Haseeb ArshadHaseeb Arshad
← All projects
Identity and secretsProduction

Private Password Vault

A dedicated, replicated password-management service with separate trusted-LAN and certificate-authenticated mobile access paths.

VaultwardenBitwarden ClientsmTLSLonghornCaddyBackups

mTLS

public mobile gate

3x

volume replicas

2

network paths

The challenge

What the system needed to solve

Make a password vault available to trusted clients without exposing a conventional login page broadly to the internet.

The build

Engineering decisions

01

Deployed a Bitwarden-compatible server on a dedicated private service address with replicated persistent storage.

02

Issued a private server certificate for enrolled LAN/VPN clients and a separate public-edge policy requiring an approved client certificate.

03

Built a structured import workflow and documented account recovery and backup expectations.

04

Kept administrative enrollment and trust distribution outside the public route.

Architecture

How the pieces connect

  1. 1Enrolled client
  2. 2Private DNS or public mTLS edge
  3. 3Dedicated service VIP
  4. 4Vaultwarden
  5. 5Replicated encrypted backup path

Results

What changed

  • Desktop and mobile clients can sync through narrowly defined trust paths.
  • A stolen password alone is insufficient to reach the public service endpoint.
  • State, recovery, and access controls are monitored and documented as one system.