Vaultwarden Dual Backup (Database + /data)

This template deploys three services:

• postgresql: database backend
• vaultwarden: password manager + /data encrypted backup worker
• vaultwarden-backup: scheduled PostgreSQL backup service

Why two backup paths

Zeabur volumes are isolated per service, so cross-service volume sharing is not supported. Therefore this template uses:

• vaultwarden itself to back up /data
• vaultwarden-backup to back up PostgreSQL

Default schedule

• Database backup cron: ${BACKUP_CRON}
• /data backup interval: every 12 hours (43200 seconds)
• Retention days: ${BACKUP_KEEP_DAYS}

Backup output paths

• Database dumps: s3://${S3_BUCKET}/vaultwarden-db/
• Encrypted /data archives: s3://${S3_BUCKET}/vaultwarden-data/

/data backups are encrypted with AES-256-CBC and PBKDF2 using BACKUP_PASSWORD.

Disaster recovery order

1. Stop vaultwarden.
2. Restore PostgreSQL from the latest DB backup.
3. Download and decrypt /data backup:
   • openssl enc -d -aes-256-cbc -pbkdf2 -pass pass:<BACKUP_PASSWORD> -in <file>.tar.gz.enc -out <file>.tar.gz
   • extract to /data
4. Start vaultwarden and verify login, items, and attachments.