r/vaultwarden

The browser extension only fills web pages, and the desktop app's Autotype only types the first match for apps tagged with apptitle:// URIs. I wanted a browser-style picker for every Windows app, so I built BwPicker.

How it works: press Ctrl+Alt+B over any login screen → a search popup shows the logins that match that app (by process name and window title, no URI tagging needed) → Enter types username + password.

• Two-step logins: type just the username or just the password (Tab / Ctrl+Enter), Shift to also submit
• Copy instead (kept out of Windows clipboard history, cleared after 30s)
• Works with bitwarden.com, bitwarden.eu and self-hosted / Vaultwarden
• Instant unlock; locks on idle, Windows lock and sleep
• Optional admin mode for launchers that run as administrator

Repo: https://github.com/capkz/bw-picker

Windows only for now.

Feedback and bug reports welcome. I'd also love for Bitwarden's official Autotype to get a picker like this.

Hey everyone,

About a year ago I posted here asking for feedback on my self-hosted Vaultwarden setup (original post). I got a lot of great replies, and many of those suggestions ended up in the setup, so thanks to everyone who took the time.

Since a few people asked last time why it's publicly exposed at all instead of being behind a VPN, there are two reasons:

1. 👨‍👩‍👧 My family and some close friends use it, and installing Tailscale or a client certificate on every device they own would be a real headache.
2. 🎓 As a cybersecurity student, it's a great way to learn: it lets me put everything I've studied so far, plus the things I've learned on my own, into one real and important project.

I've rebuilt quite a lot since then, so here's where it stands today, and I'd love your feedback again.

🏗️ Current setup

• 🌐 Exposure: a small Hetzner VPS does raw TCP passthrough (nginx stream + PROXY protocol) over WireGuard back to my OPNsense. TLS terminates at home, so the VPS only ever sees encrypted bytes, and I still get the real client IP. Cloudflare is DNS only. (Before: Cloudflare Tunnel + Zero Trust, which meant Cloudflare terminated TLS.)
• 🧱 Network: Vaultwarden runs on a Debian 13 VM in Proxmox, alone on its own VLAN. OPNsense blocks traffic to every other VLAN, and from the tunnel side only the VPS can reach the VM (80/443, plus the CrowdSec API for its bouncer). (Before: a Raspberry Pi.)
• 🛡️ Reverse proxy + WAF: BunkerWeb with TLS 1.2/1.3 (modern ciphers, post-quantum hybrid key exchange, A+ on SSL Labs), HSTS preload, security headers (A+ on securityheaders.com), country / user agent / rDNS blacklists, DNSBL and rate limiting. ModSecurity + OWASP CRS is in blocking mode at paranoia level 1 and logging at level 2. I'm still working through the Vaultwarden false positives at level 2, and I plan to move blocking to level 2 in the near future. (Before: just Caddy.)
• 🚫 CrowdSec: Vaultwarden brute force and user enumeration scenarios (tightened thresholds), plus a custom scenario that bans on ModSecurity's anomaly score. Bans are enforced twice: at the reverse proxy, and by a firewall bouncer on the VPS, so known bad IPs are dropped before they even enter the tunnel.
• 🔒 Vaultwarden itself: signups, invitations, Sends, password hints and emergency access disabled, server-side icon fetching disabled, an email on every new-device login (the login fails if it can't be sent), strict login and admin rate limits, argon2 admin token.
• 📦 Containers: rootless Podman under a dedicated user with no sudo, all capabilities dropped (only the needed ones added back), no-new-privileges, read-only root filesystem where possible, resource limits, and separate networks so each container only talks to what it needs.
• 🚪 Outbound: default deny, with two allowlists. DNS goes through Pi-hole with an allowlist: the VM running Vaultwarden can only resolve the domains on that list, anything else is blocked and I get a Discord notification. HTTP/HTTPS only goes through a Squid proxy on another VM with its own allowlist, and any attempt to reach a domain that isn't on it is blocked and notifies me too.
• 💾 Backups + maintenance: a nightly run that backs up, updates images and packages, then reboots. Backups are encrypted with age (only the public key is on the server) and signed with minisign, then replicated to TrueNAS and a Hetzner Storage Box.
• 🔧 Host: SSH key only, fail2ban, Lynis hardening (hardening index 76/100, still working on it), and debsecan to track Debian security fixes.
• 👀 Monitoring: Wazuh. To be honest, right now it's mostly a fancy forwarder to Discord: DNS denials, Squid denials, ModSecurity hits, fail2ban bans and the nightly maintenance summary each get their own channel. I'd like to use it properly, as an actual SIEM: ship the raw Vaultwarden and BunkerWeb logs, add file integrity monitoring and agent-down alerts, and correlate events instead of just forwarding them.

🔭 What I'm considering next

• 📊 Using Wazuh as a real SIEM (see above)
• 🧪 Moving ModSecurity blocking to paranoia level 2 once the exclusions are done
• 🧬 Custom seccomp profiles for the containers

📝 Some of these ideas (and a few more) are already written up in my ideas.md, others aren't even written down yet.

👉 Everything is public and documented, including a full rebuild runbook: GitHub: Homelab/Vaultwarden. The only thing kept out of the repo is the real domain (and the secrets, of course), everything else is there.

💬 I'd really appreciate your feedback again:

• What do you think of the security posture now?
• Anything that's overkill, or something I'm still overlooking?
• Any ideas, tools or improvements you'd add next?
• For those running Wazuh at home: how do you actually use it day to day as a SIEM?

Thanks again, the feedback last time taught me a lot 🙏