$ mkdir vaultwarden && cd vaultwarden
$ vim compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:1.35.1 # 显式指定版本号，防止使用latest拉取到n年前的版本
    container_name: vaultwarden
    restart: always
    environment:
      DOMAIN: "https://example.com" # 使用反向代理时必填；您的域名；Vaultwarden 需要知道它是 https 才能正确处理附件
      SIGNUPS_ALLOWED: "true" # 创建账户后，使用 "false" 停用此选项，这样就不会有陌生人注册了

    volumes:
      - ./vw-data:/data # : 前面的路径可以修改
    ports:
      - 1145:80 # 您可以将 1145 替换为您喜欢的端口



$ sudo docker compose up -d

$ sudo vim /etc/nginx/sites-available/example.conf

# 默认服务器块 - 拒绝所有其他访问
server {
    listen 1146 ssl default_server; # 1146改为外网访问使用的端口
    listen [::]:1146 ssl default_server; # 1146改为外网访问使用的端口

    ssl_certificate /path/to/cert.pem; # ssl证书公钥
    ssl_certificate_key /path/to/private.key; # ssl证书私钥

    # 默认拒绝所有请求
    return 403;
}

# vaultwarden 专用服务器块
server {
    listen 1146 ssl; # 1146改为外网访问使用的端口
    server_name example.com; # 保持与compose.yml里设置的一致

    ssl_certificate /path/to/cert.pem; # ssl证书公钥
    ssl_certificate_key /path/to/private.key; # ssl证书私钥

    # SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # 安全头
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    # 反向代理配置
    location / {
        proxy_pass http://127.0.0.1:1145; # 1145改为vaultwarden的端口
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 限制只允许特定域名访问
        if ($host != 'example.com') { # 保持与compose.yml里设置的一致
            return 403;
        }
    }
}

$ sudo ln -s /etc/nginx/sites-available/example.conf /etc/nginx/sites-enabled/example.com.conf

$ sudo nginx -t


nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful


$sudo nginx -s reload

$ sudo mount /dev/nvme0n1p4 -o subvolid=0 /mnt #挂载父卷
$ sudo btrfs subvolume create /mnt/@swap

$ sudo btrfs filesystem mkswapfile --size 16G /mnt/@swap/swapfile
$ sudo chattr +C /mnt/@swap/swapfile #禁用CoW
$ sudo swapon /mnt/@swap/swapfile

$ cat /proc/swaps
Filename                Type        Size        Used        Priority
/mnt/@swap/swapfile                          file        16777212    0        -2

# 首先将@swap子卷挂载到/swap
UUID=f3e8494a-ff37-4932-9085-e03dce5ab458     /swap        btrfs        subvol=@swap    0 0

# 然后启用swapfile
/swap/swapfile        none        swap        sw    0 0

$ cat /sys/module/zswap/parameters/enabled
Y

$ sudo vim /etc/mkinitcpio.conf


MODULES=(zstd zstd_compress)

$ sudo mkinitcpio -p linux

$ cat /sys/module/zswap/parameters/compressor
zstd

$ sudo vim /etc/mkinitcpio.conf


HOOKS=(base udev ... resume)


$ sudo mkinitcpio -p linux

$ sudo btrfs inspect-internal map-swapfile /swap/swapfile -r
2982144

resume=UUID=f3e8494a-ff37-4932-9085-e03dce5ab458 resume_offset=2982144 hibernate.compressor=zstd