Selfhosted

IMO if you are asking such question - stick to Bitwarden cloud.

Passwords, at least to me, is something I don't want to lose. I don't trust myself I could provide a proper uptime & security, so I just use cloud version.

Is there a reason you can't just VPN in and expose only the VPN gateway? My preferred security is not exposing a bunch of random applications to the internet and hoping each doesn't ever have any vulnerabilities.

is it okay to have a subdomain to connect to vaultwarden?

A lot of the people would disagree but I think so, yes. Provided that you have set up all the security measures such as firewall/fail2ban, you'll be fine.

Am i better off just trusting bitwarden and sticking with them?

I think of it as a matter of personal preferences. But honestly, if you had to ask this without your own basic plans for security, I'd advice you to stick with Bitwarden. You'll just sleep better, that's all.

I am using Tailscale (Wireguard). It's quite painless

Security is a tough thing to give advice about. Different people have different levels of risk tolerance. It’s embarrassing to give advice about one’s personal views - tedious to write - and then get replies about how that’s too much security, too little security, etc.

Attackers can use tricks to enumerate dns subdomains. They can compromise one container and pivot to the container host.

You can frustrate automated compromises by putting up roadblocks or speed bumps they have to get through before seeing the stock landing or login pages for well known apps. That can buy you a little time if a serious exploit is discovered and you know you won’t be on top of container updates. But stay on your container updates.

I just use wildcard domain that points to my local IP of my homelab. For example, *.myhomelab.com points to 192.168.1.111 (the local IP of my machine). Then, reverse proxy routes my traffic. Here are some great vids about it: by Wolfgang, by Christian Lempa, and by TechnoTim

To access my home network from outside, I use WireGuard VPN. So, I have the only one open port to the global web. I also use a random port, to dodge some bots. I use DDNS to access my VPN server, since I have a dynamic IP.

I know some people use Tailscale (it uses WireGuard under the hood) so check it out too.

Personally, I use wgeasy container to work with WireGuard, but it's so easy to be manually configured.

I'm not an expert in security or system administrating. I'm just a regular software developer, and homelabbing is my hobby. However, I have common sense of the security basics. I consider every open port as a potential vulnerability that could be exploited by hackers. So less open ports -> less security risks. Also, using VPN to access my home network adds additional layer of security. Adding 2FA for each service is also a great idea.

Personally I trust Bitwarden more than myself to keep all my passwords secure AND available. They've got a good track record as far as I'm aware.

For general security hardening though...

I use Shodan to help me identify if anything is misconfigured and what is visible from the web. You can pick up an account for usually $1 for life when they run a deal, then you can just monitor your DDNS, domain, and IP address and have it email you when any new services are detected.

Cloudflare Tunnels, to remove the need for a nginx reverse proxy (with the added benefit of easy failover as well as simplifying your stack). Then I'm utilizing Cloudflare's WAF to handle filtering out known malicious, foreign IP addresses, and other malicious traffic.

Another route you can go is a Nginx/haproxy reverse proxy behind something like Suricata. Then you can utilize something like fail2ban or crowdsec.

Authentik. Get everything behind a SSO experience and don't expose your backend services to unauthenticated local traffic (utilize http basic auth with header passthrough in authentik). So many people setup auth wrong and then have something like auth.domain.com going through auth but then mistakenly have their external IP address setup to allow traffic in authenticated.

I'd say, what kind of security are you talking about? Apart from standard HTTPS to keep things encrypted, there are other layers if you want to keep your service exposed to the internet.

Also how things are installed and if they are correct, proper file permissions. nothing different than having it on the server somewhere. You just need to keep thing up to date and you'll be fine.

I always see guys swearing by Wireguard for VPN access as a security measure and seems to me like if someone unauthorized gets your public key, they have access to the kingdom.