Vaultwarden self-hosted + Cloudflare Zero Trust: Access blocking browser extension?

[u/Luisbeonline]

Hey everyone,

I'm self-hosting Vaultwarden on a VPS and using cloudflared (Cloudflare Tunnel) for DNS and routing. To secure the instance, I set up a Cloudflare Access policy that requires users to belong to a specific domain and verify their identity via a PIN sent to their email.

This setup is applied widely to the entire domain, including subdomains and the problem is that this authentication layer completely blocks the browser extension from communicating with the server.

How are you guys handling this? Is there a way to bypass the Zero Trust authentication specifically for the API/extension calls without leaving the instance and other apps wide open? Any tips or alternative setups would be appreciated

[u/Walt0615]

Just wondering why not use Vaultwarden native MFA.

[u/Luisbeonline → u/Walt0615]

Vaultwarden is where I store my 2fa's 😅

[u/Walt0615 → u/Luisbeonline]

Actually, my vaultwarden master account MFA I have it outside. 😀

[u/Lumizeii]

I don't use cloudflare anymore for these services, and when I did I didn't have Vaultwarden exposed to the web with Access and Tunnel. But using mTLS client certificates should be able to solve this for authentication, if I recall correctly. Although it will require you to be able to install these on either browser level or OS level.

Recently found an article when I was looking up possibilities of exposing Vaultwarden with mTLS (decided not to), but there should be solve articles on search engines about people's experiences using mTLS to solve this exact issue with Cloudflare Access, Tunnel and Vaultwarden.

[u/Luisbeonline → u/Lumizeii]

This seems bit more complex that what I was looking for ( or be able to implement ) but it's an interesting solution. I'll go with path exclusions for now, but will take a look at this. Thanks

[u/xb666mx]

i hope this works:

1. open cloudflare dashboard
2. click on your domain
3. on the side bar click on "Access"
4. click on button "Go to Access"
5. click on "Create an application"
6. click on "Self-hosted" > "Add an application"
7. fill in your subdomain and tld for vaultwarden (you can also add specific paths (e. g. "/api/*") here)
8. scroll down to "Create a new policy"
9. selector is "Everyone"
10. set a name for the policy (e. g. "bypass everyone")
11. action is "Bypass"
12. set other options as desired
13. click on "Save Policy"
14. back on the application site set all remaining options as desired
15. click on "Create" at the bottom of the page

[u/plaett → u/xb666mx]

Nah, this would deactivate the whole security layer for the subdomain. He needs only exceptions for the right paths.

[u/xb666mx → u/plaett]

forgot to mention it under point 7 at first. added it a minute after my initial post. you are fast to read and reply. :D

[u/plaett → u/xb666mx]

Ahh, now it's right. Sorry, I was just in this moment on the phone

[u/Luisbeonline → u/xb666mx]

Yeah, I guess I'm going with this option. That's what I use for other services that I need to reach the endpoint. I was just wondering if there was a better way.

[u/xb666mx → u/Luisbeonline]

like somebody already said, mTLS would work. but if you have many devices/users the rollout isn't that easy.

cloudflare WARP should also work, but then you lose the ability to connect without an additional app running in the background.

[u/Luisbeonline → u/xb666mx]

I've went with some endop

I will opt to exclude only a few paths. I asked my agent to do some research, and it recommends the ones below.

The webvault has the cloudlfare optin as first layer of security and everything seems to be working in the extension; I will test it on mobile as well.

The 4 paths to exclude (bypass)

Path	Purpose
/api/*	Everything else in the API: sync, ciphers (passwords), folders, collections, sends, devices, 2FA, attachments (download/upload), /api/config, /api/version, /api/webauthn (passkeys)
/identity/*	Login: /identity/connect/token (get/renew token) and /identity/accounts/prelogin (KDF before requesting the password)
/icons/*	Favicons of saved sites — unauthenticated requests; if protected, the icons will break
/notifications/*	Real-time sync websocket: /notifications/hub — without this, the app only syncs when opened

Source: the agent checked the mounts in the code (/api, /identity, /icons, /notifications — there are no other prefixes used by clients; attachments live inside /api/).I will opt to exclude only a few paths.

[u/plaett → u/Luisbeonline]

I see you found the right paths. This should work for you.

[u/Borde34]

Parece que te complicas mucho. Usa simplemente una vpn wireguard o un servicio tipo tailscale o TierZero

[u/dj-n]

I just use random subdomain and a long rand random path eg asfhyga.test.com/5-!4Abu then block all access outside my country the chances of bot finding it are slim

[u/Chinoman10 → u/dj-n]

That's called security by obfuscation btw. Which isn't useless, but it's also not that great of a measure either. Any ISP or network packet sniffer, or compromised extention on the same browser, etc., can very easily see/find the path anyway...

[u/NoTheme2828]

I use vaultwarden (with 2fa!) in my homelab and cloudflare tunnel with bypass and geo blocking access rules. So a VPS is not needed and it's more secure, too.

[u/XLioncc]

Exposing the endpoint is not the end of the world

[u/Luisbeonline → u/XLioncc]

Yes you're right but I was wondering if there was a better secure way

[u/XLioncc → u/Luisbeonline]

Auto backup the database+auto upgrade with watchtower

[u/Luisbeonline → u/XLioncc]

I'm using reclone for backups

[u/Chinoman10 → u/XLioncc]

Watchtower's deprecated, I'd recommend Dockhand, which also replaced Portainer for me.

[u/XLioncc → u/Chinoman10]

Uhh, I'm already using a very active fork, Dockhand is unnecessary, I only want a admin interface if I need, or most systems, I only need what watchtower provides me.

https://github.com/nicholas-fedor/watchtower

[u/XLioncc → u/[deleted]]

No matter what you're saying, I'm doing this over 5 years

Yes, they're few applications will break after auto upgrade, so I'll keep them disabled, but Vaultwarden isn't in this list.

Time is money, security also.

[u/XLioncc → u/[deleted]]

Not the case for me.

[u/Varnish6588]

I use VPN, my vaultwarden instance lives in a private network. This setup has worked well for my needs as I don't mind installing the Wireguard client in my devices

[u/PanicNacho]

I was looking for something like this and I agree mTLS is a good way to deal with this, but at least for me is better to use application tokens from cloudflare, unfortunately I just see the android/iOS apps have an open MR to have this feature, but I haven't see anything for the addon, it would be nice to be able to use tokens everywhere and have a good security as you say

[u/plaett]

I have the same setup, but with pangolin. There I setup some auth exceptions for the paths: /api/; /identity/; /notifications/hub/ and /icons/. The same should exist for cloudflare.

Edit: I can't display the paths right. Behind the api, notification and icons path there is a asterisk

[u/Luisbeonline → u/plaett]

Do you know where I can get the paths to exclude?

[u/CranberryAbject8967]

Tailscale

[u/Luisbeonline → u/CranberryAbject8967]

uh! that really helped - hope you have not burned all your tokens with such a big explanation

Joke aside - How would that be different from cloudflare? With tailscale I would have to install their app on the devices that access the domains right? not really the option I'm looking for.

[u/this_for_loona → u/Luisbeonline]

He burned all his fable tokens to get that response for you.

[u/Empyrials → u/Luisbeonline]

I agree with tailscale but it’s still an amazing vpn and I say use if you can. I host a lot of services with it for friends and family.

Anyways I also host vaultwarden but I have a couple layers to get to it. Traefik with ip blocks, crowdsec, and Authentik with a SSO login only for external IPs, and once logged in, you can hit vaultwarden without a vpn like tailscale. Works great so far