A good way to backup Vaultwarden for EXTREME recovery (like having a brand new laptop on travel) ?
Hello, I'm asking for your help, my homelab growthed a lot, and I now use Vaultwarden as my password manager. Before that I was using a Keepass synced like that : Windows (or Linux) < - > homelab < - > Android phone but I've had a lot of conflict because…
Hello, I'm asking for your help, my homelab growthed a lot, and I now use Vaultwarden as my password manager. Before that I was using a Keepass synced like that : Windows (or Linux) < - > homelab < - > Android phone but I've had a lot of conflict because sometimes syncthing didn't sync etc... Now, with Vaultwarden accessible only via VPN I'm free of all thoses problems. But, I'm a bit paranoid, and when it comes to backup, and moreover backup of my PASSWORD, Passkeys, SSH keys, passphrases etc.. I need to be reassure. Context of my vaultwarden : - /data of Vaultwarden is inside a folder that we will call /srv/vaultwarden that is on an nvme ssd of my homelab. - I created a script that backup the db of Vaultwarden inside /sync/backup that is on a 4 To WD red HDD. For the moment, my strategy for backuping my Vaultwarden is : - 2 times a day : backup db to /sync/backup - Every nights : backup to : 1 SSD, 1 VPS I rent, 1 Cloud (Kdrive) /sync and /srv - 2 times a week : backup to 1 old USB HDD /sync and /srv All the backup are encrypted using backrest (gui for restic), so repos are not visible. But, since I'm a bit paranoid, I imagined something, what happen if I travel with my phone and the VPN, and I loose my phone ? How can I access back my passwords and eventually my SSH keys, wireguard rescue, and so my paperless access for like my papers (passport eventually) etc.. From NOTHING ? So what I though, was, maybe the solution is to find a way to automatically export vaultwarden datas (including passkeys and files) into a .kdbx files that I will push automatically unencrypted into a cloud with a password without 2FA that I will know ? But first of all I didn't found a project that can backup vaultwarden complete, and the 2nd thing is that I don't know if it's not a bit unsecure to do that. So, I'm asking for your help, what do you think of that ? How would you deal with that ? Thanks you ! (ps : sorry english is not my default language)
Collected discussion
Expand the replies to this comment to learn how AI was used in this post/project.
I didn't expose my vaultwarden, so it's only accessible through a wireguard connection
Not a bad idea, I should have encrypted vault export + encryption key ? But it wouldn't let me have the files inside so my entry with my wireguard rescue is not accessible, so no access to paperless -> no passport
Thanks you for the reminder, not tested my db export, but already tested the restore with backrest. I need to planify that. The script I use, use "docker exec vaultwarden /vaultwarden backup" command
Thanks you, no laptop, when I travel I have my wallet and my phone only. I'm not sure about encrypted JSON export, it didn't contain my passkeys and files (like rescue wg conf ? Maybe I should just put it inside a note of an entry, not the full file ?) So in the scenario I talk i'm asking myself what happen if I loose all my stuff, like I'm naked somewhere and end up in a cybercoffee but my homelab works ?
I really like the idea ! Thanks you
Maybe you could carry a little sd card with a extra WireGuard conf file just in case you lose everything Then you can use that to access your vaultwarden and you’re basically back in.
When you export you enter a password. I use one I can repeat from memory. The security offered by encryption is against direct physical access, which is something you would hopefully have control over.
I believe the encrypted JSON should contain your passkeys, but passkeys aren’t particularly useful in the scenario you’re proposing, since you have no device on which to load them anyway. So in the scenario I talk i'm asking myself what happen if I loose all my stuff, like I'm naked somewhere and end up in a cybercoffee but my homelab works ? Best solution is you call someone at home who has access to this stuff (or you can walk them through it). Buy a new device, load up what you need manually while they dictate your passwords and keys over the phone, then go from there. If that’s not possible, then it would be a good idea to get a second device (another phone, tablet, laptop) that has your encrypted Bitwarden export on it and you leave it secured in your hotel room.
You can use the bitwarden CLI to export your vault in JSON format, encrypted or not, so you aren't dependent on a working backend infrastructure to access your passwords in an emergency. Everyone using a password manager should be doing this anyway, self-hosted or not. As for losing your phone while abroad, would you have a laptop with you? Are you assuming that's lost as well? Do you have a person back at home you can call? There are a lot of different options depending on the scenario and your circumstances.
You're stopping the container when backing up your db, yes? Have you tested your back up to make sure it works? Spin up a test container using the backup data to make sure it works
On my setup, i did a script that run everyweek and it sends an encrypted backup to an email adress i have access to without vaultwarden
Print an encrypted vault export.
I just wrote my own script that uses rsync under the hood
one thing worth flagging: the bitwarden CLI json export isnt full fidelity, it drops file attachments and historically hasnt carried passkeys, so if those matter to you test an actual restore before you trust it. for the brand-new-device-on-travel case id keep an encrypted export you can open with the desktop app offline, rather than relying on the raw /data folder that needs the whole server back up first.
Vaultwarden stores its secrets, and data in general, inside the database. So I just backup the postgres database. And have ansible tasks that can restore said database if I have to rebuild things from scratch.
I have a VPS that I can use to SSH into my homelab, normally the web console is disabled but I can enable it to regain full control.
You missed this? https://github.com/Bruceforce/vaultwarden-backup
I keep a json export of my vault on my laptop and on my phone in case of an emergency. I have other disaster recovery things In place, my vault is backed up locally to 2 places and it also backs up to an s3 provider. So even if my house burns down I still have access to the vault. Only issue is getting into my backblaze account requires credentials… which I store in my vaultwarden. So if my house burns down with my phone and my laptop inside then I’m probably screwed? Idk. Might write that login down somewhere.
This comment was deleted.