Stop Exposing Your Vault: Secure NodeWarden with Cloudflare

The moment your NodeWarden is exposed to the public on the Internet, it starts attracting thousands of automated bots scrapping for vulnerabilities 24/7. To protect your sensitive data, You need to put NodeWarden instance in the maximum lockdown possible.

To secure your NodeWarden instance, you can use one of two Cloudflare features:

• Cloudflare IP Access Rules: Allows you to block, challenge, or permit traffic based on specific IP addresses or countries.
• Cloudflare Zero Trust (Recommend): Acts as a secure gateway that makes your NodeWarden instance completely invisible to the public, only letting authorised users through.

Why we recommend Cloudflare Zero Trust

We strongly advise using Cloudflare Zero Trust since IP Access Rules are tied to IP addresses or countries, meaning you need to manually update the your rules every time you travel or if you have a dynamic IP address. Cloudflare Zero Trust on the other hand relies on your identity, not your location—giving you seamless, secure access to NodeWarden.

Configuration Guide

Follow these steps to configure Cloudflare Zero Trust for NodeWarden.

Phase 1: Getting Started

1. In your Cloudflare dashboard, click on 'Zero Trust' from left menu
2. Click on 'Access controls' then click on 'Applications'
3. You may be asked to 'Choose a plan'.
4. Click on the 'Choose a plan' button and choose the 'Zero Trust Free'.

Phase 2: Secure Your Web Interface

First, we will create an application to protect the NodeWarden web dashboard.

1. Click on 'Create new application' to create the first application
2. Choose the 'Self-hosted and private'
3. Enter the domain name of the NodeWarden.
4. Click on 'Create new policy' to create a policy.
5. Select 'Emails' and enter an email under 'Policy rules'.
6. Enter a name and select 'Allow' under 'Policy details'.
7. Click 'Save Policy' to create the policy.
8. Enter a name and select '1 month' under the 'Details' section.
9. Click on 'Create' to create the application.
10. Test it: Open the domain on the web browser, you will see the 'Cloudflare Access' asking for email.

Phase 3: Allow BitWarden Clients Syncing (API Bypass)

The desktop and mobile BitWarden apps cannot process Cloudflare's email login screen, we need to create a second application that allows traffic to bypass the login screen specifically for API syncing.

1. Go back to Applications and click Create new application, choosing Self-hosted and private again.
2. Enter the 'api/', 'identity/', 'notifications/', and 'icons/' in the Destinations.
3. Click on 'Create new policy' to create a policy.
4. Select 'Everyone' under 'Policy rules'.
5. Enter a name and select 'Bypass' under 'Policy details'.
6. Click 'Save Policy' to create the policy.
7. Enter a name and select '1 month' for 'Session Duration'.
8. You should have 2 applications created.

Final thought

Just remember that Cloudflare is your outer shield. To maintain a truly secure vault, ensure you are still using a strong master password, utilising Two-Factor Authentication (2FA) , and keeping your Cloudflare account secure.