Self-Host Vaultwarden on a VPS with Docker

Vaultwarden is a lightweight, Bitwarden-compatible password server. You use the normal Bitwarden apps and browser extensions, but your vault lives on a server you control. It uses very little memory, so a small VPS is plenty. Because it holds your passwords, set it up carefully.

Before you start

• A VPS with Docker. See installing Docker.
• A domain pointing at the server. See DNS records explained.
• A plan to back up the data. See VPS backups.

More background is on our self-hosted Vaultwarden page.

Step 1: Docker Compose file

mkdir -p ~/vaultwarden && cd ~/vaultwarden
cat > compose.yaml <<'EOF'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"   # switch to false after you create your account
      ADMIN_TOKEN: "${ADMIN_TOKEN}"
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8081:80"
EOF

Step 2: generate an admin token

The admin page lets you manage users. Store a hashed token, not plain text. The Vaultwarden image includes a helper:

docker run --rm -it vaultwarden/server /vaultwarden hash
# paste the result into a .env file as ADMIN_TOKEN='$argon2id$...'

Step 3: start it

docker compose up -d
docker compose logs -f

Step 4: HTTPS with Caddy

The Bitwarden clients require HTTPS.

vault.example.com {
  reverse_proxy 127.0.0.1:8081
}

Reload Caddy and open the site. Create your account, then set SIGNUPS_ALLOWED to false and run docker compose up -d again so strangers cannot register.

Step 5: turn on two-step login

In the web vault, enable two-step login with an authenticator app or a hardware key. Save the recovery code offline.

Back up the vault

All data is in ./data, mainly the SQLite database and attachments. Make a consistent copy on a schedule and keep it off the server:

sqlite3 data/db.sqlite3 ".backup '/backup/vaultwarden-$(date +%F).sqlite3'"
tar czf /backup/vw-files-$(date +%F).tgz data/attachments data/rsa_key*

Test a restore at least once. A backup you never tested is only a hope.