Everlock One server for your digital life

Documentation

Vault backend

The vault backend is Everlock's Bitwarden-compatible password manager.

It provides a hosted, end-to-end-encrypted password vault over HTTP, backed by Everlock's versioned storage. Official Bitwarden clients — the desktop app, the browser extensions, the mobile apps, and the bw command-line client — connect to it directly, with no plugins or forks.

What it is for

Use the vault backend when you want:

  • your own password manager on your own hardware, spoken to by the clients you already use
  • zero-knowledge storage: the server holds only client-encrypted ciphertext and a login verifier, never your master password or any plaintext
  • passwords, cards, identities, secure notes, SSH keys, folders, Sends, and file attachments, with real-time sync across devices
  • an auditable history of every change, because each write is a Git commit

How it fits in the system

Like the OCI registry (apimeister-registry) and the image library (apimeister-photos), the protocol, crypto, and domain logic live in a standalone, clean-room engine — apimeister-vault — and this backend is the thin Everlock adapter. It:

  • mounts the vault's API into frontend-http, selected by vhost
  • bridges the vault onto a per-instance versioned-storage store, so every account, item, and folder is an auditable commit
  • gates who may register a vault account

The HTTP frontend owns host routing, TLS, and wire transport.

Authentication, in one line

The vault runs its own master-password and token flow. Everlock's HTTP Basic middleware is bypassed for the vault's vhost — Bitwarden clients speak their own protocol, and the master password is an independent secret the server never sees. Everlock's role is to gate who may have a vault account (see Access model).

Typical operator flow

  1. enable the backend
  2. assign it a vhost (public, so clients get real TLS)
  3. allow registration — invite-gated by default, or open it explicitly
  4. register an account from a Bitwarden client and set a master password
  5. add and sync items across your devices

Pages