# Vaultwarden

Vaultwarden is a lightweight, self-hosted Bitwarden-compatible password manager server. It's compatible with all official Bitwarden clients (browser extensions, desktop apps, mobile apps).

## Dependencies

- **PostgreSQL** - Database for storing vault data
- **SMTP** - For sending verification emails and emergency access notifications

## Configuration

Key settings in `config.yaml`:

- **domain** - Where Vaultwarden will be accessible (required for client connections)
- **signupsAllowed** - Whether new users can self-register (`"true"` or `"false"`)
- **storage** - Persistent volume size for attachments and icons (default: `1Gi`)
- **smtp** - Email settings inherited from your Wild Cloud SMTP service

## First-Time Setup

1. Add and deploy the app:
   ```bash
   wild app add vaultwarden
   wild app deploy vaultwarden
   ```

2. Register your admin account by visiting the app URL and clicking **Create Account**.

3. Log in to the **admin panel** at `/admin` using the `adminToken` from your `secrets.yaml`. From here you can:
   - Disable signups so no other users can self-register
   - Invite specific users by email
   - View server diagnostics

4. Install the **Bitwarden client** (browser extension, desktop app, or mobile app), then set the server URL to your Vaultwarden domain before logging in.

## Notes

- Vaultwarden is fully compatible with the official Bitwarden clients — set your server URL in the client settings before creating an account
- The `adminToken` secret is the password for the `/admin` panel — treat it like a root password
- Set `signupsAllowed: "false"` in your config after creating your account to prevent others from registering
- Attachments and icons are stored on the persistent volume; back it up along with your PostgreSQL database
- TOTP (authenticator app) two-factor authentication works out of the box; email-based 2FA requires SMTP