🚀 Vaultwarden on a VPS — Self-Hosted Bitwarden

Bitwarden-compatible password server on your own VPS: Docker, Caddy HTTPS, admin token, signups off, encrypted off-site backups.

Vaultwarden is a lightweight Rust server compatible with every official Bitwarden client — browser extensions, mobile apps, desktop. Your password database lives as SQLite on your VPS, behind your domain and your HTTPS certificate.

1. Run the container

apt update && apt install -y ufw
ufw allow OpenSSH && ufw allow 80/tcp && ufw allow 443/tcp && ufw --force enable
mkdir -p /opt/vaultwarden/data && cd /opt/vaultwarden
echo "ADMIN_TOKEN=$(openssl rand -base64 48)" > .env   # save this token!
cat > docker-compose.yml <<'EOF'
services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    env_file: .env
    environment:
      - DOMAIN=https://vault.example.com
      - SIGNUPS_ALLOWED=true
      - WEB_VAULT_ENABLED=true
    ports:
      - "127.0.0.1:8085:80"
    volumes:
      - ./data:/data
EOF
docker compose up -d

The panel binds to `127.0.0.1` only — the internet reaches it through Caddy in the next step. Everything (the `db.sqlite3` vault, attachments, config) sits in `./data`.

2. HTTPS with Caddy

apt install -y caddy
cat > /etc/caddy/Caddyfile <<'EOF'
vault.example.com {
    reverse_proxy 127.0.0.1:8085
}
EOF
systemctl reload caddy

Point the A record first, then open `https://vault.example.com`, register your account — and immediately flip `SIGNUPS_ALLOWED=false` in `docker-compose.yml` and `docker compose up -d` again. The admin panel lives at `/admin` behind the `ADMIN_TOKEN`.

3. Clients and backups

In any Bitwarden client pick Self-hosted at the login screen and enter `https://vault.example.com`. For backups, the whole vault is one folder: restic guide with a daily timer keeps an encrypted copy off the server — passwords are exactly the data you never want to reconstruct.

Quick answers

Does it work with official Bitwarden apps?

Yes — browser extensions, iOS/Android and desktop clients all have a self-hosted mode; set your domain and login as usual. Two caveats: premium features like Bitwarden Send are Vaultwarden's own implementations, and official cloud-only features (organization sharing with cloud billing) work only where Vaultwarden implements them.

How much resources does it need?

Very little: ~100–200 MB RAM, a few CPU percent even during sync. A Core VPS 4 (€12/mo) is luxurious and shares the box with other services; even the smallest plan you run is overkill, which is the point — the cost is your discipline, not the bill.

Related

View plansGuidesFAQ