---
description: Configuration with Cloudflare, Cloudflared, NPM and Webtop
---

# Vaultwarden on Oracle Cloud VPS

{% tabs %}
{% tab title="Related Videos" %}
{% embed url="https://www.youtube.com/watch?v=cUDAwYhwr2w" %}
{% endtab %}

{% tab title="Useful Links" %}
{% embed url="https://bitwarden.com" %}

{% embed url="https://github.com/dani-garcia/vaultwarden" %}

{% embed url="https://www.oracle.com/au/cloud/free" %}
{% endtab %}

{% tab title="Credits" %}
|                        |         |
| ---------------------- | ------- |
| Writer                 | Norkz   |
| Testing / Proofreading | Norkz   |
| Testing / Proofreading | Sycotix |

**Thank you for choosing to collaborate with** [**IBRACORP**](https://ibracorp.io) :pray:
{% endtab %}
{% endtabs %}

**Please read our disclaimer** [**https://docs.ibracorp.io/#disclaimer**](https://docs.ibracorp.io/#disclaimer)**.**

## Vaultwarden Oracle Cloud Free VPS

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FOg8iekv8Dyv5U16Z1mK0%2Fimage.png?alt=media\&token=4b1feba7-8136-414b-9594-4c44e5681128)

## Assumptions <a href="#arolcxe0i15c" id="arolcxe0i15c"></a>

The following videos were watched, understood and previously implemented:

* &#x20;[Nginx Proxy Manager](https://www.youtube.com/watch?v=h1a4u72o-64\&t=38s)&#x20;
* &#x20;[Cloudflare](https://youtu.be/c6Y6M8CdcQ0)

## Requirements <a href="#z1bgyjuhmai" id="z1bgyjuhmai"></a>

* Oracle Cloud account already signed up and approved. (Oracle takes up to 5 business days to approve accounts, It took mine 4 days since it was during the holidays, but it could be quicker.)
* Putty already installed on your system. (We need this for SSH and port forwarding.)
* Make sure to NOT skip any STEPS for any reason.

## Placeholders

* `USE`
* `P@ssw0rd!`
* `proxy`
* `Proxy`
* `ubuntu`
* `SOMETHING`
* `DOMAIN`
* `non-root user`
* `RANDOM-NUMBERS-FOR-NOW`
* `CLOUDFLAREDIMAGEID`
* `TUNNELNAME`
* `TUNNELUUID`
* `n-p-m.DOMAIN.COM`
* `beta`
* `domain.com`

## Oracle Cloud and SSH Steps <a href="#la5jp5tnimjw" id="la5jp5tnimjw"></a>

1. Go to your Oracle Cloud account.
2. Once you are in your account, click on the top left hamburger that looks like 3 lines parallel on top of each other.
3. After clicking that, click on `Compute`.

![Now you will see the screen below.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FlFdeUN1eAA0qr11hw3UN%2Fimage.png?alt=media\&token=fb8888a1-afb7-4d1e-853b-792b7ea12bc9)

![Click on Instances and you will see the following screen:](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FIQQX9bmQiTuFYc8i2NEx%2Fimage.png?alt=media\&token=c8db5e1d-966a-48ba-bbc8-0c92618d5985)

![As shown, click on Create Instance.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F1UyAywatme5VcpURzqaX%2Fimage.png?alt=media\&token=c1de89b3-51df-4b28-b8e8-a44a28a05996)

![Now you can change the instance name if you want, after that click on Edit, next click on change Image, now you will need to click the ubuntu image as shown below.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F3C1Wmk9EM5wSHygX19Is%2Fimage.png?alt=media\&token=72491c54-2795-4baa-ab53-c7eda76d128e)

![Now click select image.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FeYvzbRaC1TFqXHdc7IKN%2Fimage.png?alt=media\&token=042da72f-a0ee-406b-b034-460c261e0ed2)

![Change the shape to Ampere 4 cores and 24gb from the default Amd 1 core and 1gb.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F8r4Rxw8OJBtmegorHwnO%2Fimage.png?alt=media\&token=f4271adc-eb85-47b3-95f6-b3a099ee1eec)

![Click select shape once done.&#x20;
Scroll down and click the edit button for Networking and put the network as create new virtual cloud network and create new public subnet.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F3YUIDOFlrNYJ6l1R6ZTR%2Fimage.png?alt=media\&token=9a7b4672-66e2-4c5c-9df4-fa3b75857a44)

![After that click collapse andscroll down to Add SSH Keys.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FIPuk7t9yQk8GEDCaPTfo%2Fimage.png?alt=media\&token=4eff90ba-e2f1-4f69-8a60-d504a0632293)

![Click Paste public keys now we will generate the key using Puttygen, it comes with Putty when you install it.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FkGCQBDg7QWaSD1vbRjTj%2Fimage.png?alt=media\&token=af7a3b9b-0dc1-457a-9c80-db51f1077ccc)

![Generate your key, copy the entire public key shown, input a key passphrase that you will remember, lastly click on Save private key, save it somewhere secure and that you can access.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fc24rBOrz8AjswTAbvNyO%2Fimage.png?alt=media\&token=cf11392d-3273-4f7d-9ddf-0e86bdb7a1f1)

![The key that we just copied will be pasted in the Public paste keys.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FEkXQ3RzrjsxZQPcnw57L%2Fimage.png?alt=media\&token=25ba763c-76ce-4b95-bffb-ad2fd2c69590)

![Now we create the VPS, after it’s created we wait 5 minutes and reload the site since it will take a bit for it to process the creation of the VPS.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FGZFHbgTN3q9Vud8HiCnA%2Fimage.png?alt=media\&token=733e5300-cdb3-4f7e-843e-96c951eec620)

![After a refresh the page will look like this, copy the Public IP address of the server.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F7vMSKYLt1asKtI7HNyqD%2Fimage.png?alt=media\&token=bccd1ac5-6344-4c7d-9ba4-45f121b43755)

1. Open Putty and paste the IP address you copied into the SSH bar. Name the session, and click save. After that, click on the `+` icon beside SSH and then click on `Auth`.
2. Browse for the Private key you saved earlier and open it. Now in Putty, click the `open button`.
3. A terminal will appear and another box in front of it asking for permission, click `Accept`.
4. Now it wants you to login and by default the user is u`buntu`, now input the private key password that we input before saving it.

We are now SSH’d into the VPS server.&#x20;

![](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### Port Forwarding to Local Machine

Let's port-forward Webtop and N.P.M using Putty so only your PC/Machine can access it.&#x20;

1. Now we right-click the top bar of Putty and click `Change Settings`.

![](https://lh4.googleusercontent.com/J00w3GQXDZ9bcqZWpZZJkY6gmWASB5q7GGN6QtMDOWGs6FzQgbIr8AwgbeADl0GkFcOj6WyP15_-tMldDZr1Mig9Q7NoY6xBuL3VgG3QAeaXMoa-D7Oqc6xhgSsm8gWDsbASpsdL)

2\. We now click the `+` sign beside SSH and then click `Tunnels`.

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FlRpdCO1BOnjENW9Fk771%2Fimage.png?alt=media\&token=5fa4facb-c27b-4205-ace0-dcf7c77efb51)

3\. We are going to input the port of Webtop into _Source port_ which is `3000` and we are going to put `127.0.0.1:3000` for the destination.

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FcmVxkElpOWNdfFH46nLj%2Fimage.png?alt=media\&token=846b5046-7485-4167-b1da-a119d3f2831b)

4\. Furthermore, we will now click the `Add` button and add N.P.M. as well if you want to do it from that WebUI instead of Webtop which is `HIGHLY` recommended since it's much easier to add your Cloudflare Origin Certification.

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FZsjH0iK9TTdTRJ3ifkQE%2Fimage.png?alt=media\&token=d3f22999-228a-44d4-9d5f-f2ef77b62120)

The following is the end result:&#x20;

![Click Apply at the bottom.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F7PqYPNPgyrskiduKchon%2Fimage.png?alt=media\&token=aac97e93-2879-4ade-b75b-adffc886cd56)

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FMElN5gW7H6A78qiCMd4q%2Fimage.png?alt=media\&token=be3d37b4-81a7-4a1c-b264-6a15771dcd02)

### Setting up the VPS for installation <a href="#m8iimuc11ozk" id="m8iimuc11ozk"></a>

Now that we are SSH’d into the VPS, we will run a couple of commands. Run the following:

```
sudo -i     #This is to become root user.
apt-get update && apt-get upgrade #Upgrade and update all your software. #Enter on `Yes` two times when it prompts you.
```

We are now going to install Docker and Docker-compose.

* Run these commands:

(Any of these commands that prompt you for `Y` or `N`, just type `Y` and click enter.)

```
apt-get install \
    ca-certificates \
    curl \
    gnupg \
    lsb-release
```

```
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
```

```
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
```

```
apt-get update
apt-get install docker-ce docker-ce-cli containerd.io
apt-cache madison docker-ce
sudo curl -L "https://github.com/docker/compose/releases/download/v2.2.2/docker-compose-linux-aarch64" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
```

We now have both of them installed, to make sure we have them installed, run the following:

```
docker version
docker-compose version
```

Both output the version. Now let's go install Webtop, Nginx Proxy Manager, and Vaultwarden.

Run the following commands:

```
cd /home/ubuntu/
mkdir containers
cd /home/ubuntu/containers/
mkdir {webtop,npm,vaultwarden} #This command makes the three directories we need.
```

![](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### Install Fish Shell – Optional&#x20;

```
#We are going to install `fish` which is and user-friendly command line.
apt-get install fish #Click `Y` and Enter.
#We are going to make it the the default shell.
usermod --shell /bin/fish USER #Replace the Placeholder to `root`. Do the same for `ubuntu` if you want.
#If you want to change back then run the following command:
usermod --shell /bin/bash USER
#If you don't want to change users to have `fish` then run the following:
fish
```

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### **Webtop** installation – Optional Shell – Optional

{% hint style="danger" %}
Important notice: The default `abc` user isn't supposed to be removed or changed, since it already has config permissions and other access that is required to use webtop.&#x20;

`DO NOT CHANGE PLEASE!`
{% endhint %}

Run these commands:

```
sudo usermod -aG docker ubuntu #Gives our user docker access.
docker network create proxy #Creates the network named `proxy`.
cd webtop #Directory change.
nano docker-compose.yml  #To build our docker-compose file.
```

We are going to use the `.env` file, so it’s not commented out and only change your timezone PUID AND PGUID depending on the user.&#x20;

If you are using the default Ubuntu user then it’s the same number for both that is already there and if you want to know your ID then run this command:

```
id USER
```

In the docker-compose, we are going to paste the following:

```
---
    version: "2.1"
    services:
      webtop:
        image: ghcr.io/linuxserver/webtop:ubuntu-mate #choose your flavor
        hostname: webtop
        container_name: webtop
        #privileged: true #optional but not needed unless you are running kde or i3 or other tools.
        environment:
          - PUID=1001 # based on id
          - PGID=1001 # based on group
          - TZ=America/Chicago # your timezone
          - FILE__PASSWORD=./password #This is used if you use the .env file and want a permanent password change.
        volumes:
          - ./../../:/mnt/share #This will mount the relative path to the path in the container. 
          - /opt/appdata/webtop:/config #All Container Directory directory.
          - /var/run/docker.sock:/var/run/docker.sock #optional only if you need access to docker within this container.
        ports:
          - 3000:3000
        shm_size: "2gb" #optional but set to 1GB or higher to prevent browser crashes
        restart: unless-stopped
        #If .env is used uncomment this line.
        env_file:  #only necessary if you want to change the password, see .env file
          - .env
    networks:
      default:
        external: true
        name: proxy
```

Now back to the docker-compose.yml file, make sure that you save it with `CTRL+X, Y and ENTER`.

Run this command for the `.env` file.

```
nano .env
```

In here, paste this in and change the placeholder. Later we will define the same password in the Webtop system to the user `abc`.

```
PASSWORD=P@ssw0rd!  
```

Save the file and run:

```
docker-compose up -d #This will compose the files and install webtop.
```

![](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### Password change of Webtop

Go into your browser and input `127.0.0.1:3000` and login \
\
\
\
We defined the password in `.env` file now we need to do the same in the Webtop terminal.

This method doesn't permanently change the password of the container, but this method [here](#for-permanent-password-change-even-if-you-move-the-container) does.

The terminal can be found if you click `Menu` in the top left corner of the webpage, hover over `System Tools` and click `MATE Terminal` as shown below.

&#x20;&#x20;

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fz8HGkuJWHV0TD6j5SAxz%2Fimage.png?alt=media\&token=6e4b93b8-fc5e-4fc7-861f-801563eb3bd3)

Now, to change your password to the specified user, `abc` we need to run the following command.

```
sudo passwd abc  #Running this as root to change the password of user `abc`.
```

![Password is now updated and now you can login as user  abc and your new password that should be the same as the one in the .env file.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F3s6SK9F4LAzw7a15SN6n%2Fimage.png?alt=media\&token=2aa7b4a6-3ba4-4475-8961-d36a925cc278)

#### FOR Permanent PASSWORD change, even if you move the container

```
#While the container is running run:

docker exec -it webtop passwd abc

#Input the password you listed in the `.env` file.
```

The command above and below will force the `webtop5.games.com` site you put for Webtop to go to the following screen below since we changed the password permanently, which is highly recommended you do.



If you ever lose your password, you can always reset it by execing into the container as root:

```
sudo docker exec -it webtop passwd abc
```

By default, it performs all logic for the `abc` user and I recommend using that user only in the container, but new users can be added as long as there is a `startwm.sh` executable script in their home directory. All of these containers are configured with passwordless sudo,  I do not recommend ever publishing Webtop ports to the public Internet. Which we take them off after Argo Tunneling the containers.&#x20;



In here you don't change the `Session` section, only input the default user `abc` and your new password, and you will be able to enter the Webtop panel.

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FuT9idEx3yS3kVG6QnIGy%2Fimage.png?alt=media\&token=bf62e272-6aa7-4a12-a7f5-3433d587e1d3)

## **Installation of** N.P.M.

Run these commands:

```
cd /home/ubuntu/containers/npm/
nano docker-compose.yml
```

In the `yaml` paste the following below:

```
version: "3.8"
services:
  app:
    container_name: nginx-proxy-manager
    image: jc21/nginx-proxy-manager
    hostname: nginx-proxy-manager
    restart: unless-stopped
    ports:
      # Public HTTP Port:
      - 80:80
      # Public HTTPS Port:
      - 443:443
      # Admin Web Port:
      - 81:81
    environment:
      # Uncomment this if IPv6 is not enabled on your host
      DISABLE_IPV6: 'true'
    volumes:
      # Make sure this config.json file exists as per instructions below:
      - ./config.json:/app/config/production.json
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - db
    healthcheck:
      test: ["CMD", "/bin/check-health"]
      interval: 10s
      timeout: 3s
  db:
    container_name: proxy-mariadb
    image: yobasystems/alpine-mariadb:10.5.11
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: 'SOMETHING'
      MYSQL_DATABASE: 'npm'
      MYSQL_USER: 'proxyManager'
      MYSQL_PASSWORD: 'SOMETHING'
    volumes:
      - ./data/mysql:/var/lib/mysql

networks:
  default:
      name: proxy
```

Save the file.

Run the following command.

```
nano config.json
```

Paste the following:

```
{
  "database": {
    "engine": "mysql",
    "host": "db",
    "name": "npm",
    "user": "proxyManager",
    "password": "SOMETHING", #Only change the password to what you put in the `docker-compose.yml` file.
    "port": 3306
  }
}
```

Save the file and run:

```
docker-compose up -d
```

## **Vaultwarden Installation**

Run the following commands:

```
cd /home/ubuntu/containers/vaultwarden/
nano docker-compose.yml
```

Now paste the following:

```
version: "3.8"
services:
  vaultwarden:
    image: vaultwarden/server:latest
    hostname: vaultwarden
    container_name: vaultwarden
    restart: unless-stopped
    ports:
    # Port for WebSocket notifications
      - 3012:3012
    environment:
    # Enable WebSocket notifications.
      - WEBSOCKET_ENABLED=true
    volumes:
      - ./data:/data

networks:
  default:
    external: true
    name: proxy
```

Save the file.

Run:

```
docker-compose up -d
```

## N.P.M. Setup



Since we already have the local ports open for NPM we just need to open up a browser on any computer and input the `127.0.0.1:81` we will then follow the same steps taken [here](#n.p.m.-setup-in-webtop-or-your-browser).&#x20;

![
](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### N.P.M. **Setup in Webtop or your Browser**

\
As shown in the above image, we add it first and then click apply. Now we have a Webtop port forwarded, and we are now going to access it by inputting the `127.0.0.1:3000` in a web browser on your system, then you will be redirected to Webtop. In Webtop, open Firefox which is located on the top left of the screen and input in the address bar this `PUBLIC_IP_OF_VPS:81` This is, so we can access NPM.

![](https://lh6.googleusercontent.com/cw1pJMz6UnoBa6iIV66pcLOkcH6Hznju3-GOB0GYTVzav2PdK1ZQZCAIJHfoJx-8s21nLcFymcJxnpOowQmDEeFbxTNgl0PFjzcUzPS2sNHSRCK0r--jGT7V7ivMUusTHjon_q8_)

5\. We now sign in with the default credentials, which are. `admin@example.com` and `changeme`

6\. Now when we sign in it will ask us to edit the user account which we put our own email and password on the next screen.

![](https://lh3.googleusercontent.com/yx4_zKlzDdLxtS6Mil-WTek39eqOnziUi1iIMRlL4T33poXsRMzXTnoYJoBl54qh9WpzSurF6fG5OnpeTQ7CllPa2o6ECRc59zybh9kC5iiGAujh2-P27NfvZ7PAbStCxMxlsKwF)

![](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### Creating an Origin Certificate

7\. After that we will open a new tab, go to Cloudflare and login. Then we are going to make a new origin certificate, go to the next page from below:

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FlKSLWY5DRBHr9vdimOlB%2Fimage.png?alt=media\&token=5cabb246-2a0e-491a-b203-b937b5a8d537)

8\. We now need to create a file that ends with `.pem` to put the certificate origin inside it, and then we create a file that ends with .key we paste in the private key in there.

![](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F7Cs0nja8W1qvtihSzOX0%2Fimage.png?alt=media\&token=ec3c8551-1bab-44bc-a461-74f307e60d7e)

9\. Now we click `Ok` and head back to NPM, go to the SSL cert. Tab, click add SSL Cert and click custom.

![](https://lh4.googleusercontent.com/QpTvGKJpil_PIEyrgeHlVF3kM4vLqQqoWk-pkgNv-lfcC3ITE15qLxq3w6nERIDuTB8ECM_KPAfD8SsN3i4mnsQn7S57pOmkB8u8ME55wUibkvhjYyNKZ-hajKM3U1F-zfivoYTe)

10\. We will now put the .key file we have into the key section and the `.pem` into the certification section and then click `Ok` to add it.

![](https://lh3.googleusercontent.com/k5CKAOoanRC-FzQoV1xtz_2XUgTPBnIYUAGCdmwuS-d9aO6sQjdfDPuLp0PtvITUhFJNoDq8ge2oYQlf_N_qIV9Khy0H6oUgYUXndxR5G7gmjAtXvB-ucxdyLadmwl52podfKwBl)

![](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2Fbc0BCRS05VJ7ttKVEFhe%2Fimage.png?alt=media\&token=58de1c75-c7e1-4edc-88b2-c79811b5e1d0)

### Cloudflare's configuration for VPS

11\. We now head back over to Cloudflare and set up our DNS names. We will put an A name to whatever name we want and then the IPV4 section will be the PUBLIC\_IP\_OF\_VPS as shown below and proxy it.

![This A name will be changed to a CNAME and the name will be the same but the IPV4 address will be different. That will be for the tunnel.](https://lh4.googleusercontent.com/hl4hX-Dz7hOgCrak0Igl8wJEInY37hRiPTXDh-MhOT1xfpFIqvCglhPcyUUJv75xspGwuKHKjKe-NVRHmmrEQCqiOKYTXK_Lcj1aRPyCq8pSGu2MX-04h-Kv8J1EkeC3UfaNDeNi)

12\. Furthermore, we will now put our 3 CNAMES that we want to use for our containers.

![](https://lh3.googleusercontent.com/R_w2ltMhEH-O9yS5xqb5dZ5JtSINISiEf_mpzTvLpJenxtbfU6ONM9sfxJPzSJSAjYVLhUvqIDxgyXUESYmeaOV1PYhgso1Yde-rypfko5KY8Qtsz7jvPOFnm_ArtxleT2LnkTH8)

![](https://lh6.googleusercontent.com/jXoet_eOixEd_80sCIwex6Conxi_kAdHzphKVYeaOWRRy4YsC1w8bNMp6PII7PYHL4JqWEa0qOhgYZYeN7oo_Z8PwHVDsCa8a-DlTuof7Df9-kiMBvxSrZOl1k5E5IPeKuMKnJvj)

![](https://lh6.googleusercontent.com/6pR2oc7gE337gcRUGyp7RREZPCz4vqwc3yXW_OXlUiJiZksu9TbMx-GB-_LzatixT-lz1gxcD76AneFdlPcpp13fVdhONtt1YcjpmeSACF3Zlz2jl_t8FN9t3MC9ltCEMai9CMDj)

13\. Now since we have that setup, let’s head back to NPM and go to the proxy tab. Below is how all the proxies should look like once you proxied all of them.

![
](https://lh4.googleusercontent.com/SeTdvdpo1T_n0cb23Wd_JCVNUJWEBMp1Fam5Y1OqBpjSq3s504-csXSqU8Ly-6Zv_dQ-jp7E4NjeKX_UGSgJfyPl2UVn2FULqMABsUBzP2jrA__WHIIaikuOfurU5XbIj_03x6S2)

For anyone wanting to know why I didn’t use `beta.games.com` with the subdomain in front of it for any of the containers.

It is due to Cloudflare already linking each subdomain to beta and that is linked to the VPS IP and your main domain, which in this example it would be `games.com` for me.

## Argo Tunneling:ARM64

{% hint style="danger" %}
This Argo Tunneling section `NOT` required but is `HIGHLY` recommended having implemented into your VPS for security reasons.&#x20;
{% endhint %}



#### Run the following commands:&#x20;

```
sudo -i  #Become root.
cd /home/ubuntu/containers/
mkdir cloudflared #We are now going to make the folders for Cloudflared.
cd /home/ubuntu/containers/cloudflared/
mkdir data
```

The following commands are going to be used to install and configure Cloudflared:

Please read and follow instructions carefully.&#x20;

```markup
#I have tried running the `chmod -R 775` command so not every user may have access to the specified folder, though that didn't work and the following did:
sudo chmod -R 777 /home/ubuntu/containers  #This will allow everyone to modify the folders in `containers` directory.
nano docker-compose.yml
```



We are going to put the following in the docker-compose and when we compose it, the container will not work, which is fine. What we will want is the image, and then we will go back to the container to edit a couple of things.

```
version: "3.8"
services:
  cloudflared:
    build: https://github.com/cloudflare/cloudflared.git
    container_name: cloudflared
    restart: unless-stopped
    network_mode: "host"
    environment:
      - PUID=1001
      - PGID=1001
    command: tunnel --config /home/nonroot/.cloudflared/config.yaml run RANDOM-NUMBERS-FOR-NOW  #We are going to replace the placeholder later.
    volumes:
      - ./data:/home/nonroot/.cloudflared/
    extra_hosts:
      - "beta.DOMAIN.COM:127.0.0.1" #This is needed so that cloudflare may link this to the certificate so it's detected as valid.

```

Save the file with Ctrl+X, Press Y and then ENTER.



{% code title="Run the following:" %}
```
docker-compose up -d  #This could take 2 minutes for the image to build.
docker image ls #Find the cloudflared Image and copy/highlight the `Image ID`.
docker run -it --rm -v /home/ubuntu/containers/cloudflared/data:/home/nonroot/.cloudflared/ CLOUDFLAREDIMAGEID tunnel login #Make sure to replace the placeholder with your Cloudflared Image.
```
{% endcode %}

![Copy/highlight the link, go to it and authenticate your domain with it so we can have out cert.pem file in the /data folder.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F87gqTxSYCG8yJoPSGlBm%2Fimage.png?alt=media\&token=f1ca74c5-03d5-4107-a400-38a14f56faf8)



We are now going to make the tunnel and the `config.yaml` file.

```
docker run -it --rm -v /home/ubuntu/containers/cloudflared/data:/home/nonroot/.cloudflared/ CLOUDFLAREDIMAGEID tunnel create TUNNELNAME #This is to make the tunnel.
```

![Copy/highlight the tunnel-ID and let's go into Cloudflare. ](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F5Yjh70HveP26mUDV86D6%2Fimage.png?alt=media\&token=6b84eea7-6ddc-4ea8-8b47-75951226813e)

![Here I removed the A name that was to the IP-OF-THE-VPS and made a CNAME pointing to the TUNNELUUID with the same NAME. The tunnel CNAME used to be an A name from this part.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2F0d7NBGVuq24uEmZtsvIO%2Fimage.png?alt=media\&token=b090a72a-d2ae-4855-8320-9fbbe6b01ed2)



To make the`CNAME` for the tunnel, please have it like the following:

|  TYPE | NAME |            VALUE            | PROXYSTATUS |  TTL |
| :---: | :--: | :-------------------------: | :---------: | :--: |
| CNAME | BETA | TUNNELUUID.cfargotunnel.com |   Proxied   | Auto |

***

Now let's go back to the Putty Terminal and run the following:

```
cd data
nano config.yaml #In here paste the following:
```

```
tunnel:  TUNNELUUID
credentials-file: /home/nonroot/.cloudflared/TUNNELUUID.json

# NOTE: You should only have one ingress tag, so if you uncomment one block comment the others

#forward all traffic to Reverse Proxy w/ SSL
ingress:
  - service: https://IPV4_OF_VPS:443
    originRequest:
      originServerName: n-p-m.DOMAIN.COM
#forward all traffic to Reverse Proxy w/ SSL and no TLS Verify
#ingress:
#  - service: https://REVERSEPROXYIP:PORT
#    originRequest:
#      noTLSVerify: true

#forward all traffic to reverse proxy over http
#ingress:
#  - service: http://REVERSEPROXYIP:PORT
```

Save the file.

{% code title="Run:" %}
```
cd .. 
nano docker-compose.yml
```
{% endcode %}



In the compose file we are going to change the `RANDOM_NUMBERS` we had in the `command:` line to the `TUNNELUUID` and then we are going to save the file.

```
version: "3.8"
services:
  cloudflared:
    build: https://github.com/cloudflare/cloudflared.git
    container_name: cloudflared
    restart: unless-stopped
    network_mode: "host"
    environment:
      - PUID=1001
      - PGID=1001
   command: tunnel --config /home/nonroot/.cloudflared/config.yaml run TUNNELUUID #This command runs the tunnel. (Used to be RANDOM_NUMBERS. 
    volumes:
      - ./data:/home/nonroot/.cloudflared/
    extra_hosts:
      - "beta.DOMAIN.COM:127.0.0.1" #This is needed so that cloudflare may link this to the certificate so it's detected as valid.
```



Now run the following commands:

```
docker-compose down
docker-compose up -d
#Now if we run `docker ps`, you will see that Cloudflared is up and running.
docker logs cloudflared
```

![We see no errors and the Tunnel is running perfectly.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FaFX1g8GQigo8vZQJsffd%2Fimage.png?alt=media\&token=759cc1d4-3cf6-44b9-97d3-4acccd663f1a)



We will now go into NPM with our domain we already have.

![Mine is probably different than your's and I am going to show you how I added those hostnames in the docker-compose.yml files below so that we don't have to use the PUBLIC-IP-OF-THE-VPS.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FFx4odhqCAQlKlIi24S0B%2Fimage.png?alt=media\&token=07731d13-38a5-4c3b-820a-6bf48e080ef0)



### Hostname explanation

Back in the Putty terminal, run the following:

```
cd /home/ubuntu/containers/npm/
nano docker-compose.yml
#Look at the new added line below.
```

![We use hostname: since in NPM you can just proxy it by using the hostname: of the container instead of just putting VPS\_PUBLIC\_IP and if you move the containers to another machine you don't have to change anything that you Proxied in NPM. Cloudflared doesn't need hostname: since that container is never supposed to be proxied.](https://374730009-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5C1C6BPoBtOaDEMCFiaO%2Fuploads%2FlVapEzGcUX2i9A9qj1o5%2Fimage.png?alt=media\&token=0eab9420-b393-44b2-9d91-0d8186743909)



As always make sure to save the file after editing it and let's run the following to update the container:

```
docker-compose up -d #We do this if we edited the docker-compose file but if we edited anything else.
#For example the `config.yaml` file of Cloudflared, we edit that and we only have to run the following command:
`docker-compose restart`. That's it.
```



If you don't know already, you don't need to port forward any ports, since your Argo Tunneling takes care of that and lets you access it without exposing those ports to the outside world.

You can also remove the Tunnel we have in the Putty Terminal if not done so already.

That is all you have to do for Argo Tunneling on this `arm64-vps`, have a great day everyone!

## **Final Words**

We hope you enjoyed this guide. It was conceptualized, written, and implemented by our Discord Community member Norkz, based on the IBRACORP Vaultwarden guide [found here](https://www.youtube.com/watch?v=cUDAwYhwr2w).&#x20;

Want to contribute a guide? Join our Discord below and let us know!

## Support Us

Our work sometimes takes months to research and develop. \
If you want to help support us please consider:

* Liking and Subscribing to our [Youtube channel](https://youtube.com/c/ibracorp)
* Joining our [Discord server](https://discord.gg/VWAG7rZ)
* Becoming a paid member on our [IBRACORP website](https://ibracorp.io/membership/)
* Donating via [Paypal](https://paypal.me/ramteksolutions)

#### Thank you for being part of our community!
