Pixel10 Pro + Tailscale + Vaultwarden

Broonzy

Hello,

I recently started using GrapheneOS and would like to get access to my docker container vaultwarden hosted on a local unraid server. I configured tailscale to get access to vaultwarden from outside my wifi. In addition to that my ubuntu notebook is also added to this configuration. I have integrated the bidwarden add-on into Firefox for my notebook and configured it accordingly with the url of tailscale which references to my vaultwarden on unraid. Thats works without any issues. For my Pixel 10 Pro I have installed the bidwarden app on GrapheneOS and configured it in the same way as the add-on. This second setup ist not working. I have identified three cases

First case: Settings / VPN → Always-on VPN: yes → In the tailscale app it is not possible to activate my github account or click on the connect button. The bidwarden app is not working but I get access via the tailscale url.

Second case: Settings / VPN → Always-on VPN: no → In the tailscale app it is not possible to activate my github account or click on the connect button. The bidwarden app is not working and I do not get access via the tailscale url.

Third case: As I connected to my tailscale some days before (Why it is not possible to connect my tailscale right now?), then I received an error message in the bidwarden app that my master password was wrong but this passwords works in the bidwarden addon on ubuntu

Can anybody please help me with my issue?

Is there also a way to integrate the Bidwarden app into Vanadium?

Thanks and best regards

Broonzy

A short update:
I can connect to Tailscale via the tailscale app but I have to wait some minutes after change the setting Always-on VPN to no. But the result is the same as in case one.
I would be very grateful if someone could please help me.

TrustExecutor

For a different setup you can consider putting your vaultwarden knstance behind a reverse proxy, and then configure it to authenticate using mutual TLS. You generate a client cert and import it into Androids trust store. Bitwarden recently added full support for mTLS. Requests to your exposed URL without a valid client cert then gets blocked by the reverse proxy and results in a HTTP error response. You are then avoiding potential login bypass vulnerabilities in the Vaultwarden app and only you (or people that can present a valid certificate) gets access.

JackWelsh97

I literally just did this the other day, the exact same setup, Vaultwarden in Docker on a Synology NAS with Tailscale. All I had to do is use tailscale serve command to enable HTTPS because I was getting a HTTPS error and that fixed my issue, don't know if this will help.