Preface
Regarding password management, I believe it is a headache for the vast majority of people, including myself in the past... For a long time, I have been using two password management systems: one is the password management provided by Google that comes with Chrome, which is for websites; the other is built into the Mac system, which is for the system itself and installed apps. Actually, this works well enough, as long as you can ignore the "password leaked" warnings that Chrome frequently prompts~~. As for password leaks, I've become numb to them—let them leak—but there's no way a lazy person like me is going to change the passwords for so many websites. At most, I started using two-factor authentication (2FA) for important websites, and because of 2FA, I actually set simpler passwords instead—as long as they are easy to remember, relying on 2FA for security... As for app passwords, when setting them, I could only use the few passwords I was used to. In fact, this is also a helpless move; it is quite difficult to set complex passwords for so many apps and websites. Chrome can automatically generate complex passwords, but the password management tool built into the Mac system doesn't have this feature... And Chrome's built-in password management tool is sometimes unreliable; the login pages of some websites won't autofill the password, forcing me to go into the browser settings to look it up myself.
After much thought, I decided to just set up my own password management system. This way, I can use a single solution to uniformly solve password management issues for both websites and system apps, automatically generate complex passwords, and reduce my management costs. After all, as I get older, my memory is not as good as it used to be. I looked into LastPass, KeePass, and bitwarden, and finally chose the open-source, self-hosted bitwarden. Since I am committed to building a home data center, I prefer to self-host whatever I can. Moreover, bitwarden supports automatic password generation, import/export functions, and is more than enough for average users. It also supports deployment across multiple system platforms via its apps:
These completely meet all my needs, so this is the one!
Deployment
Create the folder on the host machine that needs to be mapped into the bitwarden container
As usual, first create the folders required for the -v parameter mount:
mkdir -p /docker/bitwarden/dataDeploy bitwarden (Vaultwarden)
Note: The official bitwarden image on hub.docker hasn't been updated for over 2 years. Now everyone uses the Vaultwarden version, which has over 100M+ downloads:
The security should be trustworthy.
The command in docker run format is as follows:
docker run --name vaultwarden -d --restart=always \
-v /docker/bitwarden/data:/data/ \
-p 9500:80 \
vaultwarden/server:latestPublish using an available domain name
-v /docker/bitwarden/data:/data/ \
-p 9500:80 \
1、Docker Series: Building Your Own Reverse Proxy Based on NPM Using Docker
2、Linux Panel Series: Configuring Reverse Proxy and Publishing Using Non-443 Ports
3、Home Data Center Series: Getting Cloudflare for Free via Domestic ICP-Filed Cloud Hosts to Achieve Fast Access to Domestic Sites from Abroad
4、Home Data Center Series: Getting Cloudflare for Free via Home Broadband Without Public IP to Achieve Fast Website Building (Universal)
Among them, the 1st and 2nd methods are suitable for environments with a public IP but without a legal 443 port (home broadband, non-filed cloud hosts), where non-standard ports need to be added after the URL (if using Cloudflare to build a website, no port needs to be added, but you need to customize the origin server port, which you can refer to:Home Data Center Series: Solving the Problem of Having a Public IP but No Legal 80 or 443 Ports for Website Building via Cloudflare's Origin Rules). The 3rd method is suitable for cloud hosts with ICP filing, and the 4th method is suitable for all environments (including environments without a public IP), which is also my recommended method (regardless of whether your environment has a public IP, because this method does not require running HTTPS traffic directly on the public network).
vaultwarden/server:latest
Since I need to use this password management system on multiple devices (iPhone, iPad, Win, Mac), self-hosted cross-platform applications like this usually need to provide a valid, accessible external link (no need for port 80 or 443) so that all devices using the app can connect under various network environments (similar to Nextcloud). The same goes for bitwarden, so it needs to be published externally.
Initialize bitwarden
Create account and password
You should choose the publishing method that best suits you based on your actual environment and the reverse proxy you use. You can refer to several of my previous articles:
I will write an article in the future to summarize all publishing methods and link to the specific deployment articles for each method. However, I need to finish writing the relevant prerequisite articles first~ After all, there are too many knowledge points involved, and I cannot cover them all in a single article.
Assuming the final domain name is pwd.example.com, which will be used later.
Assuming you have completed the domain publishing for bitwarden according to the previous chapter, and the domain and port are bitwarden.example.com:55555, use http(s)://bitwarden.example.com:55555/admin to log in:
Set language
Since there is no account for the first login, click "Create account" in the red box at the bottom to create an account:
The fields in the red box in the image above are required. "Email address" is required and serves as the login account. "Master password" is the master password, which is the only password you need to remember. This password is extremely important, so please ensure it is complex enough and that you can remember it correctly (of course, you can also set a simple, easy-to-remember master password and set up two-step verification in "Account Settings" - "Security" to ensure safety). Finally, click "Create account" below to create the account. After creation, return to the initial login page and log in using the email you just created:
Successfully logged in:
Directly click "Account settings" in the red box at the top right of the page:
Import passwords
Select "Preferences" in the red box, choose "zh-CN" in the red box under "Language", and then click "Save":
At this point, it will lock and require you to enter your master password to unlock:
After unlocking, the page will switch to the Chinese interface.
From the "Account Settings" - "Tools" - "Import Data" interface, you can import password text exported from other applications. You can select the format of the imported text in the "File Format" dropdown in the red box:
Taking importing a CSV text exported from Chrome as an example, select the Chrome (csv) option in the red box under "File Format":
Then select the password file exported from Chrome in the red box, and click "Import Data" in the red box below:
Similarly, you can import password files exported from macOS:
Different applications have different ways of exporting passwords, so I cannot list them all here. I will just demonstrate using Chrome and macOS password exports as examples.
In Chrome, it is located in "Settings" under the Google Password Manager's "Settings", as shown in the red box below:
Install client
Chrome browser extension
Install extension
While in macOS, it is in "System Settings" - "Passwords":
Other similar applications also have places where passwords can be exported; you will need to explore this on your own.
Finally, after importing the password vaults from Chrome and macOS, all the password vaults I usually use have been imported:
Search for "bitwarden" in the Chrome Web Store and install it:
Click the newly installed extension in the browser's extension bar, and select "Self-hosted" from the dropdown menu button to the right of "Log in to" in the red box:
Fill in the previously configured domain name in the "Server URL" field on the page below. If it is an unregistered domain, just append it with :port, and then click Save in the red box at the top right:
Configure Chrome extension
Enter the email address you used when registering the account earlier, and then click Continue in the red box:
Enter the master password you set earlier, and then click "Log in with master password" in the red box:
By default, auto-fill is basically unusable and needs to be configured. Click "Settings" in the rightmost red box at the bottom right, and then select "Auto-fill" in the red box at the top:
The 2 red boxes in the image below are the settings that need to be changed:
As shown in the figure below, I have set the auto-fill shortcut to command+Q:
The default URI match detection "Base domain" cannot correctly detect when there are multiple hostnames under the same second-level domain, or when the same second-level domain has multiple different ports, so I changed it to "Host".
Security:
Here you determine how often you need to enter the master password to unlock. The default is 1 hour. I think for a personal computer, setting it to "Never" is fine to avoid hassle.
Some tips and tricks
The number at the bottom right of the extension icon indicates that the website opened in this tab has one matching item:
The built-in self-destructing "Send" can transmit text and files, and you can set expiration times, access counts, passwords, and other information:
Password generator, which allows you to specify the complexity of the password:
Send and the generator can also be used in the web version.
iOS and iPadOS clients
The installation for iOS and iPadOS is done directly from the App Store. The settings interface and steps are exactly the same as the Chrome extension, so I won't go into detail. The key point is to replace the system-level default iCloud password verification:
The settings path for both iOS and iPadOS is: "Settings" - "Passwords" - "Password Options":
If you have a two-factor authentication app, you can also select it here, such as my Authy. Once configured, Bitwarden can completely take over the default "iCloud Passwords & Keychain".
macOS client
I do not recommend this because, unlike iOS and iPadOS, even if you install Bitwarden on macOS, there is no way to select it in the password options. I personally estimate this is due to macOS permission restrictions, which makes installing the macOS client not very useful. Therefore, it is recommended to just use the Chrome extension directly on both Mac and Windows.
Afterword
Once all password management is handed over to Bitwarden, the stability of the Bitwarden application becomes the top priority. You can consider running two Bitwarden applications in different local Docker environments and setting up local hot standby (via local load balancing), or utilizing the hot standby origin server feature provided by CDNs to use the Bitwarden in your home data center and the Bitwarden on your cloud server as the primary and hot standby origins. This way, you can ensure that Bitwarden is always online (which is the method I currently use), though this approach requires considering the issue of regularly syncing the password database.
Taking Tencent Cloud as an example, the settings interface is as follows:
