Compile vaultwarden (ex. bitwarden_rs) on Raspberry Pi

README.md

How to build and install vaultwarden (ex. bitwarden_rs) on Raspberry Pi

Best advise ever: make a backup before doing any operations described below

Steps

Prepare prerequisites

sudo apt-get update
sudo apt-get install -y --no-install-recommends build-essential libmariadb-dev-compat libpq-dev libssl-dev pkgconf

If you're going to compile ARMv8 binaries on RPi then install a compiler toolchain as follows

sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

Clone repository

git clone https://github.com/dani-garcia/vaultwarden
cd vaultwarden
git checkout refs/tags/1.32.7 # check for latest available version on https://github.com/dani-garcia/vaultwarden/releases
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
# press enter if asked for installation options, we are okay with the defaults

Optionally, if you're doing rust update you may need to clean up the crates cache first

cargo install cargo-cache --force
cargo cache -a

Configure build profile

Check all available targets and pick one you are going to use from the list

rustup show
rustup target list

In this example I am going to use armv7-unknown-linux-gnueabihf as the build target.

The rustup CLI tool has many targets already defined for you, and you should try to use them first. However, if something goes wrong you can always add your own target by using rustup target add ....

Test & compile

This process may take some time, be patient.

cargo test --features "sqlite,mysql,postgresql" --target=armv7-unknown-linux-gnueabihf --release # optional
cargo build --features "sqlite,mysql,postgresql" --target=armv7-unknown-linux-gnueabihf --release

Feel free to change supported storage backends according to your needs, for example:

cargo build --features "sqlite" --target=armv7-unknown-linux-gnueabihf --release # for sqlite support only

Append -j1 if your build process abruptly ends by the OOM exception.

For ARMv8 build set target to aarch64-unknown-linux-gnu

Add service user & group

sudo addgroup --system vaultwarden
sudo adduser --system --home /opt/vaultwarden --shell /usr/sbin/nologin --no-create-home --gecos 'vaultwarden' --ingroup vaultwarden --disabled-login --disabled-password vaultwarden

Copy artifacts

If you have vaultwarden service already running, stop it first (you did not forget to make a backup)

sudo systemctl stop vaultwarden.service

ls -la target/armv7-unknown-linux-gnueabihf/release/
sudo mkdir -p /opt/vaultwarden/bin
sudo mkdir -p /opt/vaultwarden/data
sudo cp target/armv7-unknown-linux-gnueabihf/release/vaultwarden /opt/vaultwarden/bin/

ARMv8 binary should be available in another folder target/aarch64-unknown-linux-gnu/release/

Download web-vault

If you have vaultwarden already running then I'd suggest to stop it and delete previous web-vault frontend installation first

sudo systemctl stop vaultwarden.service
sudo rm -rf /opt/vaultwarden/web-vault/

After that proceed with the web-vault installation

curl -fsSLO https://github.com/dani-garcia/bw_web_builds/releases/download/v2024.6.2c/bw_web_v2024.6.2c.tar.gz # check latest available version on https://github.com/dani-garcia/bw_web_builds/releases
curl -fsSLO https://github.com/dani-garcia/bw_web_builds/releases/download/v2024.6.2c/bw_web_v2024.6.2c.tar.gz.asc
gpg --verify bw_web_v2024.6.2c.tar.gz.asc bw_web_v2024.6.2c.tar.gz
sudo tar -zxf bw_web_v2024.6.2c.tar.gz -C /opt/vaultwarden/
rm -f bbw_web_v2024.6.2c.tar.gz bw_web_v2024.6.2c.tar.gz.asc

If you have vaultwarden service already in place but stopped, then try to start it again

sudo systemctl start vaultwarden.service

Create systemd configuration

Create /opt/vaultwarden/.env file

DATA_FOLDER=/opt/vaultwarden/data/
DATABASE_MAX_CONNS=10
WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault/
WEB_VAULT_ENABLED=true

Check all available settings in env.template configuration file

Click to see my configuration file

DATA_FOLDER=/opt/vaultwarden/data/
DATABASE_MAX_CONNS=10
WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault/
WEB_VAULT_ENABLED=true
ROCKET_ENV=staging
ROCKET_ADDRESS=192.168.1.200
ROCKET_PORT=8000
ROCKET_TLS={certs="/opt/vaultwarden/cert/rocket.pem",key="/opt/vaultwarden/cert/rocket-key.pem"}
ADMIN_TOKEN=eGQfXCqESvdo4BrWhkYCOO61cMKbBb1vw2YktDgk1+n05iyZ7vLgKlr6hTtVQSt7
DISABLE_ADMIN_TOKEN=false
INVITATIONS_ALLOWED=false
WEBSOCKET_ENABLED=true
WEBSOCKET_ADDRESS=192.168.1.200
WEBSOCKET_PORT=3012
IP_HEADER=none
ORG_CREATION_USERS=local@admin
DOMAIN=https://192.168.1.200:8000
SHOW_PASSWORD_HINT=false
ICON_CACHE_TTL=86400
DISABLE_ICON_DOWNLOAD=true
ICON_BLACKLIST_NON_GLOBAL_IPS=true
HIBP_API_KEY=xxx
SIGNUPS_ALLOWED=false
SMTP_HOST=smtp.gmail.com
[email protected]
SMTP_FROM_NAME=Vaultwarden
SMTP_PORT=587
SMTP_SSL=true
SMTP_EXPLICIT_TLS=true
[email protected]
SMTP_PASSWORD=xxx
SMTP_TIMEOUT=15
SMTP_AUTH_MECHANISM="Plain"
REQUIRE_DEVICE_EMAIL=false

Generate your own ADMIN_TOKEN using openssl rand -base64 48 command

Enable less-secure apps in Gmail to be able to use SMTP. Alternatively, enable 2SV and create an app password.

You may want to disable favicons

ICON_CACHE_TTL=0
DISABLE_ICON_DOWNLOAD=false

I do not recommend setting ENABLE_DB_WAL to false on sqlite3 databases, you may check active mode using:

sudo -u vaultwarden sqlite3 /opt/vaultwarden/data/db.sqlite3 'PRAGMA journal_mode'

It should return wal if Write-Ahead Logging was enabled (which is default behavior if ENABLE_DB_WAL was not set)

Set permissions

sudo chown -R vaultwarden:vaultwarden /opt/vaultwarden/
sudo chown root:root /opt/vaultwarden/bin/vaultwarden
sudo chmod +x /opt/vaultwarden/bin/vaultwarden
sudo chown -R root:root /opt/vaultwarden/web-vault/
sudo chmod +r /opt/vaultwarden/.env

Create systemd service

Run sudo nano /etc/systemd/system/vaultwarden.service to create a systemd service unit

[Unit]
Description=Vaultwarden Server
Documentation=https://github.com/dani-garcia/vaultwarden
After=network.target

[Service]
User=vaultwarden
Group=vaultwarden
EnvironmentFile=-/opt/vaultwarden/.env
ExecStart=/opt/vaultwarden/bin/vaultwarden
LimitNOFILE=65535
LimitNPROC=4096
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
DevicePolicy=closed
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictNamespaces=yes
RestrictRealtime=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
WorkingDirectory=/opt/vaultwarden
ReadWriteDirectories=/opt/vaultwarden/data
AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

Enable systemd service

sudo systemctl daemon-reload
sudo systemctl enable vaultwarden.service
sudo systemctl start vaultwarden.service
sudo systemctl status vaultwarden.service

If for some reason the service has not started or status has errors then refer to logs for more details

journalctl -xeu vaultwarden.service

Unable to register the first account

What's happening? You cannot submit web-forms over un-encrypted HTTP connections, the solution is to enable TLS.

sudo curl -fsSL https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-arm -o /usr/local/bin/mkcert
sudo chmod +x /usr/local/bin/mkcert
sudo mkcert -install
sudo update-ca-certificates
sudo mkdir /opt/vaultwarden/cert
sudo mkcert -cert-file /opt/vaultwarden/cert/rocket.pem -key-file /opt/vaultwarden/cert/rocket-key.pem example.org 1.2.3.4 # change hostname and ip to your own
sudo chown -R vaultwarden:vaultwarden /opt/vaultwarden/cert
sudo openssl verify -verbose -CAfile ~/.local/share/mkcert/rootCA.pem /opt/vaultwarden/cert/rocket.pem

Add the following line into the /opt/vaultwarden/.env file

ROCKET_TLS={certs="/opt/vaultwarden/cert/rocket.pem",key="/opt/vaultwarden/cert/rocket-key.pem"}

Restart the service

sudo systemctl restart vaultwarden.service
sudo systemctl status vaultwarden.service

A self-signed CA certificate which is created by mkcert tool should be imported into the client's operating system trust store

sudo mkcert -CAROOT

Pi 4b is 64bit armv8

Pi 4b is 64bit armv8

CPU yes, OS no, if you don't mind to share profile I'll update the instructions

Pi 4b is 64bit armv8

CPU yes, OS no, if you don't mind to share profile I'll update the instructions

Thanks I have it all setup now. My OS is arm64 I'm using Ubuntu Server 20.04, maybe Raspbian is still 32bit?

Pi 4b is 64bit armv8

CPU yes, OS no, if you don't mind to share profile I'll update the instructions

Thanks I have it all setup now. My OS is arm64 I'm using Ubuntu Server 20.04, maybe Raspbian is still 32bit?

Yes Raspbian is still 32bit but I think they're moving to 64bit now

Hi, thanks for sharing! I followed your steup, it works now but one issue:

Although I have added LOG_FILE=/opt/vaultwarden/vaultwarden.log to /opt/vaultwarden/.env , it doesn't create log file in the path while running. And journalctl -u vaultwarden.service command could print the log.

Could you please try to set the LOG_FILE environment variable and view that file?

@imjoeyli you're describing the effect of the security tightened systemd settings on the application itself, it is not actually a bug, you can introduce an anti-pattern and store the log file under the R/W "/opt/vaultwarden/data" folder, cheers

@imjoeyli you're describing the effect of the security tightened systemd settings on the application itself, it is not actually a bug, you can introduce an anti-pattern and store the log file under the R/W "/opt/vaultwarden/data" folder, cheers

Thanks! I have set LOG_FILE=/opt/vaultwarden/data/vaultwarden.log and it works now!