# Confused Reverse proxy and vaultwarden

**URL:** <https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762>\
**Category:** General Discussion\
**Created:** [24 September 2021 11:53 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762 "2021-09-24T11:53:36Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 11:53 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/1 "2021-09-24T11:53:36Z")

</div>

Hi

I’m really confused on how to setup a reverse proxy using lighttpd for vaultwarden. I’ve tried this config [https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples) but lighttpd refuse to restart and I’m totally lost.

I understand there’s security risks but I need a password manager that syncs with my phone and PC.

Does any one had a guide for a noob like me to set this up?

Please move this in the wrong section

Thanks for any help

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 12:47 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/2 "2021-09-24T12:47:29Z")

</div>

into which file you have added the configuration?

Could you share following pls

```nohighlight
/usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf

```

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 12:56 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/3 "2021-09-24T12:56:47Z")

</div>

> [@](#):
>
> into which file you have added the configuration?
> 
> Could you share following pls
> 
> ```plaintext
> /usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
> 
> ```

There’s no output. I deleted the entries that I copied from the site I mentioned when lighttpd couldn’t restart

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 13:03 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/4 "2021-09-24T13:03:19Z")

</div>

ok and where did you added the config to before you removed it again?

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 13:13 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/5 "2021-09-24T13:13:49Z")

</div>

> [@](#):
>
> ok and where did you added the config to before you removed it again?

Thanks for your replies.

I added it to /etc/lighttpd/conf-available/10-proxy.conf

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 13:24 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/6 "2021-09-24T13:24:31Z")

</div>

usually that would be the correct place but you would need to take care not to simple copy the code section as it contains server.modules += ( “mod\_proxy” ) which is already present in 10-proxy.conf 🙂

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 13:26 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/7 "2021-09-24T13:26:29Z")

</div>

> [@](#):
>
> usually that would be the correct place but you would need to take care not to simple copy the code section as it contains server.modules += ( “mod\_proxy” ) which is already present in 10-proxy.conf 🙂

Nope it didn’t working. I’ll try it again and see what the output is to the command you asked me to run previously

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 13:29 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/8 "2021-09-24T13:29:45Z")

</div>

maybe you can share 10-proxy.conf

Btw: port for vaultwarden is 8001 and not 4567 as in the example.

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 13:30 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/9 "2021-09-24T13:30:15Z")

</div>

> [@](#):
>
> into which file you have added the configuration?
> 
> Could you share following pls
> 
> ```plaintext
> /usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
> 
> ```

This is the output

2021-09-24 23:29:34: sock\_addr.c.435) getaddrinfo failed: Name or service not known ‘’  
2021-09-24 23:29:34: server.c.1517) Configuration of plugins failed. Going down.

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 13:31 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/10 "2021-09-24T13:31:31Z")

</div>

pls share your config file

BTW: Is there a strong need to lighttpd? It’s not the best choice for a revers proxy

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 13:42 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/11 "2021-09-24T13:42:41Z")

</div>

> [@](#):
>
> pls share your config file
> 
> BTW: Is there a strong need to lighttpd? It’s not the best choice for a revers proxy

I fixed the server by replacing with my local IP address but the app on my phone still gives me

```plaintext
"Exception message: Hostname (removed my url) not verified: certificate DN: CN DietPi Vaultwarden subjectAltNames [192.168.15.6, and my Server name].

```

I’m newish to linux and lighttpd was just installed automatically with the apps. Would I have to do heaps of config to use Apache instead?

Here is my config file:

```plaintext
# /usr/share/doc/lighttpd/proxy.txt

server.modules += ( "mod_proxy" )

## Balance algorithm, possible values are: "hash", "round-robin" or "fair" (default)
# proxy.balance = "hash"

## Redirect all queries to files ending with ".php" to 192.168.0.101:80
#proxy.server = ( ".php" =>
# (
# ( "host" => "192.168.0.101",
# "port" => 80
# )
# )
# )

## Redirect all connections on www.example.com to 10.0.0.1{0,1,2,3}
#$HTTP["host"] == "www.example.com" {
# proxy.balance = "hash"
# proxy.server = ( "" => ( ( "host" => "10.0.0.10" ),
# ( "host" => "10.0.0.11" ),
# ( "host" => "10.0.0.12" ),
# ( "host" => "10.0.0.13" ) ) )
#}

$HTTP["host"] == "mydomain.dynu.com" {
    $HTTP["url"] == "/notifications/hub" {
       # WebSocket proxy
       proxy.server = ( "" => ("vaultwarden" => ( "host" => "192.168.15.6", "port" => 3012 )))
       proxy.forwarded = ( "for" => 1 )
       proxy.header = (
           "https-remap" => "enable",
           "upgrade" => "enable",
           "connect" => "enable"
       )
    } else {
       proxy.server = ( "" => ("vaultwarden" => ( "host" => "192.168.15.6", "port" => 8001 )))
       proxy.forwarded = ( "for" => 1 )
       proxy.header = ( "https-remap" => "enable" )
    }
}

```

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 13:47 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/12 "2021-09-24T13:47:16Z")

</div>

looks like your app did not accept the SSL certificate which is logic as the certificate is a self signed one.

Question: do you plan to access vaultwarden from internet or from local only.

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [24 September 2021 13:48 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/13 "2021-09-24T13:48:56Z")

</div>

> [@](#):
>
> > [@](#):
> >
> > into which file you have added the configuration?
> > 
> > Could you share following pls
> > 
> > ```plaintext
> > /usr/sbin/lighttpd -tt -f /etc/lighttpd/lighttpd.conf
> > 
> > ```
> 
> There’s no output. I deleted the entries that I copied from the site I mentioned when lighttpd couldn’t restart

I would like to access my passwords etc when not at home.

---

<div class="post-metadata">

**Author:** ![MichaIng](https://dietpi.com/forum/user_avatar/dietpi.com/michaing/32/7_2.png) [@MichaIng](https://dietpi.com/forum/u/MichaIng)\
**Post date:** [24 September 2021 15:12 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/14 "2021-09-24T15:12:22Z")

</div>

Then I suggest to apply a public TLS certificate, e.g. via dietpi-letsencrypt and apply this to vaultwarden as well. This way you also avoid the process of importing the certificate into the client’s OS CA store.

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [24 September 2021 16:53 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/15 "2021-09-24T16:53:59Z")

</div>

Or to have the certificate on lighttpd only and switch vaultwarden to HTTP ?

Something I would need to test if it is working this way.

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [26 September 2021 10:38 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/16 "2021-09-26T10:38:42Z")

</div>

> [@](#):
>
> Or to have the certificate on lighttpd only and switch vaultwarden to HTTP ?
> 
> Something I would need to test if it is working this way.

> [@](#):
>
> Then I suggest to apply a public TLS certificate, e.g. via dietpi-letsencrypt and apply this to vaultwarden as well. This way you also avoid the process of importing the certificate into the client’s OS CA store.

I decided to purchase a domain name and SSL from name cheap that allows a records to dynamically update.

Sorry I’m fairly new to this, how do I setup dietpi-letsencrypt and vaultwardem with this SSL?

---

<div class="post-metadata">

**Author:** ![Joulinar](https://dietpi.com/forum/user_avatar/dietpi.com/joulinar/32/57_2.png) [@Joulinar](https://dietpi.com/forum/u/Joulinar)\
**Post date:** [26 September 2021 21:27 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/17 "2021-09-26T21:27:25Z")

</div>

I don’t think it was needed to purchase anything. There are quite some free DDNS provider available.

to use dietpi-letsencrypt, you would need to forward port 80/443 from your router to your DietPi system. Once done run command dietpi-letsencrypt from command line and enter your data to generate your SSL certificate.

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [27 September 2021 04:10 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/18 "2021-09-27T04:10:55Z")

</div>

> [@](#):
>
> I don’t think it was needed to purchase anything. There are quite some free DDNS provider available.
> 
> to use dietpi-letsencrypt, you would need to forward port 80/443 from your router to your DietPi system. Once done run command dietpi-letsencrypt from command line and enter your data to generate your SSL certificate.

Sorry for sounding dumb. I used to work in IT years ago before I got sick and I’ve forgotten all my nix stuff.

I’ve created my own cert but the vaultwarden doesn’t like it. I was following MichaIng reply that said I need to apply for a public one.

How do I use my public SSL on my local system?

---

<div class="post-metadata">

**Author:** ![murphydoe](https://dietpi.com/forum/user_avatar/dietpi.com/murphydoe/32/88_2.png) [@murphydoe](https://dietpi.com/forum/u/murphydoe)\
**Post date:** [27 September 2021 05:18 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/19 "2021-09-27T05:18:04Z")

</div>

I’ve also been trying for a while to get my own certificate to run locally.  
unfortunately nothing.  
Now it works with nginx proxy manager.  
Nginx with docker and forward there via the open port.  
But it only works if no other service uses port 80/443  
my tip: use an extra raspy for your project.  
i installed docker with dietpi and then added the docker images nginx and vaultwarden.  
everything in 10 minutes.

---

<div class="post-metadata">

**Author:** ![jmf](https://dietpi.com/forum/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jmf](https://dietpi.com/forum/u/jmf)\
**Post date:** [27 September 2021 07:37 UTC](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762/20 "2021-09-27T07:37:48Z")

</div>

> [@](#):
>
> I’ve also been trying for a while to get my own certificate to run locally.  
> unfortunately nothing.  
> Now it works with nginx proxy manager.  
> Nginx with docker and forward there via the open port.  
> But it only works if no other service uses port 80/443  
> my tip: use an extra raspy for your project.  
> i installed docker with dietpi and then added the docker images nginx and vaultwarden.  
> everything in 10 minutes.

Thanks for your reply. I just found this [https://www.youtube.com/watch?v=b83S\_N1kkJM](https://www.youtube.com/watch?v=b83S_N1kkJM) [How to Install Traefik on OMV and Docker - DB Tech Reviews](https://dbtechreviews.com/2020/04/how-to-install-traefik-on-omv-and-docker/)

[Next page](https://dietpi.com/forum/t/confused-reverse-proxy-and-vaultwarden/5762.md?page=2)