Self-hosting Bitwarden / VaultWarden on FreeBSD

The time has come for me to consider another application for my TOTP data (think 6-digit codes produced by Google Authenticator or an RSA device. I’ve been using an app called 2STP – I have long liked it. Support for it ended about 7 years ago, yet it continued to slug along on my phone and on my watch.

Recently, it stopped working on my watch. That was the tipping point.

I decided to move to BitWarden. I’ll use BitWarden apps on my phone and watch, and use VaultWarden for the storage engine. VaultWarden is a “Bitwarden server API implementation written in Rust compatible with upstream Bitwarden clients”.

In this post:

• FreeBSD 14.1
• vaultwarden 1.32.0_2
• BitWarden 2024.7.1 (8086)

I also referred to a blog post by Ben Lavery-Griffiths.

Installing

I created a new jail dedicated to this task. Those steps are outside the scope of this post.

• The main docs: https://github.com/dani-garcia/vaultwarden/
• The main wiki: https://github.com/dani-garcia/vaultwarden/wiki
• The FreeBSD doc: https://github.com/dani-garcia/vaultwarden/wiki/Third-party-packages#freebsd

When installing, I did the following

pkg install vaultwarden
cp /usr/local/etc/rc.conf.d/vaultwarden.sample /usr/local/etc/rc.conf.d/vaultwarden

/usr/local/etc/rc.conf.d/vaultwarden contains configuration settings for vaultwarden – I’m not sure how this works. It doesn’t seems to be the traditional rc.conf settings I expect to see. However, it does work. Really, all it’s doing is setting a bunch of environment variables. I suspect that’s what VaultWarden is expecting.

Things I changed in that file:

-ROCKET_ADDRESS=127.0.0.1
+ROCKET_ADDRESS=127.0.0.81

This was in a jail and I wanted something other than 127.0.0.1

Without the following, I could not create a new account.

-SIGNUPS_ALLOWED='false'
+SIGNUPS_ALLOWED='true'

I changed it back later.

I don’t run an smtp service here (it’s dma only), so I supplied values for SMTP_HOST & SMTP_FROM

I also set DOMAIN to the hostname I’m using for my service.

Starting

Here is the start:

[root@bw:~] $ service vaultwarden enable
vaultwarden enabled in /etc/rc.conf
[root@bw:~] $ service vaultwarden start
Starting vaultwarden.

From /var/log/daemon.log:

Sep 29 21:07:30 bw vaultwarden[84275]: [2024-09-29 21:07:30.121][rocket::server][WARN] Received SIGTERM. Requesting shutdown.
Sep 29 21:07:30 bw vaultwarden[84275]: [2024-09-29 21:07:30.122][vaultwarden][INFO] Vaultwarden process exited!
Sep 29 21:07:30 bw vaultwarden[3529]: /--------------------------------------------------------------------\
Sep 29 21:07:30 bw vaultwarden[3529]: |                        Starting Vaultwarden                        |
Sep 29 21:07:30 bw vaultwarden[3529]: |--------------------------------------------------------------------|
Sep 29 21:07:30 bw vaultwarden[3529]: | This is an *unofficial* Bitwarden implementation, DO NOT use the   |
Sep 29 21:07:30 bw vaultwarden[3529]: | official channels to report bugs/features, regardless of client.   |
Sep 29 21:07:30 bw vaultwarden[3529]: | Send usage/configuration questions or feature requests to:         |
Sep 29 21:07:30 bw vaultwarden[3529]: |   https://github.com/dani-garcia/vaultwarden/discussions or        |
Sep 29 21:07:30 bw vaultwarden[3529]: |   https://vaultwarden.discourse.group/                             |
Sep 29 21:07:30 bw vaultwarden[3529]: | Report suspected bugs/issues in the software itself at:            |
Sep 29 21:07:30 bw vaultwarden[3529]: |   https://github.com/dani-garcia/vaultwarden/issues/new            |
Sep 29 21:07:30 bw vaultwarden[3529]: \--------------------------------------------------------------------/
Sep 29 21:07:30 bw vaultwarden[3529]: 
Sep 29 21:07:30 bw vaultwarden[3529]: [DEPRECATED]: `SMTP_SSL` or `SMTP_EXPLICIT_TLS` is set. Please use `SMTP_SECURITY` instead.
Sep 29 21:07:30 bw vaultwarden[3529]: [2024-09-29 21:07:30.258][start][INFO] Rocket has launched from http://127.0.0.81:4567

Note the expect IP address there.

This is what is looks like:

[root@bw:~] $ ps auwwx
USER   PID %CPU %MEM    VSZ   RSS TT  STAT STARTED    TIME COMMAND
www  39535 66.8  0.0 364276 38096  -  SJ   19:52   0:01.31 /usr/local/bin/vaultwarden
root 26703  0.0  0.0  12876  2728  -  SsJ  19:29   0:00.01 /usr/sbin/syslogd -s
root 26746  0.0  0.0  12916  2500  -  IsJ  19:29   0:00.01 /usr/sbin/cron -s
www  39534  0.0  0.0  12828  2300  -  SsJ  19:52   0:00.00 daemon: /usr/local/bin/vaultwarden[39535] (daemon)
root 26759  0.0  0.0  13376  3232  2  IJ   19:29   0:00.02 /bin/sh -i
root 38654  0.0  0.0  14840  4416  2  IJ   19:51   0:00.02 zsh
root 38766  0.0  0.0  14356  4272  2  SJ   19:51   0:00.02 bash
root 39543  0.0  0.0  13452  2976  2  R+J  19:52   0:00.00 ps auwwx
[root@bw:~] $ 

TLS? Who wants TLS?

The docs recommend a reverse proxy to implement TLS. Here we go:

pkg install nginx

This is my nginx configuration:

    server {
        listen 80;
        server_name mine.example.com;
        return 301 https://$server_name$request_uri;
    }

    server {
        listen 443 ssl;
	http2 on;

        ssl_certificate     /usr/local/etc/ssl/mine.example.com.cer;
        ssl_certificate_key /usr/local/etc/ssl/mine.example.com.key;

	server_name mine.example.com;

	location / {
		proxy_pass http://127.0.0.81:4567;
	}

	access_log /var/log/nginx/mine.example.com-access.log;
	error_log  /var/log/nginx/mine.example.com-error.log;
    }

There’s that same IP address and port number again. Look for yours in the logs.

Once nginx was running, Here’s what was listening:

[root@bw:~] $ sockstat -4
USER     COMMAND    PID   FD  PROTO  LOCAL ADDRESS         FOREIGN ADDRESS      
www      nginx      84281 8   tcp4   *:80                  *:*
www      nginx      84281 9   tcp4   *:443                 *:*
www      nginx      84281 12  tcp4   203.0.113.231:443     203.0.113.82:60294
root     nginx      84280 8   tcp4   *:80                  *:*
root     nginx      84280 9   tcp4   *:443                 *:*
www      vaultwarde 84276 34  tcp4   127.0.0.81:4567       *:*
root     syslogd    84242 5   udp4   *:514                 *:*

Here’s some of the stuff I saw in the logs, nothing relevant here, just showing.

[root@bw:/var/log] $ tail -F /var/log/daemon.log 
Sep 29 21:06:16 bw vaultwarden[84275]: [2024-09-29 21:06:16.563][request][INFO] POST /identity/accounts/register
Sep 29 21:06:16 bw vaultwarden[84275]: [2024-09-29 21:06:16.564][vaultwarden::api::core::accounts][ERROR] Registration not allowed or user already exists
Sep 29 21:06:16 bw vaultwarden[84275]: [2024-09-29 21:06:16.564][response][INFO] (identity_register) POST /identity/accounts/register => 400 Bad Request

The rest of the signup

After browsing to https:///mine.example.com, I created myself an account, and it all just worked.

In my BitWarden app, I signed in by pointing to a self hosted install, using the same URL. It also just worked.

The data to backup

The data I think I need to backup:

[root@bw:/usr/local/www/vaultwarden/data] $ ls -l
total 172
drwxr-xr-x  2 www www      2 Sep 29 19:52 attachments
-rw-r--r--  1 www www 335872 Oct  1 00:26 db.sqlite3
-rw-r--r--  1 www www  32768 Oct  1 00:26 db.sqlite3-shm
-rw-r--r--  1 www www      0 Oct  1 00:26 db.sqlite3-wal
drwxr-xr-x  2 www www      2 Sep 29 19:52 icon_cache
-rw-r--r--  1 www www   1675 Sep 29 19:52 rsa_key.pem
drwxr-xr-x  2 www www      2 Sep 29 19:52 sends
drwxr-xr-x  2 www www      2 Sep 29 19:52 tmp

I’m sure the main stuff to backup is the db.* files. Yet, I’m sure it should all be backed up. It’s about 88K – easily accommodated. See the backup docs.

I have yet to do this, and I’m relying on my jail-based backups. Oh. I see I have to implement those backups on that host.

Things to fix up

Everything logs to both /var/log/daemon.log and /var/log/messages – this is hardcoded in the rc.d script. I’d prefer that to be removed and configurable via /etc/rc.conf settings

Copying data

For copying data out of 2STP, I used https://github.com/ewdurbin/evacuate_2stp

Future use

I need to decide if I’m going to continue using this implementation or switch to letting BitWarden host my 88K of data.

Is it worth the effort required to maintain etc?

I still plan to sign up with BitWarden and give them money, regardless.