97 lines
2.7 KiB
Markdown
97 lines
2.7 KiB
Markdown
---
|
|
title: Password Vaults
|
|
description: How passwords are being stored for homelab
|
|
published: true
|
|
date: 2026-10-02T13:49:33.635Z
|
|
tags:
|
|
editor: markdown
|
|
dateCreated: 2026-10-02T13:49:33.635Z
|
|
---
|
|
|
|
# Password & Credential Storage Policy
|
|
|
|
## Summary
|
|
|
|
As of [10/02/2026], all application admin credentials, local account passwords, and
|
|
manual password-reset instructions are stored in **Vaultwarden**
|
|
(`https://vault.frantecrt.duckdns.com`), not in Wiki.js or any other documentation page.
|
|
|
|
Documentation pages describe *process* (how to reset, where to find things).
|
|
They never contain the actual secret value.
|
|
|
|
---
|
|
|
|
## Where things live now
|
|
|
|
| Content | Location |
|
|
|---|---|
|
|
| Actual passwords / admin credentials | Vaultwarden ||
|
|
| App how tos like reset and general reasoning | Wiki.js |
|
|
| General app configuration | Git repo |
|
|
|
|
---
|
|
|
|
## Vaultwarden structure
|
|
|
|
- **Collections** are organized per application or system (e.g. `AppX`,
|
|
`AppY-admin`, `Network-Devices`).
|
|
- Each **item** represents one credential (e.g. "AppX — local admin account").
|
|
- Items are **never** duplicated into Wiki.js pages. Wiki.js pages link to
|
|
the relevant Vaultwarden item by name/collection instead of quoting the
|
|
secret.
|
|
|
|
---
|
|
|
|
## Accessing credentials
|
|
|
|
### Web vault
|
|
`https://vault.frantecrt.duckdns.com` — log in with your individual Vaultwarden
|
|
account (not a shared account). Browse to the relevant collection.
|
|
|
|
### CLI (for scripts / runbooks)
|
|
|
|
```bash
|
|
bw config server https://vault.frantecrt.duckdns.com
|
|
bw login
|
|
bw unlock
|
|
export BW_SESSION="<session key from unlock output>"
|
|
|
|
bw get password "AppX Admin"
|
|
bw list items --search "AppX"
|
|
```
|
|
|
|
Runbook steps that need a credential should reference the `bw get` command
|
|
rather than embedding the value, e.g.:
|
|
|
|
> Retrieve current admin password: `bw get password "AppX Admin"
|
|
or link https://vault.frantecrt.duckdns.org/#/vault?itemId=<ITEMID>&action=view`
|
|
|
|
---
|
|
|
|
## Access control
|
|
|
|
- Individual accounts only — no shared logins to Vaultwarden itself.
|
|
- Collections are scoped so people/teams only see credentials relevant to
|
|
systems they manage.
|
|
- `SIGNUPS_ALLOWED` is disabled after initial account setup; new accounts
|
|
are created by an admin via the [Vaultwarden admin panel](https://vault.yourdomain.com/admin)
|
|
(protected separately by `ADMIN_TOKEN`).
|
|
|
|
---
|
|
|
|
## Rotation
|
|
|
|
When a credential is rotated:
|
|
|
|
1. Update the value in the Vaultwarden item.
|
|
2. Update the Notes field if the reset procedure itself changed.
|
|
3. **Do not** edit a Wiki.js page to reflect the new password — the wiki
|
|
never contained it in the first place, so there's nothing to update there
|
|
beyond process changes.
|
|
|
|
---
|
|
|
|
## Related docs
|
|
|
|
- [Deployment: (example only) Wiki.js + Vaultwarden docker-compose stack](#)
|