Until Vaultwarden, I was never comfortable storing passwords anywhere else. Even worse, I used to use variations of the same password, because I am only human and can only remember so much.
Only after Vaultwarden, did I confidently begin storing passwords and used absolutely random characters and absolutely random passwords.
To those saying self hosting BitWarden/Vaultwarden is not a security feature, do you have tips as to improve the security hardening of Vaultwarden?
Things, I could think of
Disabling the admin token.
Preventing WAN access. (To be done on the router)
Setup Reverse proxy with fail2ban.
For WAN access, consider something like tailscale.
I meant preventing remote access to the router management page itself. And also stop port forwarding vaultwarden or anything else. Both of these hold water only if your ISP provides dynamic IP instead of CGNAT IP. Sometimes having a CGNAT IP is a blessing. (case in point)
With cloudflare tunnels, is your vaultwarden exposed to the public internet directly? Doesnât that open it to brute force attacks (if you havenât used fail2ban)