# Ubuntu/Debian
curl -fsSL https://get.docker.com | sh
docker compose plugin install  # Built-in for Docker 23+, otherwise:
# apt install docker-compose-plugin

mkdir -p ~/bitwarden && cd ~/bitwarden

# Generate random install token
docker run --rm bitwardenrs/server:latest gen-install-token

# Generate random master password (or set your own strong one)
openssl rand -base64 32

cat > .env << 'EOF'
# ===== Basic Configuration =====
BITWARDENSSL_ENABLED=true
BITWARDENSSL_CERT_FILE=/etc/ssl/vault.crt
BITWARDENSSL_KEY_FILE=/etc/ssl/vault.key

# ===== Domain =====
DOMAIN=vault.yourdomain.com

# ===== Database (MySQL) =====
MYSQL_ROOT_PASSWORD=$(openssl rand -base64 32)
MYSQL_DATABASE=bitwarden
MYSQL_USER=bitwarden
MYSQL_PASSWORD=$(openssl rand -base64 32)

# ===== Admin Password =====
ADMIN_TOKEN=$(openssl rand -base64 48)

# ===== Email (for password reset notifications) =====
SMTP_HOST=smtp.yourdomain.com
SMTP_PORT=587
SMTP_FROM=noreply@yourdomain.com
SMTP_SSL=true
SMTP_USERNAME=your_smtp_user
SMTP_PASSWORD=your_smtp_pass

# ===== Feature Flags =====
SIGNUPS_ALLOWED=false
INVITATIONS_ALLOWED=false
EOF

version: "3.8"

services:
  # ── Bitwarden Main Service ──
  bitwarden:
    image: bitwardenrs/server:latest
    container_name: bitwarden
    restart: unless-stopped
    ports:
      - "127.0.0.1:8089:80"
    environment:
      WEBSITE_HOSTNAME: "${DOMAIN}"
      SIGNUPS_ALLOWED: "false"
      ADMIN_TOKEN: "${ADMIN_TOKEN}"
      MYSQL_HOST: db
      MYSQL_PORT: 3306
      MYSQL_DATABASE: bitwarden
      MYSQL_USER: bitwarden
      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
      SMTP_HOST: "${SMTP_HOST}"
      SMTP_PORT: "${SMTP_PORT}"
      SMTP_FROM: "${SMTP_FROM}"
      SMTP_SSL: "${SMTP_SSL}"
      SMTP_USERNAME: "${SMTP_USERNAME}"
      SMTP_PASSWORD: "${SMTP_PASSWORD}"
    volumes:
      - ./bwdata/icons:/opt/bitwarden/web/assets/icons
    depends_on:
      - db

  # ── MySQL Database ──
  db:
    image: mysql:8.0
    container_name: bitwarden-db
    restart: unless-stopped
    command: --default-authentication-plugin=mysql_native_password
    environment:
      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD}"
      MYSQL_DATABASE: bitwarden
      MYSQL_USER: bitwarden
      MYSQL_PASSWORD: "${MYSQL_PASSWORD}"
    volumes:
      - ./bwdata/db:/var/lib/mysql
    networks:
      default:
        aliases:
          - db

networks:
  default:
    driver: bridge

# Create data directories
mkdir -p bwdata/db bwdata/icons

# Start
docker compose up -d

# Check logs
docker compose logs -f bitwarden

apt update && apt install -y nginx certbot python3-certbot-nginx

cat > /etc/nginx/sites-available/vault.yourdomain.com << 'EOF'
server {
    listen 80;
    server_name vault.yourdomain.com;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name vault.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/vault.yourdomain.com/chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;

    client_max_body_size 128M;

    location / {
        proxy_pass http://127.0.0.1:8089;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded Proto $scheme;
        proxy_buffering off;
        proxy_request_buffering off;
    }

    location /notifications/hub {
        proxy_pass http://127.0.0.1:8089;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_buffering off;
    }

    location /notifications/hub/negotiate {
        proxy_pass http://127.0.0.1:8089;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_buffering off;
    }
}
EOF

ln -s /etc/nginx/sites-available/vault.yourdomain.com /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

# Ensure your domain's A record points to your VPS IP
# Then request the certificate
certbot --nginx -d vault.yourdomain.com --non-interactive --agree-tos --email your@email.com

# Set up auto-renewal (Certbot usually configures this automatically)
systemctl status certbot.timer

docker compose restart bitwarden

docker exec bitwarden cat /etc/bitwarden/admin_token
# Or read from .env
grep ADMIN_TOKEN .env

# Create admin via CLI (recommended method)
docker exec -it bitwarden /usr/local/bin/bw register \
  --masterpasswordhash "$(echo -n 'your_master_password' | sha256sum | cut -d' ' -f1)" \
  --email "admin@yourdomain.com" \
  --token "$(grep ADMIN_TOKEN .env | cut -d'=' -f2)"

# Confirm Signups is disabled (set in .env)
grep SIGNUPS_ALLOWED .env
# Should output: SIGNUPS_ALLOWED=false

# Restart to apply
docker compose restart bitwarden

echo "123.45.67.89  vault.bitwarden.com" | sudo tee -a /etc/hosts

# Only allow specific IPs to access admin panel
# Add to Nginx config
location /admin {
    allow 1.2.3.4;  # Your management IP
    deny all;
    proxy_pass http://127.0.0.1:8089;
}

# Create backup script
cat > ~/bitwarden/backup.sh << 'EOF'
#!/bin/bash
BACKUP_DIR="/backup/bitwarden"
DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p $BACKUP_DIR

# Backup database
docker exec bitwarden-db mysqldump -u bitwarden -p${MYSQL_PASSWORD} bitwarden > $BACKUP_DIR/db_$DATE.sql
# Backup Bitwarden data directory
tar czf $BACKUP_DIR/bwdata_$DATE.tar.gz /root/bitwarden/bwdata/
# Delete backups older than 30 days
find $BACKUP_DIR -name "*.sql" -mtime +30 -delete
find $BACKUP_DIR -name "bwdata_*.tar.gz" -mtime +30 -delete
echo "Backup completed: $DATE"
EOF

chmod +x ~/bitwarden/backup.sh

# Add to crontab (daily at 3 AM)
(crontab -l 2>/dev/null; echo "0 3 * * * /root/bitwarden/backup.sh") | crontab -

# Only open necessary ports
ufw default deny incoming
ufw allow 80/tcp    # HTTP (redirects to HTTPS)
ufw allow 443/tcp   # HTTPS
ufw allow 22/tcp    # SSH
ufw enable

# Disable registration (already set)
SIGNUPS_ALLOWED=false
# Disable invitations
INVITATIONS_ALLOWED=false
# Disable password generation history (reduce data exposure)
PASSWORD_HISTORY_ENABLED=false

# Reset admin password (requires server access)
docker exec -it bitwarden /usr/local/bin/bw reset-admin-password \
  --newpassword "YourNewMasterPassword"

# Add to docker-compose.yml
  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    ports:
      - "127.0.0.1:9000:9000"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: $(openssl rand -base64 32)
    volumes:
      - ./bwdata/minio:/data

ATTACHMENTS_EXTENSION__S3__BUCKET=bitwarden-attachments
ATTACHMENTS_EXTENSION__S3__REGION=us-east-1
ATTACHMENTS_EXTENSION__S3__USE_PATH_STYLE=false
ATTACHMENTS_EXTENSION__S3__URL=http://127.0.0.1:9000
ATTACHMENTS_EXTENSION__S3__KEY=minioadmin
ATTACHMENTS_EXTENSION__S3__SECRET=your_minio_secret

cd ~/bitwarden
docker compose pull
docker compose up -d

./backup.sh

# Check container status
docker compose ps

# View live logs
docker compose logs -f

# Check resource usage
docker stats bitwarden