[ Removed by moderator ]

DISCLAIMER: Follow this guide at your own risk. I am not responsible for any damages to your device, or you.

Pre-requisites: a Jailbroken Echo show 5(1st/2nd gen) or Show 8 (1st gen only)

Exact-Guide for my model: CLICK ME

I then tinkered a bit with the Android a bit and it was quite easy to gain root access.

[Quick Note: You can self host VW without root aswell with a small caveat, that autostart won't work.]

I rooted it after I patched the boot.img with magisk, flashed and then I got root.

Host Machine Used: Fedora 44

Section 1 Building your vaultwarden

1. Download the source code from https://github.com/dani-garcia/vaultwarden and put it in a directory

2. Next up install build toolchain (rust etc)

3. The architecture for the Echo SHOW 5 is "armeabi-v7"

4. Build it with this command (I used podman as I'm on fedora kde 44 feel free to modify to use docker)

CROSS_CONTAINER_ENGINE=podman cross build --release \
  --target aarch64-unknown-linux-musl \
  --features sqlite,vendored_openssl

Note: If build freezes (or if you're on a low end setup) use this

CROSS_CONTAINER_ENGINE=podman \
CARGO_PROFILE_RELEASE_LTO=off \
CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 \
cross build --release \
  --target aarch64-unknown-linux-musl \
  --features sqlite,vendored_openssl

Verify using

file target/aarch64-unknown-linux-musl/release/vaultwarden

Should return "ELF 64 BIT LSB Executable, ARM.... STATICALLY LINKED

If not static then you messed something up.

5. Get the Web-Vault

WV=$(curl -s https://api.github.com/repos/dani-garcia/bw_web_builds/releases/latest | grep -o 'https://[^"]*bw_web.*\.tar\.gz' | head -1)
curl -L "$WV" -o web-vault.tar.gz

6. Download CA Certs (this build doesn't have them cloudflared won't work without this)

curl -o cacert.pem https://curl.se/ca/cacert.pem

[Only if you want to link your vaultwarden to a domain or access outside your home] 1 Thing i'd like to add: I tried making it network only but it gave me crap on HTTPS

7. PUSH PUSH PUSH

You must download ADB and connect to the device after you enable USB Debugging (google it)

D=/data/local/tmp
adb push target/aarch64-unknown-linux-musl/release/vaultwarden $D/vaultwarden
adb push web-vault  $D/web-vault
adb push cacert.pem $D/cacert.pem
adb shell chmod 755 $D/vaultwarden

8. Optional (Set up admin token to access /admin)

adb shell -t /data/local/tmp/vaultwarden hash

Type your password and take the hash '$argon2id$v=19$m=.........."

9. Create the config

cat > vaultwarden.env <<'EOF'
BRAND_NAME='MyVault'
# MUST be single quotes so the "$" in the hash isn't mangled:
ADMIN_TOKEN='PASTE_YOUR_$argon2id_HASH_HERE'
DOMAIN=https://YOUR_DOMAIN
ROCKET_ADDRESS=0.0.0.0
ROCKET_PORT=8003
DATA_FOLDER=/data/local/tmp/vw-data
WEB_VAULT_FOLDER=/data/local/tmp/web-vault
SSL_CERT_FILE=/data/local/tmp/cacert.pem
PUSH_ENABLED=false
ICON_SERVICE=internal
EOF

adb push vaultwarden.env /data/local/tmp/.env

⚠️ Issue 1: the Argon2 token is full of $. If it's unquoted (or double-quoted), the shell/dotenvy strips the $... parts and the token silently never works. Single-quote it.

[Note: I realized after writing it but I modified my version a bit to rebrand, please be careful writing your config]

10. Optional, Setup Cloudflared

# on the host, one-time:
cloudflared tunnel login
cloudflared tunnel create MYTUNNEL
cloudflared tunnel route dns MYTUNNEL YOUR_DOMAIN

Create config.yml

tunnel: YOUR_TUNNEL_ID
credentials-file: /data/local/tmp/.cloudflared/YOUR_TUNNEL_ID.json
ingress:
  - hostname: YOUR_DOMAIN
    service: http://localhost:8003
  - service: http_status:404

11. PUSH AGAIN

D=/data/local/tmp
adb shell mkdir -p $D/.cloudflared
# download the arm64 cloudflared from Cloudflare's GitHub releases first:
adb push cloudflared-linux-arm64 $D/cloudflared && adb shell chmod 755 $D/cloudflared
adb push config.yml $D/.cloudflared/config.yml
adb push ~/.cloudflared/cert.pem $D/.cloudflared/cert.pem
adb push ~/.cloudflared/YOUR_TUNNEL_ID.json $D/.cloudflared/YOUR_TUNNEL_ID.json

12. Launch

adb shell "su -c 'cd /data/local/tmp && \
  setsid ./vaultwarden >/data/local/tmp/vw.log 2>&1 </dev/null & \
  setsid ./cloudflared tunnel --config /data/local/tmp/.cloudflared/config.yml --no-autoupdate run >/data/local/tmp/cf.log 2>&1 </dev/null &'"

I used claude to help me with this heavily as I'm more of a guy whose familiar w Computers and not mobile devices. Anyway Lmk if you want more. I'm going to turn this headless and host even more.

I'm deeply sorry but I did not include how I made it auto startup as my hands cramp right now.

I made a service monitor too with a dashboard that lets me monitor all of them, push updates, edit .env and it just sends me notifications if the RAM is going too high (Echo only has 1GB)

One last note. Claude has been spamming me with the fact that Echo is 32 bit so I asked why we compile 64bit. It said

The Echo Show 5 reports a 32-bit armeabi-v7a Android ABI (getprop ro.product.cpu.abi), but the kernel is 64-bit. Because we build a statically linked binary, we can target aarch64-unknown-linux-musl (64-bit) and it runs fine on the 64-bit kernel — static linking means it doesn't touch Android's 32-bit userspace at all. (A 32-bit armv7-unknown-linux-musleabihf build also works if you'd rather match the advertised ABI, but 64-bit static is what this guide uses.)