How to configure SMTP mail in Vaultwarden

How do I configure SMTP email in Vaultwarden? I'm sure it's happened to you: you try to create a secure password and the system asks you to include everything from a Cyrillic character to your pet's name in Morse code. It's a real nightmare that leads us to make the mistake of using the same password for everything or relying on a paper notebook that, if lost, leaves our digital life completely exposed. To avoid this headache, the ideal solution is to switch to a... password managera kind of digital safe where you only need to remember one master key to access the rest.

If you're someone who doesn't trust leaving your data in a large company's cloud and prefers to have total control, the self-hosting or self-hosting This is the way. This is where Vaultwarden comes in, a lightweight and optimized version, written in Rust, that is fully compatible with Bitwarden clients but doesn't require the huge hardware resources of the original version, making it perfect for running on a VPS or even a Raspberry Pi 4.

Vaultwarden Installation and Deployment

To assemble this system, the cleanest option is to use Docker and Docker ComposeThe first step is to organize the site by creating a directory for persistent data, for example in /opt/vaultwarden/dataIt is crucial that the data is not erased when the container restarts. To manage security, it is recommended to create a administration token using an Argon2 hash (using the openssl command or the Vaultwarden image itself) to avoid storing keys in plain text in the configuration files.

In the deployment file, it is vital fortify the containerIt's not enough to just launch it; you have to limit the memory (around 512MB is more than enough), run the process as a non-root user (for example, UID 1000), and configure the file system as read onlyleaving only the necessary volumes writable. For the service to be securely accessible over the internet, a reverse proxy such as Nginx Proxy Manager or Caddy, which is responsible for managing the Let's Encrypt SSL/TLS certificate.

Comprehensive SMTP configuration

Email is at the heart of notifications and vault security. Without a properly configured SMTP server, you won't be able to send invitations, reset accounts, or activate the vault. two-factor authentication (2FA) by email. To configure it, you must access the administration panel (/admin) or edit the file .env.

Typical parameters for a service like Gmail include the host smtp.gmail.com, the port 587 with STARTTLS or port 465 if you prefer implicit TLS (force_tls). It is crucial to enter the correct application username and password. If you encounter a SMTP error 5xx (535)This usually means that the credentials are incorrect or that the provider (such as Proton Mail or Gmail) requires a specific password for applications and not the master account password.

A key point is the Domain URL, where you must put the full address (e.g. https://vault.tudominio.comIf this doesn't match, the links received by email won't work. For those who want a more professional touch, there are email templates in Spanish that can be cloned from GitHub and mounted on a specific volume so that users don't receive everything in English.

Advanced Security and Hardening

Once you and your team have an account, the most sensible thing to do is disable public logging configuring SIGNUPS_ALLOWED=falseThis way, no unauthorized person will be able to create accounts on your server. To protect yourself against brute-force attacks, it is highly recommended to install [the appropriate security software/method]. Fail2BanSince you're using Docker, you need to configure Fail2Ban to act on the chain. DOCKER-USER of iptables, since standard INPUT rules are often ignored by container traffic.

Other vital functions include the Emergency AccessThis allows a trusted contact to retrieve your vault after a waiting period if you don't respond. Managing the vault is also essential. administrator tokenOnce the configuration is complete, you can delete the variable ADMIN_TOKEN and restart the container so that the route /admin return a 404 error and be invisible to the rest of the world.

Maintenance, Backups and Recovery

Having all your keys in one place is convenient, but dangerous if there are no backups. Copying the database file while the server is running is pointless, as it could result in a corrupted file. The correct approach is to use the command sqlite3 .backup to create a consistent snapshot of db.sqlite3.

A robust backup plan should include the database, the folder of attachments and the file .envTo add an extra layer of security, these copies can be encrypted using tools such as agethen sending them to a remote server using rsync. In case of disaster, restoration involves stopping the container, cleaning up the SQLite WAL and SHM temporary files, and replacing the database with the previously decrypted encrypted copy.

To keep the system up to date, avoid using the tag latest in Docker and always fix one specific versionThis way, when you want to update, you can read the release notes, make a backup beforehand, and change the tag manually, preventing an automatic update from breaking your configuration.

The implementation of Vaultwarden allows for complete privacy management, integrating an SMTP mail server for critical alerts, protecting access with Fail2Ban, and ensuring data persistence through encrypted and consistent backups, all under a reverse proxy that guarantees communication encryption.