Vaultwarden 部署指南：在 VPS 上用 Docker 自托管密码管理器，替代 Bitwarden 的轻量级方案

# 安装 Docker
curl -fsSL https://get.docker.com | sh

# 设置 Docker 开机自启
sudo systemctl enable docker
sudo systemctl start docker

# 安装 Docker Compose 插件
sudo apt-get install docker-compose-plugin -y

# 验证安装
docker --version && docker compose version

# 创建 Vaultwarden 目录
mkdir -p ~/vaultwarden
cd ~/vaultwarden

# 创建数据持久化目录
mkdir -p ./data ./nginx/conf.d

version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./data:/data
    environment:
      # 域名配置（重要！）
      - DOMAIN=https://vault.yourdomain.com
      # 管理员面板密码（首次登录后立即修改）
      - ADMIN_TOKEN=your-strong-admin-token-here
      # 注册开放设置（部署后建议关闭）
      - SIGNUPS_ALLOWED=true
      # 邀请功能
      - INVITATIONS_ALLOWED=true
      # 日志级别
      - LOG_LEVEL=warn
      # 数据推送间隔（秒）
      - PUSH_INTERVAL=60
      # 禁用新版本检查
      - DISABLE_ADMIN_TOKEN=false
    ports:
      - "127.0.0.1:8080:80"
    networks:
      - vaultwarden_network

  nginx:
    image: nginx:alpine
    container_name: vaultwarden-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./nginx/ssl:/etc/nginx/ssl
      - ./data:/data:ro
    depends_on:
      - vaultwarden
    networks:
      - vaultwarden_network

networks:
  vaultwarden_network:
    driver: bridge

server {
    listen 80;
    server_name vault.yourdomain.com;
    
    # Let's Encrypt 验证路径
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name vault.yourdomain.com;

    # SSL 证书（稍后使用 Certbot 生成）
    ssl_certificate /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # WebSocket 支持（Vaultwarden 需要）
    location /notifications/hub {
        proxy_pass http://vaultwarden:80;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub/negotiate {
        proxy_pass http://vaultwarden:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        proxy_pass http://vaultwarden:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 大文件上传支持（附件导入）
        client_max_body_size 128M;
    }
}

# 安装 Certbot
sudo apt-get install certbot -y

# 申请证书（先确保域名已指向服务器 IP）
sudo certbot certonly --standalone -d vault.yourdomain.com

# 复制证书到 Nginx SSL 目录
sudo mkdir -p ~/vaultwarden/nginx/ssl
sudo cp /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem ~/vaultwarden/nginx/ssl/
sudo cp /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem ~/vaultwarden/nginx/ssl/
sudo chown -R $USER:$USER ~/vaultwarden/nginx/ssl

cd ~/vaultwarden
docker compose up -d

# 查看服务状态
docker compose ps

# 查看日志
docker compose logs -f vaultwarden

# 将 CSV 文件上传到 Vaultwarden 数据目录
scp ~/Downloads/firefox_passwords.csv user@your-vps:~/vaultwarden/data/

# 通过 Vaultwarden Web UI 导入
# 点击右上角头像 → 工具 → 导入数据 → 选择对应格式

#!/bin/bash
# ~/vaultwarden/backup.sh - 每日备份脚本

BACKUP_DIR=~/vaultwarden/backups
DATE=$(date +%Y%m%d_%H%M%S)
DB_FILE=~/vaultwarden/data/db.sqlite3

mkdir -p $BACKUP_DIR

# 停止容器确保数据一致性
docker stop vaultwarden

# 备份数据库和附件
tar czf $BACKUP_DIR/vaultwarden-backup-$DATE.tar.gz \
  -C ~/vaultwarden data/

# 重新启动
docker start vaultwarden

# 保留最近 30 天备份，删除更早的
find $BACKUP_DIR -name "vaultwarden-backup-*.tar.gz" -mtime +30 -delete

echo "Backup completed: vaultwarden-backup-$DATE.tar.gz"

chmod +x ~/vaultwarden/backup.sh
crontab -e
# 添加以下行（每天凌晨 2 点执行）
0 2 * * * ~/vaultwarden/backup.sh

docker stop vaultwarden
# 编辑 docker-compose.yml 修改 ADMIN_TOKEN
docker compose up -d vaultwarden

cd ~/vaultwarden
docker compose pull vaultwarden
docker compose up -d vaultwarden
# 确认新版本
docker compose logs vaultwarden | grep "Version"