Admin guide

Vault: https://vault-gbkui.basketnews.com
Admin panel: /admin

Current setup: Vaultwarden on DigitalOcean; Cloudflare DNS (proxied); invite-only; SMTP enabled (Google Workspace); org require-2FA on Team and Basketnews. Cloudflare Access is not on the vault (docs site may still use Access).

Prerequisites

Vaultwarden owner/admin account in the organization
Optional: admin panel token from ~/.vaultwarden-do-secrets (ADMIN_PASSWORD)

Invite a new user

Open the vault and log in with your master password (+ 2FA).
Invite via one of these paths:

A — From the organization (preferred)

Organizations → your org (e.g. Basketnews) → Members
Invite member → work email → choose role → send
They receive an invite email (SMTP)

B — From Vaultwarden admin

Open /admin
Unlock with admin token
Users → Invite user → enter email

If they register but are not in the org

They are often still Invited (not accepted). Ask them to log in and accept the organization invitation. In Members, check the Invited/pending filter. Re-invite if needed.

Require 2FA on an org

Organizations → [org] → Settings → Policies
Enable Require two-step login
Save (already on for Team and Basketnews)

Offboarding

Remove from organization (Members → revoke)
In /admin → Users → disable or delete the account

Admin panel notes

/admin uses the server admin token, not a vault user password
Org membership is managed mainly in the vault UI; admin panel is for invites, users, SMTP test, diagnostics
SSH to the droplet is IP-allowlisted on the DigitalOcean firewall; add your current public IP if SSH times out