Vaultwarden restore — VALIDATED

Extracted from the master document on 2026-09-04. The §N numbering is kept so cross-references are not broken.

45. Granular Vaultwarden restore — ✅ VALIDATED END-TO-END

Archive: docker-host-20260901-030007. Only these were extracted:

opt/stacks/vaultwarden
var/backups/borg-staging/vaultwarden-db.sqlite3

into an isolated directory /tmp/borg-restore-test.

 1. selective borg extract
        ▼
 2. SQLite integrity
        sudo sqlite3 .../vaultwarden-db.sqlite3 'PRAGMA integrity_check;'
        → ok        + schema inspected, real Vaultwarden tables
        ▼
 3. mount a temporary instance
        /tmp/vaultwarden-restore-live/data   ← db.sqlite3 + rsa_key.pem
        container `vaultwarden-restore-test`
        ▼
 4. first attempt: 127.0.0.1:18080 → container:80
        ✗ not enough: the Web Vault requires a secure HTTPS context (§21)
        ▼
 5. reuse the lab: test.balserosworld.net
        container connected to `proxy` → 172.22.0.6/16
        Caddy reaches it by Docker name: vaultwarden-restore-test:80
        ▼
 6. real HTTPS access + restored instance working
        ▼
 ✅ VAULTWARDEN END-TO-END RESTORE APPROVED

Afterwards the container and the temporary directories were deleted. The test DNS endpoint and the commented-out template in Caddy are kept for future labs.

Why this test counts: it does not check that the archive exists, it checks that the restored data starts a working service. That is the difference between “I have backups” and “I can recover”.