Should Your Vaultwarden Vault Be VPN-Only? Three Conditions

First login on a replacement phone is where a VPN-only vault shows its cost: the app has no cache, the server sits behind a tunnel, and the tunnel credential may be inside the vault you cannot open. That is a design question rather than an outage, and it is cheaper to answer before the deployment than after it. Three conditions decide whether a private vault is practical for your users. If any of them fails, the right answer is usually a narrower exposure rather than a VPN wall.

Condition 1: your users can reach the server on day one

A new device has no cache, no session and no trust. It needs the server's hostname to resolve, the route to reach it, and a VPN profile that is already installed before the user tries to sign in. If any of those three arrives only after the first login, the deployment fails at the worst possible moment. Count how many steps a new hire has to complete before they can open their vault.

A split tunnel is often the better fit here: carry only the vault endpoint and the DNS path it needs, and leave the rest of the user's traffic alone. That is a routing decision to make with whoever owns the VPN, not an assumption that every mobile client honours the same policy. Both address families and the service's hostname have to be consistent with the choice.

If users cannot reach the server before they have working credentials, this condition fails and the VPN wall is the wrong shape.

Condition 2: cached access is read-only, and that is enough

Bitwarden clients can show an already-unlocked vault without reaching the server, and that offline copy is read-only. It is useful for reading a password during an outage; it is not a new login and it is not editing. Decide whether read-only is acceptable for your users before you design around it.

curl -sI https://vault.example.com/alive
openssl s_client -connect vault.example.com:443 -servername vault.example.com </dev/null

Locking and logging out are different states, and the difference matters here. A locked client keeps the local vault encrypted and can unlock it again with the master password or biometrics; logging out removes that local copy and requires the server. If a support script tells users to log out and back in to fix a sync problem, it also removes their offline access. Check the timeout action on each client rather than assuming the default.

A cached copy is not a backup. It lives on one device, it is tied to one account, and it disappears with a logout or a wipe.

Condition 3: recovery does not run through the vault itself

The circular case is easy to build by accident: the VPN credential is stored in the vault, the vault is behind the VPN, and the only device with a cache is the one that was lost. Recovery then depends on a document or a person outside the system. Write that bootstrap path down and test it with a recoverable account before anyone needs it. A break-glass procedure nobody has exercised is a hope.

Test the sequence in a controlled way: confirm which existing items stay readable offline, then restore the network path and verify that a fresh login and a sync both work. Avoid logging out of the only cached copy as an experiment unless another route back exists. Record what you observed, including the client version.

If recovery requires the vault, this condition fails. The fix is a documented out-of-band path, not a stronger warning in the onboarding document.

What you keep either way: HTTPS, backups and updates

HTTPS stays in place even behind the VPN. It gives the web service an identity the browser can check and keeps the application connection protected independently of where the tunnel terminates. A private endpoint should not teach users to click through certificate warnings, because that habit follows them to public sites.

Backups are a separate discipline from availability. Vaultwarden stores its data in a database, and a consistent copy taken while the service is stopped, or a database-level backup, is worth more than a file copied from a running process. Keep the copy off the vault host and test a restore. Exported vault material needs the same protection as the original, because an export is not encrypted the way the server's storage is.

sqlite3 /data/db.sqlite3 ".backup '/backup/vault-2026-11-03.sqlite3'"
docker compose ps

Then keep the server and the clients updated. VPN-only access reduces exposure; it does not make a vulnerable implementation harmless, and it does not protect a compromised endpoint. The three conditions decide the access model, and maintenance decides whether that model survives the year.