by email addresses whose domains you control.
SMTP Settings

I previously mentioned you’ll need a SMTP email account for your Vaultwarden service to be able to send emails. This is how we’ll configure those account settings. A reminder – these settings will depend on how your email provider has their systems configured.

      - SMTP_HOST=smtp.youremaildomain.com
      - SMTP_FROM=vaultwarden@youremaildomain.com
      - SMTP_FROM_NAME=Vaultwarden
      - SMTP_SECURITY=SECURITYMETHOD
      - SMTP_PORT=XXXX
      - SMTP_USERNAME=vaultwarden@youremaildomain.com
      - SMTP_PASSWORD=YourReallyStrongPasswordHere
      - SMTP_AUTH_MECHANISM="Mechanism"

Finally, our last group of settings.

    SMTP_HOST

This is your SMTP mailserver.

    SMTP_FROM

This is the email address messages will be sent from.

    SMTP_FROM_NAME

The name you wish to appear as the email account name on sent messages

    SMTP_SECURITY

The security method used by your SMTP server. Possible values: “starttls” / “force_tls” / “off”.

    SMTP_PORT

This is the SMTP port used by your mail server. Possible values: 587 / 465.

    SMTP_USERNAME

This is the login for your SMTP mail server.

    SMTP_PASSWORD

This is the password for your SMTP credentials.

    SMTP_AUTH_MECHANISM

This is the SMTP authentication mechanism of your mail server. Possible values: “Plain” / “Login” / “Xoauth2”.
Putting It All Together

Putting all the pieces together gives us this complete docker-compose.yml file. As I’ve previously mentioned, copy and paste this into your editor and make the appropriate changes for your deployment.

version: '3'

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
      - ./data/:/data/
    ports:
      - XXXX:80
    environment:
      - DOMAIN=https://subdomain.yourdomain.com
      - LOGIN_RATELIMIT_MAX_BURST=10
      - LOGIN_RATELIMIT_SECONDS=60
      - ADMIN_RATELIMIT_MAX_BURST=10
      - ADMIN_RATELIMIT_SECONDS=60
      - ADMIN_TOKEN=YourReallyStrongAdminTokenHere
      - SENDS_ALLOWED=true
      - EMERGENCY_ACCESS_ALLOWED=true
      - WEB_VAULT_ENABLED=true
      - SIGNUPS_ALLOWED=false
      - SIGNUPS_VERIFY=true
      - SIGNUPS_VERIFY_RESEND_TIME=3600
      - SIGNUPS_VERIFY_RESEND_LIMIT=5
      - SIGNUPS_DOMAINS_WHITELIST=yourdomainhere.com,anotherdomain.com
      - SMTP_HOST=smtp.youremaildomain.com
      - SMTP_FROM=vaultwarden@youremaildomain.com
      - SMTP_FROM_NAME=Vaultwarden
      - SMTP_SECURITY=SECURITYMETHOD
      - SMTP_PORT=XXXX
      - SMTP_USERNAME=vaultwarden@youremaildomain.com
      - SMTP_PASSWORD=YourReallyStrongPasswordHere
      - SMTP_AUTH_MECHANISM="Mechanism"

Starting The Container

Once you’ve finished editing the docker-compose.yml file, run this command from the vaultwarden directory to both create and start the container.

docker-compose up -d

The -d flag tells docker to run the container “detached” in the background instead of running in the foreground of your terminal. Without this flag, your container would stop running as soon as you close the terminal it was launched from.

The example screenshot, below, illustrates what you can expect to see once your container is created.
Example Output - "docker-compose up -d"
Example Output
Stopping The Container

If you ever have a need to stop your Vaultwarden container, simply run this command from your vaultwarden directory:

docker-compose down

Updating The Container

The same command you used to launch and start your container can also be used to update your container. First change into the vaultwarden directory:

cd ~/docker/vaultwarden

Then run:

docker-compose up -d

TIP: To simplify the process of updating my containers, I create a bash script that navigates to each docker subdirectory on my system and runs the necessary docker-compose command.

Containers do not have to be stopped in advance in order to perform updates.
Firewall Settings

Earlier, I specified to make note of what public port we’re exposing for your container on the host system. We need to ensure that port is open in your host’s firewall. If you’re using the UFW firewall package that I previously mentioned under Prerequisites, you can open the port you’ve used with this command.

sudo ufw allow XXXX/tcp

Be sure you specify the port you’ve selected in place of XXXX.
Accessing The Web Vault

Once your container is up and running and you’ve confirmed that your reverse proxy is configured properly and your firewall port is open, accessing the web vault for the first time to create your Vaultwarden account should be as simple as entering your chosen domain into a browser. So, for example, if your domain is vault.mydomain.com, you’d use this as the URL:

https://vault.mydomain.com/

If accessing Vaultwarden this way returns an error, attempt to access the system instead using your host system’s IP and the port number you chose for Vaultwarden to confirm that it isn’t the source of your problem. For example, if your host’s IP is 192.168.1.100 and you’ve chosen port 8000 the URL would be:

http://192.168.1.100:8000

If Vaultwarden loads in this way, the problem likely resides with your reverse proxy.