---
title: Password Vaults
description: How passwords are being stored for homelab
published: true
date: 2026-10-02T13:49:33.635Z
tags: 
editor: markdown
dateCreated: 2026-10-02T13:49:33.635Z
---

# Password & Credential Storage Policy

## Summary

As of [10/02/2026], all application admin credentials, local account passwords, and
manual password-reset instructions are stored in **Vaultwarden**
(`https://vault.frantecrt.duckdns.com`), not in Wiki.js or any other documentation page.

Documentation pages describe *process* (how to reset, where to find things).
They never contain the actual secret value.

---

## Where things live now

| Content | Location |
|---|---|
| Actual passwords / admin credentials | Vaultwarden ||
| App how tos like reset and general reasoning | Wiki.js |
| General app configuration | Git repo |

---

## Vaultwarden structure

- **Collections** are organized per application or system (e.g. `AppX`,
  `AppY-admin`, `Network-Devices`).
- Each **item** represents one credential (e.g. "AppX — local admin account").
- Items are **never** duplicated into Wiki.js pages. Wiki.js pages link to
  the relevant Vaultwarden item by name/collection instead of quoting the
  secret.

---

## Accessing credentials

### Web vault
`https://vault.frantecrt.duckdns.com` — log in with your individual Vaultwarden
account (not a shared account). Browse to the relevant collection.

### CLI (for scripts / runbooks)

```bash
bw config server https://vault.frantecrt.duckdns.com
bw login
bw unlock
export BW_SESSION="<session key from unlock output>"

bw get password "AppX Admin"
bw list items --search "AppX"
```

Runbook steps that need a credential should reference the `bw get` command
rather than embedding the value, e.g.:

> Retrieve current admin password: `bw get password "AppX Admin" 
or link https://vault.frantecrt.duckdns.org/#/vault?itemId=<ITEMID>&action=view`

---

## Access control

- Individual accounts only — no shared logins to Vaultwarden itself.
- Collections are scoped so people/teams only see credentials relevant to
  systems they manage.
- `SIGNUPS_ALLOWED` is disabled after initial account setup; new accounts
  are created by an admin via the [Vaultwarden admin panel](https://vault.yourdomain.com/admin)
  (protected separately by `ADMIN_TOKEN`).

---

## Rotation

When a credential is rotated:

1. Update the value in the Vaultwarden item.
2. Update the Notes field if the reset procedure itself changed.
3. **Do not** edit a Wiki.js page to reflect the new password — the wiki
   never contained it in the first place, so there's nothing to update there
   beyond process changes.

---

## Related docs

- [Deployment: (example only) Wiki.js + Vaultwarden docker-compose stack](#)