群晖部署Bitwarden密码管理器全攻略

1
# 切换至 root 用户
2
# 创建目录，用于存放 vaultwarden 数据
3
mkdir -p /volume1/docker/vw-data
4

5
# 下载 docker 最新镜像
6
docker pull vaultwarden/server:latest
7

8
# 创建并运行容器（完整命令）
9
docker run -d --name bitwarden \
10
  -v /volume1/docker/vw-data:/data/ \
11
  -p 8080:80 \
12
  -p 3012:3012 \
13
  -e SIGNUPS_ALLOWED=false \
14
  -e WEBSOCKET_ENABLED=true \
15
  -e INVITATIONS_ALLOWED=false \
16
  -e ADMIN_TOKEN=随机字符串 \
17
  -e DOMAIN=https://yourdomain.com:7878 \
18
  --restart=always \
19
vaultwarden/server:latest

1
# 进入目录
2
cd /etc/nginx/sites-enabled
3

4
# 编辑文件
5
vim bitwarden.server.conf

1
server {
2
    listen 7878 default; #禁止通过IP访问
3
    server_name _;
4
    return 403;
5
}
6

7
server {
8
  # 可替换为其它可用端口，前提是已做好端口映射和防火墙开放行
9
  listen 7878 ssl http2;
10

11
  # 替换为自己的域名
12
  server_name yourdomain.com;
13

14
  ssl_certificate /usr/syno/etc/certificate/system/default/fullchain.pem;
15
  ssl_certificate_key /usr/syno/etc/certificate/system/default/privkey.pem;
16
  ssl_protocols TLSv1.2 TLSv1.3;
17
  ssl_ciphers 'TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:TLS13-AES-128-CCM-8-SHA256:TLS13-AES-128-CCM-SHA256:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AES128:EECDH+aRSA+AES128:EECDH+ECDSA+AES256:EECDH+aRSA+AES256:SSLCipherSuiteECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256;';
18
  add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; #开启HSTS
19

20
  # 非443端口强制跳转https，注意不可有其他跳转
21
  error_page 497 301 =307 https://$host:$server_port$request_uri;
22

23
  # 反向代理
24
  location / {
25
    proxy_http_version 1.1;
26
    proxy_set_header Upgrade $http_upgrade;
27
    proxy_set_header Connection $connection_upgrade;
28

29
    proxy_set_header Host $host;
30
    proxy_set_header X-Real-IP $remote_addr;
31
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
32
    proxy_set_header X-Forwarded-Proto $scheme;
33

34
    proxy_pass http://127.0.0.1:8080;
35
  }
36

37
  location /admin {
38
    proxy_http_version 1.1;
39
    proxy_set_header Upgrade $http_upgrade;
40
    proxy_set_header Connection $connection_upgrade;
41

42
    proxy_set_header Host $host;
43
    proxy_set_header X-Real-IP $remote_addr;
44
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
45
    proxy_set_header X-Forwarded-Proto $scheme;
46

47
    proxy_pass http://127.0.0.1:8080;
48
  }
49
}

1
# DSM 6.x 系统
2
synoservice --reload nginx
3

4
# DSM 7.x 系统
5
systemctl reload nginx