mates
444191d16d
- docker-services: 14 generic compose templates (portainer, npm, vaultwarden, gitea, jotty, nextcloud-aio, rustdesk, audiobookshelf, calibre-web, plex, erugo, jswiki, speedtest, watchtower) - install-scripts: bash scripts for Ubuntu server bootstrap, docker, portainer, npm, backup, restore - ansible: 4 playbooks (bootstrap, deploy-services, update-services, security-hardening) + roles skeleton - hermes-install: Hermes CLI setup on macOS - macos-setup: Brewfile + osx-defaults + fish-config - home-nas-tools: metadata index for NAS projects (no binaries) - docs: architecture, security, contributing - README, LICENSE (MIT), .gitignore
80 lines
1.8 KiB
Markdown
80 lines
1.8 KiB
Markdown
# Vaultwarden – self-hosted správce hesel
|
||
|
||
> Kompatibilní s Bitwarden klienty. Open-source, lehký (Rust).
|
||
|
||
## 📋 Přehled
|
||
|
||
- **Image:** `vaultwarden/server:latest`
|
||
- **Porty:** `2999` (HTTP), `3012` (WebSocket, interní)
|
||
- **User:** `1000:1000`
|
||
- **Network:** `bridge`
|
||
|
||
## 🚀 Instalace
|
||
|
||
```bash
|
||
cp .env.example .env
|
||
nano .env # nastavit DOMAIN, ROCKET_PORT, hesla
|
||
|
||
docker compose up -d
|
||
```
|
||
|
||
## 🌐 Přístup
|
||
|
||
- **Web vault:** `http://<server>:2999` (za HTTPS terminuj v NPM)
|
||
- **Bitwarden app:** stejná URL jako vault
|
||
- **Doporučení:** terminuj HTTPS přes NPM a nepoužívej HTTP přímo
|
||
|
||
## 🔐 Bezpečnost
|
||
|
||
- **DOMAIN** musí být `https://vault.example.com` (ne `http`)
|
||
- **SIGNUPS_ALLOWED=false** po registraci admin účtu
|
||
- **INVITATIONS_ALLOWED=false** pokud nechceš zvát další
|
||
- **SHOW_PASSWORD_HINT=false** (odhalování hesel)
|
||
- **DATABASE_URL** – zálohuj SQLite pravidelně
|
||
|
||
## 🔑 Záloha
|
||
|
||
```bash
|
||
# Zastavit kontejner
|
||
docker compose stop
|
||
|
||
# Zazálohovat SQLite DB
|
||
cp ./data/db.sqlite3 /backup/vaultwarden-$(date +%Y%m%d).sqlite3
|
||
|
||
# Restart
|
||
docker compose start
|
||
```
|
||
|
||
## 👥 Organizace
|
||
|
||
- **1 user** (ty) – self-hosted
|
||
- **2FA** – povinně aktivuj po registraci
|
||
- **FIDO2/WebAuthn** – podpora hardwarových klíčů (YubiKey)
|
||
- **Organizace** – pro sdílení hesel s rodinou
|
||
|
||
## 📁 Volumes
|
||
|
||
| Mount | Účel |
|
||
|---|---|
|
||
| `./data:/data` | SQLite DB, attachmenty, ikony, config |
|
||
|
||
## 📚 Klienti
|
||
|
||
- **Mobil:** Bitwarden (iOS/Android)
|
||
- **Desktop:** Bitwarden (Win/Mac/Linux)
|
||
- **Browser:** Bitwarden extension (Chrome/Firefox/Edge)
|
||
- **CLI:** `rbw` (Rust) nebo `bitwarden-cli`
|
||
|
||
## 🔄 Aktualizace
|
||
|
||
```bash
|
||
docker compose pull
|
||
docker compose up -d
|
||
# DB migrace probíhá automaticky
|
||
```
|
||
|
||
## 📚 Dokumentace
|
||
|
||
- [Vaultwarden Wiki](https://github.com/dani-garcia/vaultwarden/wiki)
|
||
- [Bitwarden klienti](https://bitwarden.com/download/)
|