self-host/POC/bwsh/README.md

bwsh — Bitwarden self-host CLI

A single .NET tool that installs and manages a Bitwarden self-host deployment — replacing the bitwarden.sh + run.sh + Setup-container stack. It generates all config in-process and drives Docker directly. Supports both standard and lite deployments.

Status: working proof of concept. See What's not done yet at the bottom.

Prerequisites

• .NET 10 SDK — https://dotnet.microsoft.com/download
• Docker running
• An installation ID + key from https://bitwarden.com/host

Install

From this directory, the tool runs via dotnet run --.

Interactive

dotnet run -- install

It asks for your domain, region, installation id/key, and database name, then pulls the images, starts the stack, and shows a live status table.

Unattended with a manifest

Create bitwarden.yaml:

deployment: standard            # standard | lite
domain: bitwarden.example.com
region: US                      # US | EU
installation-id: 00000000-0000-0000-0000-000000000000
installation-key: your-key-here
# optional:
# enable-key-connector: true
# enable-scim: true

Then:

dotnet run -- install --manifest bitwarden.yaml

Add --plan to preview without pulling or starting anything.

Everyday commands

dotnet run -- status                 # health, versions, and vault URL
dotnet run -- logs identity          # a service's logs; --export bundles all to a zip
dotnet run -- update                 # pull latest images and recreate changed services
dotnet run -- backup                 # snapshot config + secrets + database to a .tar.gz
dotnet run -- restore backup.tar.gz  # restore from a backup
dotnet run -- uninstall              # stop and remove; --purge also deletes data

Run dotnet run -- <command> --help for options on any command.

Migrate an existing bash install

Adopt a stack that was installed with bitwarden.sh under CLI management — non-destructive, backs up first:

dotnet run -- migrate --root ./bwdata

Notes

• Data lives in ./bwdata by default; override with --root <dir>.
• Versions default to the pinned version.json release; override per run with update --core-version <v> --web-version <v> or in the manifest.
• A real bwsh binary can be produced with dotnet publish -c Release --self-contained.
• The demo GIFs are generated from VHS tapes in docs/.

What's not done yet

Installation id/key cloud validation · signed-binary distribution & self-update · Let's Encrypt / renewcert · Windows deployment parity · cloud marketplace channels.