Building a Private Enterprise Password Management Architecture Using Self-Hosted Vaultwarden Clusters

Pontos principais

1. Deploy with Docker. Vaultwarden has an official image that runs with minimal configuration.
2. Use PostgreSQL for the database. SQLite works for small teams; PostgreSQL scales better.
3. Enable HTTPS. Use a reverse proxy with Let's Encrypt for TLS termination.
4. Configure SMTP. Email is needed for invitations and password recovery.
5. Set up backups. Automate database dumps and test restores regularly.
6. Enable admin panel. The admin panel provides user management and diagnostics.
7. Restrict access. Use firewall rules and fail2ban to protect against brute force.
8. Monitor health. Check the health endpoint and database connectivity.

Architecture

Vaultwarden runs as a container behind a reverse proxy. PostgreSQL stores vault data. SMTP handles email. Backups run on a schedule. The admin panel provides management. All traffic is encrypted via TLS.

Production configuration

version: '3'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: always
    environment:
      DATABASE_URL: postgresql://vw:password@db/vaultwarden
      SMTP_HOST: smtp.example.com
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_USERNAME: noreply@example.com
      SMTP_PASSWORD: change-me
      ADMIN_TOKEN: change-me-admin-token
    volumes:
      - ./vw-data:/data
    ports:
      - 8080:80
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: vaultwarden
      POSTGRES_USER: vw
      POSTGRES_PASSWORD: password
    volumes:
      - ./pg-data:/var/lib/postgresql/data

# backup database
docker exec vw-db pg_dump -U vw vaultwarden > backup.sql
# backup data volume
tar czf vw-data.tar.gz ./vw-data

# restore
docker exec -i vw-db psql -U vw vaultwarden < backup.sql
tar xzf vw-data.tar.gz

# /etc/fail2ban/jail.d/vaultwarden.conf
[vaultwarden]
enabled = true
port = 80,443
filter = vaultwarden
logpath = /var/log/vaultwarden.log
maxretry = 5
bantime = 3600

# verify
fail2ban-client status vaultwarden

Edge cases from production

• Admin token must be strong; a weak token compromises the entire vault.
• Database backups must be encrypted; vault data is sensitive.
• SMTP misconfiguration breaks invitations and recovery; test email delivery.
• Upgrades can change the database schema; back up before upgrading.

Perguntas frequentes