VaultWarden¶
Password and secret store (Bitwarden-compatible server).
| Runtime | Container (Docker Swarm), 2 containers: app, postgresql |
| Tier | Core |
| Node | swarm-core |
| Image | vaultwarden/server:1.36.0; postgres:16-alpine |
| URL | https://vault.lab.riversfamily.uk |
| Auth | Native OIDC (SSO login), registration closed |
| Source | ansible/stacks/core/vaultwarden/ |
Configuration¶
SIGNUPS_ALLOWED=false — new accounts are never self-service; add users by
other means. SSO is enabled (SSO_ENABLED=true) pointing at Authentik's
vaultwarden application (SSO_AUTHORITY, SSO_CLIENT_ID=vaultwarden,
SSO_SCOPES="email profile").
Volumes¶
| Volume | Path | Backing | Contents |
|---|---|---|---|
data |
/data |
Local | Attachments and RSA keys — never NFS |
database |
/var/lib/postgresql/data |
Local | Postgres data — never NFS |
Networking¶
vaultwarden joins both the shared traefik network (for its Traefik
route) and this stack's private internal network. postgresql joins
internal only — it is unreachable from every other stack.
Secrets¶
| Vault variable | Delivered as | Purpose |
|---|---|---|
vault_vaultwarden_admin_token |
Swarm secret (vaultwarden_admin_token) |
Admin panel token |
vault_vaultwarden_postgres_password |
Swarm secret on the postgresql container; app reads the same value inline in DATABASE_URL |
Postgres password |
vault_vaultwarden_oidc_client_secret |
Plain env var (SSO_CLIENT_SECRET) |
OIDC client secret — VaultWarden has no file-based option |
Gotchas¶
- The admin token is delivered as an argon2-hashed Swarm secret while the OIDC client secret is a plain env var — an accepted inconsistency, since VaultWarden has no file-based option for the latter.
- Registration is closed by design; there is no self-service signup flow to document for end users.