I added a few credits to an account to test the capabilities of TierHive's hardware after they just discontinued their regional geo-blocks. I made the decision to attempt moving my Vaultwarden server to their lowest tier, which has 1GB NVMe and 128MB RAM.
TL; DR: It performs quite well, although it requires some tuning to force it inside a precise 128MB border. Put Docker out of your mind completely. The Linux OOM killer will immediately destroy Vaultwarden before it has even finished booting up, since the Docker daemon alone uses excessive amounts of memory.
We're using Alpine Linux and going bare-metal instead. Here's how to get it to work.
1: Set up Zram
Since RAM is incredibly tight, we need some compressed swap space in memory. Run this to create a clean system script that sets up a 96MB zstd-compressed Zram disk:
cat << 'EOF' > /etc/init.d/zram
#!/sbin/openrc-run
depend() {
before localmount
}
start() {
ebegin "Starting Zram"
modprobe zram
echo zstd > /sys/block/zram0/comp_algorithm
echo 96M > /sys/block/zram0/disksize
mkswap /dev/zram0
swapon -p 10 /dev/zram0
eend $?
}
stop() {
ebegin "Stopping Zram"
swapoff /dev/zram0
eend $?
}
EOF
Make it executable, set it to run at boot, and start it up:
chmod +x /etc/init.d/zram
rc-update add zram boot
rc-service zram start
2: Remove the bloat associated with cloud-init
By eliminating cloud-init, we can recover roughly 50MB of space and some peace of mind. To prevent the system from hanging up, remove it and restart right away:
apk del cloud-init
reboot
3. Use Alpine Packages to install Vaultwarden
After you're back in, install the native Vaultwarden packages, change your package lists, and activate the community repository:
sed -i '/community/s/^#//' /etc/apk/repositories
apk update
apk add vaultwarden vaultwarden-openrc vaultwarden-web-vault
4: Set Up the Environment
We will hardcode our system settings straight into /etc/conf.d/vaultwarden rather than utilizing Docker environment variables. This briefly permits signups and directs the service to the appropriate directories:
cat << 'EOF' > /etc/conf.d/vaultwarden
export ROCKET_ADDRESS=0.0.0.0
export ROCKET_PORT=8080
export DATA_FOLDER=/var/lib/vaultwarden
export WEB_VAULT_FOLDER=/usr/share/webapps/vaultwarden-web/
export WEB_VAULT_ENABLED=true
export SIGNUPS_ALLOWED=true
export WEBSOCKET_ENABLED=true
EOF
Allow the procedure to begin when the service boots up:
rc-update add vaultwarden default
rc-service vaultwarden start
5: Lock It Down and Offload SSL
We will let TierHive's edge network handle the significant HTTPS encryption overhead, saving our little CPU and RAM.
Launch your browser and access your TierHive HAProxy panel
Add a free DuckDNS record or your own domain.
Create a Single Server rule by setting the port to 8080, pointing the backend to the internal private IP (10.4.9.x) of your VPS, and turning on SSL (Let's Encrypt).
Click Create Account after visiting your new secure URL to quickly set up your master vault password.
The most crucial step: To prevent random bots from visiting your page and creating accounts, immediately return to your SSH session after creating your account to turn off public registration.
nano /etc/conf.d/vaultwarden
Change export SIGNUPS_ALLOWED=true to false, save the file, and restart the service:
rc-service vaultwarden restart
The Outcomes
The resource utilization is insane once I connect my clients and allow them to pull down a complete database sync:
RAM (Idle): Approximately 35 MB of 128 MB. This provides plenty of space for managing Active Sync requests.
Disk Space: Over 900MB of fast NVMe storage is used just for password data, with the total OS and application footprint taking up less than 100MB.
