arthurgeek / vaultwarden-fly-template

Template to deploy Vaultwarden on Fly.io with websockets support and sqlite hourly backups

Template for deploying Vaultwarden on Fly.io

This is a template for deploying Vaultwarden on Fly.io with Caddy and supercronic for hourly restic backups with e-mail failure notification via msmtp.

This uses a single fly machine, within Fly's free allowance.

Usage

You first need to create a new repo for your config, by clicking on the Use this template button on this page.

Then, clone your new repo and cd into it.

Install dependencies

1. Install go-task:

   We use go-task to automate some steps, you can check the task code under .taskfiles. to see which commands each task run.

   brew install go-task/tap/go-task

2. Install flyctl:

   brew install flyctl

Configuration

The .config.env file contains environment variables needed to deploy the apps in this template.

1. Copy the .config.sample.env to .config.env and fill out all the environment variables. All uncommented variables are required.

Fly.io setup

For some commands below, we use a task instead of flyctl because we the task writes (on app creation) and reads (subsequent commands) your app name from the config file. This is the only way to keep your app name hidden.

1. Signup to Fly

   If you already have a Fly account, use flyctl auth login instead.

   flyctl auth signup

2. Create a new fly app

   If this is your first app, you'll be asked to add credit card information, but, don't worry, you'll not be charged by this app.

   task fly:app:create

3. Create a new volume

   This will show you a warning about invididual volumes. It's ok to have a single volume because we're not concerned about downtime for our Vaultwarden instance.

   task fly:volume:create

4. Deploy your app

   task fly:app:deploy

5. Setup your custom domain

   After your app is deployed, follow the steps here to setup your custom domain.

6. Open your new Vaultwarden website

   That's all! Now you can open your custom domain and Vaultwarden should work.

Keeping dependencies up to date

This template uses Renovatebot to scan and open new PRs when dependencies are out of date.

To enable this, open their Github app page, click the "Configure" button, then choose your repo. The template already provides Renovate configs and there's no need for further action.

Troubleshooting

If your deployment failed or you can't open Vaultwarden web, you can see the logs with:

task fly:app:logs

If that command fails (eg, if the machine is stopped), try opening your logs in the browser:

task fly:app:logs:web

You can also ssh in the machine with:

task fly:app:ssh

and check individual logs using overmind:

# Run this command inside your fly machine
overmind connect vaultwarden

This will open a tmux window with vaultwarden logs. You can scroll your tmux window with Ctrl-B-] and use Ctrl-B-D to exit the tmux window.

Substitute vaultwarden with caddy, or backup to see logs for other apps.

Continuous deployment

After your first manual deploy to Fly.io, per instructions above, you can setup continuous deployment via Github Actions.

1. Install Github CLI

   brew install gh

2. Login to Github

   gh auth login

3. Set Fly secrets to your Github repo

   task github:secrets:set

4. Test your workflow deployment

   task github:workflow:deploy

That's all! Now, any changes to your Dockerfile, fly.toml or scripts/config will trigger a fly deploy.

FAQ

1. Why every fly command I run errors with: Error: the config for your app is missing an app name?

   For security reasons the app name is not sdaved in the fly.toml file. In that case, you have to add -a your-app-name to all fly commands.

   Your app name is found in your .config.env file.

   Example:

   fly secrets list -a your-app-name

   Or you can add:

   app = "your-app-name"

   to the beginning of your fly.toml file.

2. How do I update the environment variables?

   After updating the .config.env file, you can update your environment variables in two different ways:

   task fly:secrets:set

   will read your .config.env file and import every defined variable to your fly app, Or you can just do a new deployment:

   task fly:app:deploy

   which will run the command above and do a new deployment afterwards.

vaultwarden-fly-template's Issues

B2 backups

Hi there,

I have configured using B2 backups, I can see the backups happening in the logs but not seeing anything getting through to B2.

Is anyway I could troubloshoot this ?
Only change in .config.env is I have added below variables instead of default s3.

B2_ACCOUNT_ID=
B2_ACCOUNT_KEY=

Renovate Dashboard 🤖

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• feat(github-release): update darthsim/overmind to v2.5.1

Detected dependencies

dockerfile

Dockerfile

• vaultwarden/server 1.30.5-alpine
• alpine 3.19
• alpine 3.19
• caddy 2.7.6-alpine

github-actions

.github/workflows/fly-deploy.yaml

• actions/checkout v4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• superfly/flyctl-actions master
• arduino/setup-task v1

.github/workflows/publish.yaml

• actions/checkout v4@0ad4b8fadaa221de15dcec353f45205ec38ea70b
• docker/login-action v3@e92390c5fb421da1463c202d546fed0ec5c39f20
• docker/metadata-action v5@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
• docker/build-push-action v5@2cdde995de11925a030ce8070c3d77a52ffcf1c0

regex

Dockerfile

• aptible/supercronic v0.2.29
• DarthSim/overmind v2.4.0

---

• Check this box to trigger a request for Renovate to run again on this repository

.config.env not work

for example: I set ADMIN_TOKEN

# https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page
ADMIN_TOKEN=xxxxxx