Access Vaultwarden on Umbrel via Tailscale – not working?

[SpyDeeHub]

Hi everyone,

I’m running Vaultwarden as an app on my Umbrel server, where it is only accessible via Tor.

According to the Umbrel App Store description, it should be possible to access Vaultwarden using Tailscale by entering the Tailscale IP in the Bitwarden app or browser extension.

However, this doesn't work for me – I’ve tried entering the Tailscale IP as the server URL in the Bitwarden browser extension, but I just get an error ("KDF config is required").

Is there anything I’m missing? Has anyone successfully connected to Vaultwarden over Tailscale on an Umbrel setup?

Any help would be appreciated!

[stefan0xC]

Have you configured http://100.xyz.xyz.xyz or https://100.xyz.xyz.xyz as your server URL? If the latter did you enable HTTPS in Tailscale? (And which port did you specify?) I am not sure how the Umbrel setup works exactly (so I might be off with my assumptions here) but I think that the setup instructions are assuming that the other Bitwarden clients all don't require HTTPS (which is why you need to create an account via the .onion address) but it's not clear because they don't specify the scheme you should use. (Note that this has been changed recently at least for the Android client that now requires a secure connection as well (cf. bitwarden/android#5533) so the instructions are probably a bit outdated.) Also did you install Tailscale on your devices? Did you configure your browser to use the system proxy?

[SpyDeeHub]

Hi there,
thanks a lot for your quick reply!

I’ve tried pretty much everything by now — first using http://100.x.x.x, then https://100.x.x.x.

Yes, HTTPS is enabled in Tailscale, and yes, my Umbrel server, my laptop, and my smartphone are clients in the same Tailnet.

I’ve tried connecting via the Tailscale IP, via MagicDNS, with and without specifying a port.
As for the port, I used 8080, since that seemed to be the most common suggestion I could find online.

However, Umbrel itself doesn’t seem to expose Vaultwarden on any actual port — as far as I understand, it only runs through Tor, and is only accessible via the Tor browser.

So I originally didn’t even think it would be possible to access Vaultwarden through the Bitwarden app or extension, except maybe using Orbot and the .onion address.

But since the official Umbrel App Store description explicitly says that this is possible via Tailscale, I figured I’d ask here to find out how it’s supposed to work.

Thanks again for taking the time to help!

[stefan0xC]

As for the port, I used 8080, since that seemed to be the most common suggestion I could find online.

In their docker-compose.yml it seems like they set the ROCKET_PORT (the one where vaultwarden listens on) to 8089 so maybe that's why it's not working? (ROCKET_ADDRESS should by default be set to 0.0.0.0 so it listens on all interfaces.) But you can probably check via the logs what Vaultwarden says it's listening on. (e.g. [start][INFO] Rocket has launched from http://0.0.0.0:8080). So if you setup https in tailscale you probably want to set the Server URL to https://100.x.y.z:8089.

[SpyDeeHub]

Thanks a lot for your help earlier — especially for pointing me to port 8089!
That was indeed the first major issue, as I had initially been trying 8080,
which obviously went nowhere.

After fixing the port, I still ran into the same “endless loading” problem
in the browser UI and the Bitwarden app couldn’t log in either.
Eventually we figured out that the issue was related to the missing HTTPS setup
and how the certificates were handled.

The final working solution was to use Tailscale Serve directly on Umbrel’s
built-in Tailscale terminal.
Running this command solved it instantly:

tailscale serve --https / http://localhost:8089

This automatically created an HTTPS address within my Tailnet
(https://<umbrel-hostname>.<tailnet-name>.ts.net) that points to Vaultwarden’s internal port 8089.
Certificates are managed automatically by Tailscale, and it now works perfectly
— both in the web interface and the Bitwarden mobile app — all within the Tailnet.

So in short:

Umbrel + Vaultwarden + Tailscale Serve = working Bitwarden clients without Tor.

(It might also be possible to achieve the same result using the Umbrel Nginx Proxy Manager
with a locally issued TLS certificate, but I haven’t tested that approach.)