How To Set Up Bitwarden And Keep Your Passwords Safe On A Synology NAS

Store and manage all your passwords on your Synology NAS.

Bitwarden is a popular password manager that can help you conveniently create and use more secure passwords for all your accounts. By default, the available apps will use Bitwarden’s backend cloud infrastructure to store your passwords and provide access anywhere in the world. Because one of the primary goals of setting up network-attached storage (NAS) may be to run some services in-house, taking full control of your passwords and how they’re stored is easy by running Bitwarden on your server. This guide will walk you through how to set Bitwarden up on a Synology NAS.

How to install Bitwarden on Synology NAS

This guide will use an unofficial docker version of the Bitwarden server stack called Vaultwarden.

Log into your Synology NAS.
Open Package Manager.
Search for and install Container Manager.
Open Container Manager.
Click Registry.

Search for “Vaultwarden.”
Click Vaultwarden/server.
Click Download.
Click Apply.
Click Container.

Click Create.
Choose Vaultwarden/server:latest in the image drop-down menu.
Check Enable auto-restart.
Click Next.
Enter a port number in the two available TCP fields.

Click Add Folder. Select a folder to use for Vaultwarden. I recommend creating one within the docker folder. (Enter “https://www.xda-developers.com/data” in the blank field.)
Click Done.
Open Control Panel.
Go to External Access> DNSS.
Click Add.

Choose Synology as the Service Provider.
Enter a hostname. (For example: xda.synology.me.)
Click Test Connection. (If it fails, the hostname is likely already taken.)
Select Get a certificate from Let’s Encrypt and set it as default.
Click OK.

Click OK.
Go to Login Portal> Advanced.
Click Reverse Proxy.
Click Create.
Set a Proxy name.

Change the source protocol to HTTPS.
Enter the hostname. (vaultwarden.CHANGEME.synology.me.)
Set the source port to 443.
Check Enable HSTS.
Set destination hostname to localhost.

Set destination port to 9890.
Select the Custom Header tab.
Click Create.
Click WebSocket.
Click Save.

Click Close.
Go to Network> Connectivity.
Check Enable HTTP/2.
Click Save.
Go to Security> Advanced.
Check Enable HTTP Compression.
Click Save.

You’ll now be able to connect to your newly configured Vaultwarden instance and set everything up, following the handy on-screen wizard.

Which Synology NAS should you buy?

There are countless Synology enclosures available, but which would be best for running a Vaultwarden instance? Any Synology NAS would do and it depends if you want to run additional services alongside the password manager. Anything from the budget-friendly Synology DiskStation DS223j to the DiskStation DS224+ would work well. I recommend keeping the password manager on the same NAS as your home or office server for storage, keeping everything in one place, though you may wish to separate these deployments for added security.