Since the free version of LastPass gets a device limit from the middle of March, I wanted to move away from LastPass sooner rather than later, so I looked into whether there was any open source password manager out there, and Bitwarden looked good, so — as always — I tried self-hosting it with Docker.
What I do for the work is almost the same as the article below ↓
Bitwarden
Here is the official site.
If you are not going to self-host, it is easier to create an account and use that
Preparation
- Having a server with a Docker environment already in place (docker-compose)
- Being able to configure DNS for your own domain
- Having an SMTP server for sending mail (Gmail can be used)
docker-compose
In my environment the nginx-proxy and Let’s Encrypt containers are already running all the time, so the docker-compose.yml for bitwarden ends up looking like the following.
As of May 2021, bitwardenrs has been deprecated and has changed to vaultwarden
I based this almost entirely on the GitHub repository below, but for some reason the .env file could not be read, so I wrote its contents directly into docker-compose.yml
Starting it up
Once the docker-compose build has succeeded without trouble and the Let’s Encrypt certificate has been obtained, access the site you configured on your own domain
If a screen like the one below appears, you have succeeded. Congratulations!Never mind the "copy as markdown" text, it slipped into the screenshot by accident
From here you can enter an email address and a master password and create an account, and you can start using it right away.
Migrating from LastPass
Log in to LastPass in advance and export your data
Then, after logging in to Bitwarden, all you have to do is import it from the tools in the LastPass (csv) format
Security
For the environment variables, the following is a good reference
- After creating your account, if you do not need to create any more accounts, set the following to false
SIGNUPS_ALLOWED=falseINVITATIONS_ALLOWED=false - If you write an Admin Token, the admin management mode becomes available at https://yourhost/admin and detailed settings become possible
- Put htpasswd authentication in front of it with nginx-proxy
- Stop the services you do not need
Going LDAP
When it is used by a large number of people, for example at work, it seems that accounts can be authenticated against LDAP, but this time it is only for me and my family, so I have not set it up — this is just for reference.
While using an online service brings the worry that it will be changed for the worse, that the service will shut down, or that data will leak, with self-hosting the password management can end up neglected depending entirely on how well you manage it yourself, so there are pros and cons either way.