vaultwarden-backup

This script saves the Vaultwarden SQLite database, and sends a message to a Telegram bot.

Introduction

The SQLite database file (db.sqlite3) stores almost all important Vaultwarden data/state (database entries, users, organizations, device metadata...), with the main exception being attachments, which are stored as separate files on the filesystem.

You should generally use the .backup command in the SQLite CLI to back up the database file. This command uses the Online Backup API, which SQLite documents as the best way to back up a database file that may be in active use. If you can ensure the database will not be in use when a backup runs, you can also use other methods such as the .dump command, or simply copying all the SQLite database files (including the -wal file, if present).

You can learn more here: https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault

Requirements

Software

It is clearly necessary to have deployed a Vaultwarden instance on your server. I wrote an article about this topic here: https://illuad.fr/2020/06/11/install-vaultwarden.html

Since a message is sent to a Telegram bot, it is necessary to have one configured. I wrote an article about this topic here: https://illuad.fr/2020/10/27/get-a-telegram-alert-on-a-ssh-login-with-pam.html

System

This script can run on any GNU/Linux machine.

This script uses sqlite3 command, so make sure it is installed on your system.

Installation

Since this script must be executed with root rights, it is a good practice to place it in /usr/local/sbin/.

curl -LOsSf https://gitea.illuad.fr/adrien/vaultwarden-backup/raw/branch/master/vaultwarden-backup.sh
sudo mv vaultwarden-backup.sh /usr/local/sbin
sudo chmod 750 /usr/local/sbin/vaultwarden-backup.sh

Create the logs' directory.

sudo mkdir -p /var/log/backup/vaultwarden-backup

Configuration

This script requires the configuration of 2 variables to work: key and chat_id.

Variables key and chat_id correspond to the API key and the chat id obtained during the bot creation process.

Fast variables setting

For the key variable.

sudo sed -i "s/key=/key=<your_key>/" /usr/local/sbin/vaultwarden-backup.sh

For the chat_id variable.

sudo sed -i "s/chat_id=/chat_id=<your_chat_id>/" /usr/local/sbin/vaultwarden-backup.sh

Automation

Running this script automatically is a good idea, here is what you should have in the cron jobs of the root user.

sudo crontab -l
*/15 * * * * /usr/local/sbin/vaultwarden-backup.sh

Every 15 minutes, the script will save the Vaultwarden SQLite database into /var/local/vaultwarden/backups/.

If you keep all the backups, the storage space will quickly become full, so it is necessary to delete them as time goes on.

sudo crontab -l
*/16 * * * * /usr/bin/find /var/local/vaultwarden/backups/ -type d -mmin +60 -exec rm -rf {} \;

Every 16 minutes, the script will delete the backups that are 60 minutes old.

Restore a backup

Make sure Vaultwarden service is stopped.

sudo systemctl stop vaultwarden.service

Replace <date> with the folder name (the date you want to restore the data).

sudo cp /var/local/vaultwarden/backups/<date>/backup.sqlite3 /var/lib/vaultwarden/data/db.sqlite3

Start Vaultwarden service.

sudo systemctl start vaultwarden.service