About Vaultwarden
Vaultwarden is a Rust reimplementation of the Bitwarden server API. It works with the official Bitwarden apps and extensions (browser, mobile, desktop, command line) while using very few resources, which makes it a good fit for a small VPS. Developers, families and small teams use it to keep their credentials on a server they control.
At delivery, the install script has deployed Docker, then started two containers with Docker Compose in /opt/vaultwarden. Vaultwarden listens only locally (127.0.0.1:8080), and Caddy publishes the interface on port 443 over HTTPS. Data is stored in a Docker volume named vw_data.
The certificate is self-signed (Caddy's tls internal directive) and tied to the server's public IP address, so your browser will show a warning until you attach a domain name. Sign-ups are open at first (SIGNUPS_ALLOWED=true). Create your account, then close them.
What you can do with Vaultwarden
Works with Bitwarden clients
Bitwarden apps and extensions connect to your server once you enter its URL. You keep the tools you already know, with no third-party service involved.
Low resource usage
Written in Rust, Vaultwarden runs comfortably on a modest VPS. That leaves room for other services on the same machine.
HTTPS served by Caddy
Caddy runs on the host network and serves the interface on port 443 with a self-signed certificate. The Vaultwarden container is not exposed directly to the Internet.
Deployed with Docker Compose
The whole configuration lives in
/opt/vaultwarden/docker-compose.ymlandCaddyfile. Edit a file, rundocker compose up -d, and the change is applied.Data in a dedicated volume
The database and attachments live in the
vw_datavolume, separate from the container. You can update the image without touching your vaults.Controllable sign-ups
The
SIGNUPS_ALLOWEDvariable lets you close account creation once your users are registered, so a stranger cannot sign up on your instance.
Get started with Vaultwarden
From order to production in a few minutes.
- 1
Order the VPS with Vaultwarden
Choose a Linux VPS (Paris or Frankfurt) running Debian 12, Debian 13 or Ubuntu 20.04, 22.04, 24.04. Tick Vaultwarden in the Applications tab of the order form.
- 2
Check the installation after delivery
Give it a few minutes after delivery: the script installs Docker, then starts the containers. Connect over SSH and check that
vaultwardenandcaddyare running.Bashssh root@SERVER_IP cd /opt/vaultwarden docker compose ps - 3
Create your main account
Open https://SERVER_IP in your browser and accept the warning about the self-signed certificate. Create your account, then close sign-ups so nobody else can open one.
Bashsed -i 's/SIGNUPS_ALLOWED=true/SIGNUPS_ALLOWED=false/' /opt/vaultwarden/docker-compose.yml cd /opt/vaultwarden && docker compose up -d - 4
Switch to a domain with valid HTTPS
Point an A record for YOUR_DOMAIN to SERVER_IP. In the Caddyfile, replace the block with one for YOUR_DOMAIN without
tls internal, setDOMAIN=https://YOUR_DOMAINin docker-compose.yml, open ports 80 and 443, then restart.Bashcd /opt/vaultwarden nano Caddyfile nano docker-compose.yml ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp docker compose up -d --force-recreate
Vaultwarden use cases
Personal or family vault
Host your household's passwords, secure notes and recovery codes on a server of your own, reachable from all your devices.
Access management for a small team
Share credentials (server logins, SaaS accounts, API keys) among a few colleagues using Bitwarden organizations and collections.
Alternative to a cloud subscription
Leave a password manager hosted by a third party and keep the same Bitwarden client, with your data on a VPS in Europe.
Part of an internal tools server
Run the vault next to other self-hosted services on the same VPS, thanks to its small memory footprint.
Vaultwarden FAQ
The certificate is generated by Caddy (tls internal) for the server's IP address, so no public authority has signed it. You can accept it to create your account. For long-term use, attach a domain name and let Caddy obtain a valid certificate.
More about Vaultwarden
Files and services to know
Everything is in /opt/vaultwarden: the install-vaultwarden.sh script, the docker-compose.yml file and the Caddyfile. The three Docker volumes are vw_data (your data), caddy_data (certificates) and caddy_config. Both containers restart automatically (restart: always).
Using a domain name
The certificate provided at delivery is self-signed and tied to the IP. Mobile apps and some extensions may reject this kind of certificate, so a domain with a valid certificate is recommended for daily use. With a domain name (see our domain names), a minimal Caddyfile looks like this:
YOUR_DOMAIN {
reverse_proxy 127.0.0.1:8080
}
Caddy can then obtain a public certificate, provided the DNS points to the server and ports 80 and 443 are reachable. After editing, restart with docker compose restart caddy. Do not forget to update Vaultwarden's DOMAIN variable to match.
Backups
Back up the vw_data volume: it holds the SQLite database, the keys and the attachments. The exact volume name depends on the project folder, so check it with docker volume ls (it should be called vaultwarden_vw_data).
docker run --rm -v vaultwarden_vw_data:/data -v /root:/backup alpine tar czf /backup/vw-backup.tgz -C /data .
Then copy the archive off the server. A backup left on the same VPS does not protect you if the machine is lost. The tutorials in the /learn section can help you automate this step.
Updates
The image used is vaultwarden/server:latest. To move to the latest version, make a backup first, then run:
cd /opt/vaultwarden
docker compose pull
docker compose up -d
