Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#101

Post by MrOwen »

kivle wrote: post #98
tryfinally wrote: post #2

I've been self-hosting this for years now, works flawlessly.

I did too, and liked it until it taught me a valuable lesson about self hosting things. I started using the project while it was still called bitwarden-rs. Apparently they were told to rename by Bitwarden (understandable). My setup was based on their Docker images, and thinking it was the safest option I had set up Watchtower to automatically update to the latest image nightly to get the latest security patches. But…

I've seen watchtower burn so many people...

Better to put everything in git and run your own renovate bot which will create PRs for you to review and also pull in the changelogs to the PR itself so you can check for breaking changes.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#102

Post by gaws »

aborsy wrote: post #52

Vaultwarden is impressive. Years of work without issue. It supports Yubikey now. Eventually, I ended up using Pass though, since I prefer terminal. Pass doesn’t have any database to break: it’s just gpg and git. With Yubikey, every password needs a touch.

How do you handle password management on mobile?

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#103

Post by tvshtr »

alyandon wrote: post #79
jerf wrote: post #74

Earlier quoted context omitted.

If you care enough to run a personal Vaultwarden, you should care enough to back it up too. If you don't want to back it up, you probably shouldn't run it locally and just use the service. I'm somewhat less crazy-eyes about the importance of backing things up properly than some people on HN can get. A lot of personal content I can honestly just accept the risk of losing it. However, if there is an exception to that,…

If you care enough to run a personal Vaultwarden, you should care enough to back it up too. If you don't want to back it up, you probably shouldn't run it locally and just use the service. Exactly right. I have a script that briefly stops my Vaultwarden container and creates a .tgz of the contents of the data volume before restarting the container. The .tgz file gets copied off-site so I always have an accessible bac…

This is kinda unnecessary, each of DB has a tool which can safely backup it online.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#104

Post by OptionOfT »

kivle wrote: post #98
tryfinally wrote: post #2

I've been self-hosting this for years now, works flawlessly.

I did too, and liked it until it taught me a valuable lesson about self hosting things. I started using the project while it was still called bitwarden-rs. Apparently they were told to rename by Bitwarden (understandable). My setup was based on their Docker images, and thinking it was the safest option I had set up Watchtower to automatically update to the latest image nightly to get the latest security patches. But…

Please be careful with Watchtower. Its update functionally can not (by design) separate your ENV settings and the ones from the new container.

E.g. you deploy with DATABASE_URL=x

This becomes DATABASE_URL=x PYTHON=3.0.0

You did not set the Python one, the image did via ENV.

Now a new version comes out with PYTHON=3.1.0.

Watchtower doesn't know which ENVs you set and which ones came from the container as docker inspect exposes them in the same way.

So now Watchtower deploys the new version (which only has Python 3.1.0) with DATABASE_URL=x PYTHON=3.0.0.

And stuff stops working.

I use an ansible playbook which maintains the only ENV vars that need to survive an update.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#105

Post by OptionOfT »

MrOwen wrote: post #101
kivle wrote: post #98

Earlier quoted context omitted.

I did too, and liked it until it taught me a valuable lesson about self hosting things. I started using the project while it was still called bitwarden-rs. Apparently they were told to rename by Bitwarden (understandable). My setup was based on their Docker images, and thinking it was the safest option I had set up Watchtower to automatically update to the latest image nightly to get the latest security patches. But…

I've seen watchtower burn so many people... Better to put everything in git and run your own renovate bot which will create PRs for you to review and also pull in the changelogs to the PR itself so you can check for breaking changes.

Do you have an example online? Always interested to see different approaches.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#106

Post by miki123211 »

Is there a good argument for actually using Rust for such things?

I think Rust is a great language, but I think it shines in contexts where you'd previously have used C or C++. Web apps aren't really one of those contexts, unless they're microservices with extreme performance requirements, and this isn't the case here. Why would one choose to write something like this in Rust over easier-to-write languages like Go?

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#107

Post by super_flanker »

miki123211 wrote: post #106

Is there a good argument for actually using Rust for such things? I think Rust is a great language, but I think it shines in contexts where you'd previously have used C or C++. Web apps aren't really one of those contexts, unless they're microservices with extreme performance requirements, and this isn't the case here. Why would one choose to write something like this in Rust over easier-to-write languages like Go?

> Is there a good argument for actually using Rust for such things?

Can't speak for the author, but I'd choose Rust over Go/Java/Python for such projects for following reason:

* Rust is a more pleasant language to work with, i.e. Sum type, pattern matching, and Drop trait closing resources/cancelling tasks.

* Type system is much more robust than Go and Java, resulting in better quality code with less requirement of unit tests.

* I don't care about performance much (for personal projects), but a free performance is always a win.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#108

Post by jauntywundrkind »

moontear wrote: post #95

Since Vaultwarden is gaining traction here, also check out this VERY active PR (including custom build/image) for adding SSO via OpenID Connect: https://github.com/dani-garcia/vaultwarden/pull/3899

Year long PR, whoooaaa. And not for long gaps of inactivity either! Wild.

Seems like it's very close. The recent updates on the past couple of days sounds very positive, home-stretch & all that.

What an effort!

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#109

Post by aborsy »

gaws wrote: post #102
aborsy wrote: post #52

Vaultwarden is impressive. Years of work without issue. It supports Yubikey now. Eventually, I ended up using Pass though, since I prefer terminal. Pass doesn’t have any database to break: it’s just gpg and git. With Yubikey, every password needs a touch.

How do you handle password management on mobile?

For sharing, I use diceware passphrases (with few words quickly typed in iOS keychain). With autocomplete it’s quick.

There is a good mobile app for Pass though (I don’t use it). I try to separate the systems, and not to share as much as possible. Otherwise, Vaultwarden would quickly sync, and is reliable.

Pass with Yubikey is more secure than other password managers in my opinion: You decrypt the password for a site and other passwords are not exposed. With other password managers, the whole vault has to be decrypted.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#110

Post by Ferret7446 »

aborsy wrote: post #52

Vaultwarden is impressive. Years of work without issue. It supports Yubikey now. Eventually, I ended up using Pass though, since I prefer terminal. Pass doesn’t have any database to break: it’s just gpg and git. With Yubikey, every password needs a touch.

Bitwarden has a CLI interface btw, and be careful of phishing since that is one of the main reasons to use a password manager.
Post reply on HN