Docker BitWarden - self hosted password manager using vaultwarden/server image

[Rusty]

Rusty submitted a new resource:

BitWarden - self hosted password manager using mprasil/bitwarden image - Quick tutorial on how to run this in docker

Considering that there are several people interested in this solution, maybe a quick tutorial on how to run this in docker will help.

Let's start.

1st thing - install Docker via Package center or if your NAS doesnt support it, install it manually by downloading the package from Syno site. After that you can use the Manual install button in Pacakge Center to install Docker. Keep in mind that this is not 100% supported and some features of docker will still not function. If your nas is from...

Read more about this resource...

 

[Telos]

Why not leave port 3012 mapped to "auto"? Do we interact with that port in anyway? Is it related to BW's email invitations?

 

[Rusty]

Why not leave port 3012 mapped to "auto"?

Sure you can leave it on auto. Personally, I don't like to do that and have all those dynamic ports set as static. When you have several containers running sure but when you have 30,40+ it gets hectic. This port is for WebSockets notifications, yes.

 

[wwwampy]

Now that you have your new BW selfhosted instance running, enjoy it and prepare to make it accessible via the internet using a valid SSL certificate, a custom domain name and revers proxy. More on that in the upcoming tutorial.

Hope all that can be done via Let's encrypt on my NAS for certificate and synology domain that I use for my DDNS

 

[wwwampy]

33MB RAM usage. Is that ok? I limit it to 50 MB according to the tutorial.

 

[Rusty]

Hope all that can be done via Let's encrypt on my NAS for certificate and synology domain that I use for my DDNS

Well, ofc it can. If you already have a LE cert and ddns domain on your NAS active, then just use the Control Panel > Application Portal > Revers proxy to configure record that will point a custom name to your docker BW installation.

Do you have a preferred url in mind?

 

[Rusty]

33MB RAM usage. Is that ok? I limit it to 50 MB according to the tutorial.

It will be fine don't worry

 

[wwwampy]

Do you have a preferred url in mind?

I already have Synology DDNS URL. Do I have to create a new one for Bitwarden?


You've lost me here:

 

[Rusty]

I already have Synology DDNS URL. Do I have to create a new one for Bitwarden?


You've lost me here:

View attachment 37

So, Source needs to be your end result url and port, and a destination is your local docker container destination.

In your case, the source will be https, url, and port (guessing 443 if you don't wanna use a custom number in the url). On the destination side it will be http, ip address of your nas and port that bw is using (the port that you have used against bw port 80).

For example, it should look like this:

 

[wwwampy]

Hm, set it up, but can't connect to my https://[name].synology.me:[myportnumber].

Should I open that port on my router?

Or should I create new synology.me name for Bitwarden?

 

[Rusty]

1st off if your are using any port (even 443) you will have to sort port forwarding, ofc. 2nd if your certificate doesn't cover any other subdomain names, then yes you will have to have a different cert.

One option would be a wild card certificate the other would be a regular cert that has multiple SAN (subject alternate names) values in it.

 

[wwwampy]

1st off if your are using any port (even 443) you will have to sort port forwarding

So I'll need to add [myportnumber] to my router port forwarding?

2nd if your certificate doesn't cover any other subdomain names, then yes you will have to have a different cert.

It covers that [name].synology.me I already have, so I guess that's ok.

 

[Rusty]

So I'll need to add [myportnumber] to my router port forwarding?

Yes, the port number you wanna use when accessing needs to be passed to your NAS

 

[wwwampy]

Ok, I set ports that I choose for BW in Docker in DSM > Router configuration and on my router (for IP I set my NAS IP).

Nothing happens. Not sure if I'm doing this right...

 

[Rusty]

The port that you will use when accessing BW from the internet needs to be forwarded to your NAS IP. On top of this, you need to configure reverse record that will use that forwarded port (added in source section) to your docker container port for bw web ui (in the destination section).

 

[wwwampy]

The port that you will use when accessing BW from the internet needs to be forwarded to your NAS IP.

I add this to my router port forwarding:

On top of this, you need to configure reverse record that will use that forwarded port (added in source section) to your docker container port for bw web ui (in the destination section).

Lost me again... Sorry, I'm still new to all this networking stuff.

 

[Rusty]

Ok forward is fine.

Now use that same port 10xx as a port in Revers proxy source port and use the BW container port in the destination one.

 

[wwwampy]

Hm, I already have this in reverse proxy rules:

It will not allow me to set another rule with my 10xx port.

 

[wwwampy]

Actually, to be exact, it loads on http, but it does not work on https for that domain.

 

[Rusty]

wait a min... you port forward 443 then not your 10xx port. If 10xx is your docker container port thats not the port you want to be open towards the internet. Just the port you want to use as your final Internet port.