Self-Hosting Vaultwarden: A Password Manager

A password manager is the single most important security tool most developers still do not run properly. Vaultwarden is a compatible, community re-implementation of the Bitwarden server API that is dramatically lighter than the official stack, which normally needs multiple containers and a heavier database. One small process plus SQLite is enough for a personal or family vault, and it works with the official Bitwarden apps on every platform, so your clients keep working exactly as they did against the commercial service.

For anyone uncomfortable handing every credential to a third party, running your own vault server is the difference between renting security and owning it. Your master password and recovery key remain the only keys to the encrypted data, whether it sits in a datacenter you rent or on infrastructure you run.

Because a password vault is the crown jewels, this guide spends as much time on exposure, backups, and upgrades as on the one-line deploy.

Why Vaultwarden

The official Bitwarden server is a large .NET application with many moving parts, MySQL to Redis to a notification agent. Vaultwarden collapses all of it into a single efficient binary. It is open source and API-compatible with every Bitwarden client and browser extension, uses SQLite by default so there is no separate database service, runs comfortably in under 512 MB of RAM, and sends no telemetry.

The trade-off is that it is a community project, so staying current matters. Security fixes ship regularly, and the small surface area means each release is worth reviewing before you pull it into production.

Deployment With Compose

The simplest reliable deployment pins a version and mounts one data volume:

services:
  vaultwarden:
    image: vaultwarden/server:1.32.0
    container_name: vaultwarden
    environment:
      - DOMAIN=https://vault.example.com
      - SIGNUPS_ALLOWED=false
      - INVITATIONS_ALLOWED=true
      - WEBSOCKET_ENABLED=true
    volumes:
      - ./vault-data:/data
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped

Two settings deserve explanation. SIGNUPS_ALLOWED=false closes self-registration; you create accounts by invitation, which keeps strangers off your vault server. WEBSOCKET_ENABLED=true gives live sync between devices instead of polling, so a new password on your laptop appears on your phone almost instantly.

Enable the Bitwarden App Connection

Before creating the admin user, decide how nontrivial setup will be. Run the init once to generate an admin token:

docker exec -it vaultwarden /vaultwarden --init-admin
# The printed admin token goes straight into /data/config.json as ADMIN_TOKEN.

Then create your admin from the web UI. Clients connect by entering your vault URL in the Settings screen, out of the box on the official Bitwarden apps. No recompilation and no special builds are needed.

Deployment is deliberately boring, which is exactly what a security-critical service wants. There is one binary, one volume, and one listening port, so there are few places for a misconfiguration to hide. The container runs as a non-root user by default, and the whole data directory is a single SQLite database that you can inspect and back up directly.

Go through the first-run token workflow once to generate an ADMIN_TOKEN and confirm you can log in as admin before you invite any real users. That way mistakes surface on an empty vault, not after people have started storing credentials.

Preparing For a Disaster

A lost server is a lost vault if you are not careful. Encrypt the backup and push it off box, because the vault is encrypted at rest but the data directory itself is still worth protecting:

tar czf vault-$(date +%Y%m%d).tgz ./vault-data
gpg --symmetric --cipher-algo AES256 vault-20260801.tgz
scp vault-20260801.tgz.gpg backup@backup-host:/vault/

Restore is just extracting the archive into ./vault-data and restarting the container. Test the restore path now, not during an emergency. Keep the master password and recovery key in two separate places, because they are the only way back in.

Operational Hygiene

• Upgrade the container at least monthly and read the changelog for breaking DB migrations.
• Set SIGNUPS_ALLOWED=false permanently; invitations cover new users.
• Rotate the admin token after first login.
• Put Caddy or a similar proxy in front to handle TLS and automatic renewals.

// Node.js example: push an emergency snapshot from a cron-like worker
const { execSync } = require('child_process');
execSync('docker exec vaultwarden /vaultwarden --backup', { stdio: 'inherit' });

Takeaway

Vaultwarden gives you enterprise-grade password management on hardware you trust, with negligible resource cost and full compatibility with the Bitwarden app ecosystem. Back it up, keep it patched, and it quietly does one job very well.

A 1 GB Ubuntu VPS on Netbay runs this comfortably under lock and key. Spin one up in under 60 seconds — netbayhosts.in.