How to Self-Host Vaultwarden with Docker

Everyone needs a password manager. If you're still reusing passwords or storing them in a browser's built-in manager, you're one data breach away from a very bad week. Bitwarden is the best open-source option, but the official server is heavy — it needs MSSQL and multiple containers.

Vaultwarden solves this. It's a lightweight, community-built server that's fully compatible with all Bitwarden clients — browser extensions, mobile apps, desktop apps, CLI. It runs in a single Docker container, uses SQLite by default, and needs about 30MB of RAM. I self-host Vaultwarden with Docker on the same VPS that runs this blog, and it handles my entire password vault without breaking a sweat.

By the end of this guide, you'll have a working Vaultwarden instance with SSL, auto-backups, and all the security settings configured properly.

Prerequisites

• A Linux VPS with Docker and Docker Compose (here's how I set mine up)
• A domain name pointed at your server (e.g., vault.yourdomain.com)
• A reverse proxy with SSL — Nginx Proxy Manager or similar
• SSH access to your server (hardened, ideally)

Deploy Vaultwarden with Docker Compose

Create a directory for Vaultwarden:

sudo mkdir -p /opt/vaultwarden
cd /opt/vaultwarden

Generate an admin token. This secures the admin panel:

openssl rand -base64 48

Save that token — you'll need it in the compose file.

Create the compose file:

# docker-compose.yml
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - ADMIN_TOKEN=<YOUR_GENERATED_TOKEN>
      - SIGNUPS_ALLOWED=false
      - INVITATIONS_ALLOWED=true
      - SHOW_PASSWORD_HINT=false
      - ROCKET_LIMITS={json=10485760}
      - LOG_FILE=/data/vaultwarden.log
      - LOG_LEVEL=warn
    volumes:
      - vw_data:/data
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped

volumes:
  vw_data:

Key environment variables explained:

• DOMAIN — Must match your actual domain with https://. Required for WebSocket notifications and email links.
• ADMIN_TOKEN — Protects the /admin panel. Without this, anyone can access admin settings.
• SIGNUPS_ALLOWED=false — Disables public registration. You'll create your account first, then lock it down.
• SHOW_PASSWORD_HINT=false — Password hints are a security risk. Disable them.
• ROCKET_LIMITS — Increases the upload limit to 10MB for file attachments.

Note: The container binds to 127.0.0.1:8080, not 0.0.0.0. This means it's only accessible from localhost — your reverse proxy handles external traffic and SSL.

Start the container:

docker compose up -d

Set Up the Reverse Proxy

You need SSL for Vaultwarden — the Bitwarden clients refuse to connect over plain HTTP, and you should never send passwords unencrypted.

Using Nginx Proxy Manager

1. Log into your NPM dashboard
2. Add a new Proxy Host: - Domain: vault.yourdomain.com - Forward Hostname: vaultwarden (or 127.0.0.1 if not on the same Docker network) - Forward Port: 80 - Enable SSL: Yes, request a new Let's Encrypt certificate - Force SSL: Yes - WebSocket Support: Yes (required for live sync)

Using Caddy

Add to your Caddyfile:

vault.yourdomain.com {
    reverse_proxy vaultwarden:80
}

Caddy handles SSL automatically.

Create Your Account

With signups still technically allowed (we'll disable them after), open https://vault.yourdomain.com in your browser. Click "Create Account" and set up your master password.

Choose your master password carefully. This is the one password you need to memorize. Make it long (4+ random words), unique, and never used anywhere else. Vaultwarden encrypts your vault with this password on the client side — even if someone compromises the server, they can't read your passwords without the master password.

After creating your account, immediately disable signups. Edit the compose file and verify SIGNUPS_ALLOWED=false, then restart:

docker compose down && docker compose up -d

If you need to add family members or team members later, use the admin panel to send invitations.

Configure the Admin Panel

Access the admin panel at https://vault.yourdomain.com/admin and enter your admin token.

Here you can:

• Manage users — delete accounts, disable accounts, verify email addresses
• Configure SMTP — for email verification and password reset (optional but recommended)
• Adjust security settings — 2FA enforcement, password length requirements
• View diagnostics — server version, database size, environment status

Optional: SMTP for Email

If you want email verification and password reset capability, configure SMTP in the admin panel or via environment variables:

environment:
  - SMTP_HOST=smtp.example.com
  - SMTP_FROM=vault@yourdomain.com
  - SMTP_PORT=587
  - SMTP_SECURITY=starttls
  - SMTP_USERNAME=<YOUR_SMTP_USER>
  - SMTP_PASSWORD=<YOUR_SMTP_PASSWORD>

Set Up Automatic Backups

Your password vault is critical data. Losing it would be catastrophic. Set up automated backups with a simple cron job.

Create the backup script:

sudo tee /opt/vaultwarden/backup.sh << 'SCRIPT'
#!/bin/bash
BACKUP_DIR="/opt/vaultwarden/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
mkdir -p "$BACKUP_DIR"

# Copy the SQLite database (safely, with WAL checkpoint)
docker exec vaultwarden sqlite3 /data/db.sqlite3 ".backup '/data/backup_${TIMESTAMP}.sqlite3'"
docker cp vaultwarden:/data/backup_${TIMESTAMP}.sqlite3 "${BACKUP_DIR}/db_${TIMESTAMP}.sqlite3"
docker exec vaultwarden rm "/data/backup_${TIMESTAMP}.sqlite3"

# Copy attachments and other data
docker cp vaultwarden:/data/attachments "${BACKUP_DIR}/attachments_${TIMESTAMP}" 2>/dev/null

# Compress
tar -czf "${BACKUP_DIR}/vaultwarden_${TIMESTAMP}.tar.gz" \
    -C "$BACKUP_DIR" "db_${TIMESTAMP}.sqlite3" "attachments_${TIMESTAMP}" 2>/dev/null

# Cleanup loose files
rm -f "${BACKUP_DIR}/db_${TIMESTAMP}.sqlite3"
rm -rf "${BACKUP_DIR}/attachments_${TIMESTAMP}"

# Keep only last 7 backups
ls -t "${BACKUP_DIR}"/vaultwarden_*.tar.gz | tail -n +8 | xargs rm -f 2>/dev/null

echo "Backup completed: vaultwarden_${TIMESTAMP}.tar.gz"
SCRIPT
chmod +x /opt/vaultwarden/backup.sh

Schedule it to run daily:

sudo crontab -e

Add:

0 3 * * * /opt/vaultwarden/backup.sh >> /var/log/vaultwarden-backup.log 2>&1

Note: Use SQLite's .backup command, not a raw file copy. Copying a SQLite database while it's being written to can produce a corrupted backup. The .backup command handles this safely.

Connect Your Devices

Browser Extension

Install the Bitwarden browser extension (Chrome, Firefox, Safari, Edge). Before logging in:

1. Click the gear icon in the extension
2. Under "Self-hosted environment," enter https://vault.yourdomain.com
3. Save and log in with your credentials

Mobile App

Install the Bitwarden app (iOS/Android). Tap the gear icon on the login screen, enter your self-hosted URL, save, and log in.

Desktop App

Download from bitwarden.com/download. Same process — set the server URL before logging in.

CLI

npm install -g @bitwarden/cli
bw config server https://vault.yourdomain.com
bw login

The CLI is useful for scripting — you can generate passwords, export vaults, and manage entries programmatically.

Enable Two-Factor Authentication

After logging in to your web vault, go to Settings → Security → Two-step Login. Enable at least one method:

• Authenticator app (TOTP) — works with any authenticator app. This should be your minimum.
• YubiKey — hardware key support. Best security if you have one.
• Email — sends a code to your email. Better than nothing, but TOTP is preferred.

Warning: If you lose your 2FA device and your recovery code, you're locked out of your vault permanently. Vaultwarden encrypts everything client-side — there's no "forgot my 2FA" reset. Save your recovery code in a physically secure location.

Security Considerations

Self-hosting a password manager means the security is entirely your responsibility.

• Keep Vaultwarden updated. Check for new releases monthly: docker compose pull && docker compose up -d. Security patches in a password manager are critical.
• Restrict admin panel access. Consider disabling the admin panel entirely after initial setup by removing the ADMIN_TOKEN variable. Or restrict it by IP using your reverse proxy.
• Don't expose port 8080. The compose file binds to 127.0.0.1 specifically so the container isn't directly accessible. All traffic should go through your SSL-terminating reverse proxy.
• Server-side encryption isn't the whole picture. Vaultwarden stores your vault encrypted with your master password. The server never sees the plaintext. But if someone gets root on your server, they could modify the Vaultwarden binary to capture passwords as you type them. Keep your server hardened and Docker locked down.
• Offline access. Bitwarden clients cache an encrypted copy of your vault locally. If your server goes down, you can still access passwords. But new entries won't sync until the server is back.

Troubleshooting

Problem: Bitwarden client says "Unable to connect to server." Cause: Wrong server URL, SSL issue, or Vaultwarden isn't running. Fix: Verify the URL includes https:// and matches exactly. Check docker compose logs vaultwarden for errors. Test with curl -I https://vault.yourdomain.com.

Problem: "Not a valid Bitwarden server" error. Cause: The DOMAIN environment variable doesn't match the URL you're accessing. Fix: Ensure DOMAIN in docker-compose.yml matches the URL in your client settings, including the protocol (https://).

Problem: WebSocket notifications not working (items don't sync instantly). Cause: Your reverse proxy isn't forwarding WebSocket connections. Fix: In NPM, enable "WebSocket Support" for the proxy host. In Caddy, it works automatically. In Nginx manually, add proxy_set_header Upgrade $http_upgrade; and proxy_set_header Connection "upgrade";.

Problem: Attachments fail to upload. Cause: Default request body size limit in your reverse proxy. Fix: Increase the limit. In NPM, add client_max_body_size 25M; to custom Nginx configuration. In Caddy, it's unlimited by default.

Problem: Admin panel returns 404. Cause: ADMIN_TOKEN is not set or was removed. Fix: Add ADMIN_TOKEN to your environment variables and restart the container.

Conclusion

You now have a self-hosted, Bitwarden-compatible password manager running on your own server. No subscription fees, no data on someone else's infrastructure, and full control over your security.

The total resource usage is minimal — about 30MB of RAM and negligible CPU. It runs comfortably alongside other services on even a small VPS.

From here, I'd recommend:

• Setting up Uptime Kuma to monitor your Vaultwarden instance (it's critical infrastructure now)
• Reviewing my Docker security practices to lock down the container
• Adding Fail2Ban to protect against brute-force login attempts

If you need a VPS for this, I run my entire stack on Hetzner — check my VPS comparison for options.