You need your app to have the bitwarden decryption passphrase to read it. Do you intent to enter that manually if the server reboots ? If not, then it's a secr

You need your app to have the bitwarden decryption passphrase to read it. Do you intent to enter that manually if the server reboots ? If not, then it's a secret you must manage, and you are back to square one: either using a simpler solution, use a hardware key, or going full secure vault service, with privileged first request, and so on.