Skip to content
How-To

How to run Vaultwarden on a $5 VPS in an afternoon

Jordan BlakeMac & desktop power user

What you’ll get

A Vaultwarden instance you host yourself, working with official Bitwarden apps on phone and desktop. Budget about 3–4 hours the first time (less if you’ve already used Docker). Comfort with SSH and copying commands helps; you don’t need to be a sysadmin.

Before you start

  • A Linux VPS (1 GB RAM is enough for a household)—Hetzner or DigitalOcean and similar $4–6/month plans are fine
  • Ubuntu 22.04 or 24.04 (or Debian—adjust package names)
  • A domain pointed at the VPS or a Tailscale URL if you only want private access
  • SSH access as a non-root user with sudo

Vaultwarden is the lightweight Bitwarden API server. Clients talk to it the same way they talk to Bitwarden’s cloud—except the database lives on your box.

Steps

1. Update the server and install Docker

SSH in and run:

sudo apt update && sudo apt upgrade -y
sudo apt install -y ca-certificates curl
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER

Log out and back in so the docker group applies.

2. Create a directory and compose file

mkdir -p ~/vaultwarden && cd ~/vaultwarden
nano docker-compose.yml

Paste:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./vw-data:/data
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "false"
    ports:
      - "127.0.0.1:8080:80"

Change DOMAIN to your real URL (including https://). If you’re using Tailscale only, set it to your MagicDNS name, e.g. https://vaultwarden.my-tailnet.ts.net.

SIGNUPS_ALLOWED: "false" after you create your account—leave it "true" for the first login only.

3. Start the container

docker compose up -d
docker compose logs -f

Wait until you see the server listening. Ctrl+C to leave logs.

4. Put HTTPS in front (public internet)

Vaultwarden expects HTTPS for clients. Easiest path on a VPS with a domain:

sudo apt install -y caddy
sudo nano /etc/caddy/Caddyfile

Example:

vault.example.com {
    reverse_proxy 127.0.0.1:8080
}
sudo systemctl reload caddy

Caddy grabs a Let’s Encrypt cert automatically. Open https://vault.example.com in a browser—you should see the Vaultwarden login page.

Tailscale-only? Skip Caddy and use Tailscale Serve or HTTPS on the tailnet; many people access http://100.x.x.x:8080 only over Tailscale for a homelab. For phone clients, HTTPS on the tailnet hostname is cleaner.

5. Create your admin account

  1. Open the web vault in a browser.
  2. Create account with the email you’ll use everywhere.
  3. The first account on a fresh install is the admin.
  4. Set SIGNUPS_ALLOWED to "false" in docker-compose.yml, then docker compose up -d again so randos can’t register.

Optional: set ADMIN_TOKEN in the compose file for the admin panel at /admin.

6. Point Bitwarden clients at your server

On each device (Bitwarden app, browser extension):

  1. Log out of any existing vault (or add a second account).
  2. On the login screen, tap the gear or self-hosted environment option.
  3. Enter your server URL: https://vault.example.com (no path).
  4. Log in with the account you just created.

Import an export from 1Password or Bitwarden cloud if you’re migrating—test unlock on one device before you delete the old vault.

7. Back up vw-data

Everything important is in ~/vaultwarden/vw-data. Copy it off the server regularly:

# example: tarball to your laptop
scp -r user@vps:~/vaultwarden/vw-data ./vw-data-backup-$(date +%F)

Schedule that weekly. Restoring is: stop container, restore folder, start container. Also save your master password and 2FA recovery codes somewhere that isn’t inside the vault.

Common mistakes

  • Forgetting HTTPS—mobile clients will refuse or warn endlessly
  • Leaving SIGNUPS_ALLOWED on after your account exists (open registration on the internet is bad)
  • Treating the VPS disk as “backup”—if the provider nukes the VM, you need a copy elsewhere
  • Migrating from cloud Bitwarden without testing unlock and 2FA on a second device first

Tooling that helps

  • Caddy or Nginx Proxy Manager for TLS without yak-shaving
  • Tailscale if you don’t want the vault on the public internet at all
  • restic or rclone to push vw-data to object storage on a schedule

Wrap-up

You now own the vault file, the server, and the backup problem. That’s the trade. Run a restore test once, keep signups closed, and point every client at your URL—not bitwarden.com.

Who should skip this: if you won’t patch the VPS or test backups, paid Bitwarden cloud is a better fit than a neglected self-hosted copy.

Related