Self-Hosting & Automation
Self-Hosted Vaultwarden (Password Manager)
Built & Deployed2026
Self-hosted, Bitwarden-compatible
Enforced HTTPS behind a trusted cert
Hardened: least-privilege, restricted signup, admin protected
Passwords are the highest-value credential an attacker wants. This project is a self-hosted, Bitwarden-compatible password manager — and a demonstration of security-first ops.
What I did
- Deployed Vaultwarden in Docker on the LAN with TLS enforced (clients refuse plain HTTP and untrusted certs).
- Issued a trusted certificate via a private local CA — the right pattern for LAN-only services with no public domain.
- Hardened it: signups disabled after account creation, admin endpoint protected by a token, and a least-privilege container that keeps only the capabilities it needs to bind port 443.
Why it matters
- Full control and ownership of credentials — no third-party sync, no vendor lock-in.
- Demonstrates real security engineering: matching least-privilege to actual file ownership, TLS enforcement, and CA/key management.
Outcomes
- Deployed a working self-hosted password manager with secure HTTPS transport enforced.
- Hardened configuration: signup disabled after account creation, protected admin endpoint, least-privilege container settings.
- Used a private local CA pattern to issue trusted certificates for LAN-only services with no public domain.
Stack & tools
VaultwardenDocker ComposeRocket TLSPrivate local CALinux