Use reverse-proxy-verified mTLS as an alternative second factor

I was thinking about hardening my internet reachable Vaultwarden instance. I thought about implementing 2FA, the only reasonable approach for my case would be TOTP, but I find TOTP quite annoying. So I thought about mTLS and to my surprise I stumbled upon [this blog post]( so a working setup is possible. But enforcing mTLS would kill a bit of convenience, especially if i want to just quickly login to my vault from a rarely used device. So I propose a middle-ground solution: allowing TOTP to be skipped when the reverse proxy forwards a specific trusted header. This is possible in Caddy and Traefik at the very least. They have verify_if_given and VerifyClientCertIfGiven respectivley in their client certificate settings which allows checking mTLS if provided and other-wise just letting the connection pass. So in short the expected behavior should look like this: • Valid client certificate => Skip the normal 2FA challenge. • No client certificate => Requir…