Bitwarden, self hosted in Docker Swarm

Heard about the latest password breach (since lunch)? HaveYouBeenPowned yet (today)? Passwords are broken, and as the amount of sites for which you need to store credentials grows exponetially, so does the risk of using a common password.

"Duh, use a password manager", you say. Sure, but be aware that even password managers have security flaws.

OK, look smartass.. no software is perfect, and there will always be a risk of your credentials being exposed in ways you didn't intend. You can at least minimize the impact of such exposure by using a password manager to store unique credentials per-site. While 1Password is king of the commercial password manager, BitWarden is king of the open-source, self-hosted password manager.

Enter Bitwarden..

Bitwarden is a free and open source password management solution for individuals, teams, and business organizations. While Bitwarden does offer a paid / hosted version, the free version comes with the following (better than any other free password manager!):

• Access & install all Bitwarden apps
• Sync all of your devices, no limits!
• Store unlimited items in your vault
• Logins, secure notes, credit cards, & identities
• Two-step authentication (2FA)
• Secure password generator
• Self-host on your own server (optional)

Bitwarden Requirements

Preparation

Setup data locations

We'll need to create a directory to bind-mount into our container, so create /var/data/bitwarden:

mkdir /var/data/bitwarden

Setup environment

Create /var/data/config/bitwarden/bitwarden.env, and leave it empty for now.

Bitwarden Docker Swarm config

Create a docker swarm config file in docker-compose syntax (v3), something like the example below:

version: "3"
services:
  bitwarden:
    image: vaultwarden/server
    env_file: /var/data/config/bitwarden/bitwarden.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/data/bitwarden:/data/:rw
    deploy:
      labels:
        # traefik common
        - "traefik.enable=true"
        - "traefik.docker.network=traefik_public"
        # traefikv1
        - traefik.web.frontend.rule=Host:bitwarden.example.com
        - traefik.web.port=80
        - traefik.hub.frontend.rule=Host:bitwarden.example.com;Path:/notifications/hub
        - traefik.hub.port=3012

        #traefikv2
        - "traefik.http.routers.bitwarden.rule=Host(`bitwarden.example.com`)"
        - "traefik.http.services.bitwarden.loadbalancer.server.port=80"
        - "traefik.http.routers.bitwarden.service=bitwarden"
        - "traefik.http.routers.bitwarden-websocket.rule=Host(`bitwarden.example.com`) && Path(`/notifications/hub`)"
        - "traefik.http.routers.bitwarden-websocket.service=bitwarden-websocket"
        - "traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012"
    networks:
        - traefik_public

networks:
  traefik_public:
    external: true

Serving

Launch Bitwarden stack

Launch the Bitwarden stack by running docker stack deploy bitwarden -c <path -to-docker-compose.yml>

Browse to your new instance at https://YOUR-FQDN, and create a new user account and master password (Just click the Create Account button without filling in your email address or master password)

Get the apps / extensions

Once you've created your account, jump over to https://bitwarden.com/#download and download the apps for your mobile and browser, and start adding your logins!

Chef's notes 📓

Tip your waiter (sponsor) 👏

Did you receive excellent service? Want to compliment the chef? (..and support development of current and future recipes!) Sponsor me on Github / Ko-Fi / Patreon, or see the contribute page for more (free or paid) ways to say thank you! 👏

Employ your chef (engage) 🤝

Is this too much of a geeky PITA? Do you just want results, stat? I do this for a living - I'm a full-time Kubernetes contractor, providing consulting and engineering expertise to businesses needing short-term, short-notice support in the cloud-native space, including AWS/Azure/GKE, Kubernetes, CI/CD and automation.

Learn more about working with me here.

Flirt with waiter (subscribe) 💌

Want to know now when this recipe gets updated, or when future recipes are added? Subscribe to the RSS feed, or leave your email address below, and we'll keep you updated.

Your comments? 💬