Building a Private Enterprise Password Management Architecture Using Self-Hosted Vaultwarden Clusters

要点

• Deploy with Docker. Vaultwarden has an official image that runs with minimal configuration.
• Use PostgreSQL for the database. SQLite works for small teams; PostgreSQL scales better.
• Enable HTTPS. Use a reverse proxy with Let's Encrypt for TLS termination.
• Configure SMTP. Email is needed for invitations and password recovery.
• Set up backups. Automate database dumps and test restores regularly.
• Enable admin panel. The admin panel provides user management and diagnostics.
• Restrict access. Use firewall rules and fail2ban to protect against brute force.
• Monitor health. Check the health endpoint and database connectivity.

Architecture

Vaultwarden runs as a container behind a reverse proxy. PostgreSQL stores vault data. SMTP handles email. Backups run on a schedule. The admin panel provides management. All traffic is encrypted via TLS.

Production configuration

version: '3'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: always
    environment:
      DATABASE_URL: postgresql://vw:password@db/vaultwarden
      SMTP_HOST: smtp.example.com
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_USERNAME: noreply@example.com
      SMTP_PASSWORD: change-me
      ADMIN_TOKEN: change-me-admin-token
    volumes:
      - ./vw-data:/data
    ports:
      - 8080:80
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: vaultwarden
      POSTGRES_USER: vw
      POSTGRES_PASSWORD: password
    volumes:
      - ./pg-data:/var/lib/postgresql/data

# backup database
docker exec vw-db pg_dump -U vw vaultwarden > backup.sql
# backup data volume
tar czf vw-data.tar.gz ./vw-data

# restore
docker exec -i vw-db psql -U vw vaultwarden < backup.sql
tar xzf vw-data.tar.gz

# /etc/fail2ban/jail.d/vaultwarden.conf
[vaultwarden]
enabled = true
port = 80,443
filter = vaultwarden
logpath = /var/log/vaultwarden.log
maxretry = 5
bantime = 3600

# verify
fail2ban-client status vaultwarden

Edge cases from production

• Admin token must be strong; a weak token compromises the entire vault.
• Database backups must be encrypted; vault data is sensitive.
• SMTP misconfiguration breaks invitations and recovery; test email delivery.
• Upgrades can change the database schema; back up before upgrading.

常见问题