portioner/vaultwarden/RESEARCH.md

Self-Hosted Password Manager Research: Vaultwarden vs Alternatives

Conclusion & Recommendation

Vaultwarden (formerly bitwarden_rs) is the highly recommended choice for a self-hosted password manager for personal or family use, running on a Synology NAS.

It provides the premium experience and cross-platform compatibility of Bitwarden without the massive resource overhead of the official enterprise server.

Detailed Comparison

1. Vaultwarden

• Architecture: A lightweight, community-driven server implementation of the Bitwarden API written in Rust.
• Resource Usage: Extremely low CPU/RAM usage. Perfect for a Synology NAS environment. Often requires just a single Docker container.
• Device Support: 100% compatible with all official Bitwarden clients:
  • Web Vault
  • iOS App
  • Android App
  • Browser Extensions (Chrome, Firefox, Safari, Edge, etc.)
  • Desktop Apps (Windows, macOS, Linux)
• Features: Includes premium Bitwarden features for free, such as:
  • TOTP (Time-based One-Time Passwords) authenticator
  • File attachments
  • Organization/Family sharing
  • YubiKey / WebAuthn support

2. Official Bitwarden Server

• Architecture: Commercially supported, enterprise-grade architecture using .NET Core and Microsoft SQL Server.
• Resource Usage: Very heavy. A standard deployment spins up over 10 containers (mssql, web, api, identity, admin, sso, etc.) and consumes gigabytes of RAM. Not ideal for a standard NAS unless it has dedicated enterprise resources.
• Features: Full enterprise features, directory sync, SSO integrations, commercial support.
• Pros/Cons: While it is the "official" server, it is complete overkill for individual or small family usage, making Vaultwarden the pragmatic choice.

3. Passbolt

• Architecture: Designed primarily for teams, agencies, and enterprise collaboration with a strong focus on compliance (GDPR, ISO 27001).
• Security Model: Uses GnuPG (OpenPGP) for encryption, which is excellent for shared passwords but can be more complex for end-users to manage keys.
• Device Support: Offers Web, iOS, Android, and Browser Extensions. However, the mobile experience is often cited as less "seamless" compared to Bitwarden for simple personal use.
• Ease of Setup: Complex. It practically requires an SMTP server configuration just to invite your first user and complete the installation process.
• Pros/Cons: Excellent for businesses needing granular, role-based password sharing, but overly complex and somewhat rigid for an individual home-lab user.

Next Steps for Repository

If you choose to proceed with Vaultwarden, the implementation should follow the repository standards:

1. Create a dedicated svc-vaultwarden user on the NAS.
2. Create a SETUP.md document for it.
3. Implement an Intelligent Dry-Run script (create_vaultwarden_folders.sh).
4. Deploy it via a docker-compose.portainer.yml stack grouped with a reverse proxy or cloudflared tunnel for secure remote access.