Self-Host Your Password Manager on a VPS: Vaultwarden + Caddy in 15 Minutes

#selfhosted #security #docker #tutorial

Disclosure: I run Buran.host, a small VPS reseller, so I show everything on my own server. The steps work on any Ubuntu 22.04/24.04 VPS with Docker.

Vaultwarden is a lightweight Rust implementation of the Bitwarden server. It works with all the official clients (browser extensions, iOS/Android and desktop apps), and the vault is a single directory with SQLite on your own server. It uses roughly 100–200 MB of RAM, so even the smallest plan is enough.

1. Firewall and directory

apt update && apt install -y ufw
ufw allow OpenSSH && ufw allow 80/tcp && ufw allow 443/tcp && ufw --force enable
mkdir -p /opt/vaultwarden/data && cd /opt/vaultwarden
echo "ADMIN_TOKEN=$(openssl rand -base64 48)" > .env   # save this token

Docker must be installed (on Ubuntu: curl -fsSL https://get.docker.com | sh).

2. docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    env_file: .env
    environment:
      - DOMAIN=https://vault.example.com
      - SIGNUPS_ALLOWED=true
      - WEB_VAULT_ENABLED=true
    ports:
      - "127.0.0.1:8085:80"
    volumes:
      - ./data:/data

The port is bound to 127.0.0.1 only: the service reaches the internet through Caddy. Start it with docker compose up -d.

3. HTTPS with Caddy

Point an A record for vault.example.com at your server's IP first. Then:

apt install -y caddy
cat > /etc/caddy/Caddyfile <<'EOF'
vault.example.com {
    reverse_proxy 127.0.0.1:8085
}
EOF
systemctl reload caddy

Caddy obtains and renews the Let's Encrypt certificate by itself.

4. Close registration

Open https://vault.example.com, create your account and immediately change SIGNUPS_ALLOWED=true to false in docker-compose.yml, then run docker compose up -d again. Otherwise anyone who finds the address can create an account on your server.

The admin panel lives at /admin. Here the token is stored in plain form: that is acceptable for a personal server, but the project recommends storing an Argon2 hash in ADMIN_TOKEN (generated with the vaultwarden hash command) if you keep the admin panel enabled.

5. Connect your clients

In any Bitwarden client, choose Self-hosted on the login screen and enter https://vault.example.com. After that, sign in as usual.

6. Backups — do not skip this

The whole vault is the ./data directory. Keep a copy outside this server: for example an encrypted restic repository on a nightly systemd timer. A copy on the same disk will not save you if the server itself is lost. Test the restore: a backup you have never restored is a hope, not a backup.

What you get

Your own password server: your domain, your disk, updates in your hands. The one honest downside: administration is now your job — image updates, backups, monitoring.

A longer version with FAQ: https://buran.host/guides/vaultwarden-vps

DEV Community