8
How do I block Vaultwarden's Web UI from outside my LAN via Caddy? (feddit.org)
submitted 3 months ago by to c/homelab@selfhosted.forum
4 comments fedilink hide all child comments
 

Hi, I'm working on improving the security of my home server.
I want to use the Bitwarden app and the Chrome/Firefox extensions outside my LAN, but I don't need Web Vault at all. How do I block access to Web Vault from outside the LAN in the Caddyfile?

pass.my-domain {
    @block_webvault_outside {
        not remote_ip 192.168.1.0/24 10.8.0.0/24
        
        # What should be there?
        # path /admin* will lock only admin options
    }

    respond @block_webvault_outside 403
    reverse_proxy vaultwarden:80
}

all 4 comments

sorted by: hot top controversial new old
[–] 5 points 3 months ago

I personally don't expose services like these to the Internet directly but rather put them behind a Wireguard VPN that I stay connected to while remote to be able to access local network resources and ad-blocking without actually exposing anything in my internal network except the Wireguard port.

That doesn't work for everyone of course, but I personally would be really nervous exposing a service like Vaultwarden to the Internet without having it behind a VPN.

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 2 months ago (1 child)

    If you're deploying Vaultwarden via docker, there's an ENV to disable web vault

    WEB_VAULT_ENABLED=true

    Set to false and redeploy.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •