Archive / Self-Hosted Services

Vaultwarden Setup

Billville reference page for the self-hosted Vaultwarden setup on the Synology NAS: domain, reverse proxy, Docker container, DNS, certificate, and backup notes.

Open Vaultwarden →

Access

Domain & Server

Domain: https://vault.netflygraphics.com
Local Server: 192.168.50.100 — Synology NAS
Web Access: https://vault.netflygraphics.com
Bitwarden Apps: Server URL: https://vault.netflygraphics.com

Docker

Container

Name: vaultwarden
Image: vaultwarden/server:latest
Internal Port: 80
Exposed Ports: 5151 → HTTP
3012 → WebSocket
Volume Mapping: /volume1/docker/vaultwarden → /data

Synology

Reverse Proxy

Source: Protocol: HTTPS
Hostname: vault.netflygraphics.com
Port: 443
Destination: Protocol: HTTP
Hostname: localhost
Port: 5151
Certificate: Let’s Encrypt certificate for vault.netflygraphics.com, assigned in Synology Control Panel.

Network

DNS & Router

Cloudflare DNS: Type: A
Name: vault
Points to public IP
Proxy: DNS only / gray cloud
Router Port Forwarding: External Port: 443
Internal IP: 192.168.50.100
Internal Port: 443

Notes

Important Reminders

Vaultwarden requires HTTPS. HTTP access will fail or behave badly.
The master password cannot be recovered.
Back up the vault regularly using JSON export.
Avoid using the Cloudflare proxy unless websockets are configured properly.

Future

Optional Improvements

Enable 2FA.
Restrict admin panel access.
Consider Tailscale for private access instead of exposing port 443 publicly.
Document the exact backup/export routine.

Security rule: do not store passwords, recovery codes, API keys, or admin tokens in Billville pages. Keep secret values inside Vaultwarden only.