2.7 KiB
title, description, published, date, tags, editor, dateCreated
| title | description | published | date | tags | editor | dateCreated |
|---|---|---|---|---|---|---|
| Password Vaults | How passwords are being stored for homelab | true | 2026-10-02T13:49:33.635Z | markdown | 2026-10-02T13:49:33.635Z |
Password & Credential Storage Policy
Summary
As of [10/02/2026], all application admin credentials, local account passwords, and
manual password-reset instructions are stored in Vaultwarden
(https://vault.frantecrt.duckdns.com), not in Wiki.js or any other documentation page.
Documentation pages describe process (how to reset, where to find things). They never contain the actual secret value.
Where things live now
| Content | Location |
|---|---|
| Actual passwords / admin credentials | Vaultwarden |
| App how tos like reset and general reasoning | Wiki.js |
| General app configuration | Git repo |
Vaultwarden structure
- Collections are organized per application or system (e.g.
AppX,AppY-admin,Network-Devices). - Each item represents one credential (e.g. "AppX — local admin account").
- Items are never duplicated into Wiki.js pages. Wiki.js pages link to the relevant Vaultwarden item by name/collection instead of quoting the secret.
Accessing credentials
Web vault
https://vault.frantecrt.duckdns.com — log in with your individual Vaultwarden
account (not a shared account). Browse to the relevant collection.
CLI (for scripts / runbooks)
bw config server https://vault.frantecrt.duckdns.com
bw login
bw unlock
export BW_SESSION="<session key from unlock output>"
bw get password "AppX Admin"
bw list items --search "AppX"
Runbook steps that need a credential should reference the bw get command
rather than embedding the value, e.g.:
Retrieve current admin password:
bw get password "AppX Admin" or link https://vault.frantecrt.duckdns.org/#/vault?itemId=<ITEMID>&action=view
Access control
- Individual accounts only — no shared logins to Vaultwarden itself.
- Collections are scoped so people/teams only see credentials relevant to systems they manage.
SIGNUPS_ALLOWEDis disabled after initial account setup; new accounts are created by an admin via the Vaultwarden admin panel (protected separately byADMIN_TOKEN).
Rotation
When a credential is rotated:
- Update the value in the Vaultwarden item.
- Update the Notes field if the reset procedure itself changed.
- Do not edit a Wiki.js page to reflect the new password — the wiki never contained it in the first place, so there's nothing to update there beyond process changes.