Who It’s For#

I think it’s suitable for these people:

• Already have their own small server
• Want to keep their password data in their own hands
• Are willing to deal with the dirty work of HTTPS, backups, and updates

If you just want peace of mind, then official Bitwarden hosting, 1Password, or Apple Password Manager are all great options.

Vaultwarden’s advantage isn’t zero maintenance, but rather that it’s lighter, more flexible, and better suited for a poor student’s small machine.

What You’ll Need#

• A VPS capable of running Docker
• A domain, or at least a stable HTTPS entry point
• Docker and Docker Compose
• Basic knowledge of SSH, reverse proxies, and firewalls

If you haven’t installed Docker yet, you can check out Docker and Docker Compose Minimum Introduction: Understanding those YML files first.

If you haven’t set up a domain yet, you can check out Get a Free Domain for Your New Blog, Then Show Your Face in the Webmaster Community first.

Create Directories#

I’ll still put it in /srv/stacks here.

1
sudo mkdir -p /srv/stacks/vaultwarden
2
sudo chown -R $USER:$USER /srv/stacks/vaultwarden
3
cd /srv/stacks/vaultwarden
4
mkdir -p vw-data

The directory structure will look something like this:

1
/srv/stacks/vaultwarden/
2
  docker-compose.yml
3
  vw-data/

Later, the database, attachments, and other stuff will all be in vw-data.

First, Write the Compose File#

1
services:
2
  vaultwarden:
3
    image: ghcr.io/dani-garcia/vaultwarden:latest
4
    container_name: vaultwarden
5
    restart: unless-stopped
6
    environment:
7
      DOMAIN: "https://vault.example.com"
8
      SIGNUPS_ALLOWED: "true"
9
      INVITATIONS_ALLOWED: "false"
10
      ENABLE_WEBSOCKET: "true"
11
      TZ: "Asia/Shanghai"
12
    volumes:
13
      - ./vw-data:/data
14
    ports:
15
      - "127.0.0.1:8080:80"

Replace vault.example.com with your own domain.

The most important line here is:

1
127.0.0.1:8080:80

This means Vaultwarden only listens on 8080 on the local machine.

The public internet won’t hit it directly; it can only be routed through Nginx, Caddy, or Cloudflare Tunnel.

Don’t just write it like this from the start:

1
0.0.0.0:8080:80

Having your password vault directly exposed on a public HTTP port is a no-go.

A quick word on a few variables:

• DOMAIN: The actual HTTPS address you’ll access.
• SIGNUPS_ALLOWED: Temporarily enable it for the first registration, then turn it off.
• INVITATIONS_ALLOWED: Directly disable it for personal use.
• ENABLE_WEBSOCKET: Keep it enabled; client sync experience will be smoother.

Start It Up#

1
docker compose up -d
2
docker compose logs -f vaultwarden

Check it locally:

1
curl -I http://127.0.0.1:8080/

If it returns a status code, the container is alive.

But that’s not the end of the setup, because what’s truly important is HTTPS.

Reverse Proxy and HTTPS#

You shouldn’t run something like Vaultwarden on HTTP long-term.

Browser security contexts, password manager clients, and your own peace of mind all demand that you get HTTPS right.

I usually choose one of two paths.

1
vault.example.com {
2
  reverse_proxy 127.0.0.1:8080
3
}

1
server {
2
    listen 80;
3
    server_name vault.example.com;
4
    return 301 https://$host$request_uri;
5
}
6

7
server {
8
    listen 443 ssl http2;
9
    server_name vault.example.com;
10

11
    ssl_certificate /path/to/fullchain.pem;
12
    ssl_certificate_key /path/to/privkey.pem;
13

14
    location / {
15
        client_max_body_size 525M;
16
        proxy_pass http://127.0.0.1:8080;
17
        proxy_set_header Host $host;
18
        proxy_set_header X-Real-IP $remote_addr;
19
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
20
        proxy_set_header X-Forwarded-Proto $scheme;
21
        proxy_set_header Upgrade $http_upgrade;
22
        proxy_set_header Connection "upgrade";
23
    }
24
}

1
sudo nginx -t
2
sudo systemctl reload nginx

1
vault.example.com
2
  -> Cloudflare
3
  -> Cloudflare Tunnel
4
  -> 127.0.0.1:8080
5
  -> Vaultwarden

Disable Registration Immediately After First Signup#

After opening https://vault.example.com for the first time, set up your main account.

Once done, immediately change the configuration:

1
SIGNUPS_ALLOWED: "false"

Then restart:

1
docker compose up -d

Don’t think your domain is obscure; public services will eventually be scanned.

What to Do After Setting Up Your Account#

• Set a truly strong master password.
• Enable two-factor authentication.
• Only import passwords after confirming HTTPS is working correctly.
• Before importing, export an offline backup from your old password manager.

And here’s a very realistic point:

Don’t carelessly throw server SSH keys, panel passwords, and various root-level credentials into a password vault without a clear backup strategy.

Set it up first, then migrate gradually.

Backup#

Vaultwarden’s most important data is right here:

1
/srv/stacks/vaultwarden/vw-data

The simplest approach is to first let it perform an internal backup, then package the entire directory.

1
cd /srv/stacks/vaultwarden
2
mkdir -p backups
3
docker compose exec -T vaultwarden /vaultwarden backup
4
tar -czf backups/vaultwarden-$(date +%Y%m%d-%H%M%S).tar.gz docker-compose.yml vw-data

If you’re using things like .env, SMTP, or admin tokens, back those up too, but don’t put them in a public repository.

Then pull the backup back to your local machine, or sync it to another server.

1
scp your-server:/srv/stacks/vaultwarden/backups/vaultwarden-20260625-030000.tar.gz .

Don’t just keep it on the same server.

On-server backups often amount to no backup at all.

Recovery Drill#

Only knowing how to back up, but not how to restore, is actually quite dangerous.

You should at least occasionally check if there’s anything inside the backup package:

1
tar -tzf backups/vaultwarden-20260625-030000.tar.gz | sed -n '1,30p'

Normally, you should see:

1
docker-compose.yml
2
vw-data/
3
vw-data/db.sqlite3

When actually restoring, first stop the service, then move the old data aside:

1
cd /srv/stacks/vaultwarden
2
docker compose down
3
mv vw-data vw-data.before-restore-$(date +%Y%m%d-%H%M%S)
4
tar -xzf backups/vaultwarden-20260625-030000.tar.gz
5
docker compose up -d

After restoring, check at least four things:

• The web page can be opened.
• You can log in.
• Entries are still there.
• Browser extensions and mobile clients can sync.

Don’t wait until things actually blow up to learn how to restore for the first time.

Updates#

Back up before updating; don’t be lazy about this.

1
cd /srv/stacks/vaultwarden
2
docker compose exec -T vaultwarden /vaultwarden backup
3
docker compose pull
4
docker compose up -d
5
docker compose logs --tail=100 vaultwarden

After updating, don’t just look at the logs; click around on the web interface and client yourself to test it.

Is It Suitable for 2C2G?#

Very suitable.

Vaultwarden itself doesn’t consume much in terms of resources; a 2C2G server can run it easily.

The real cost isn’t in CPU and memory, but in maintenance habits:

• HTTPS
• Disabling registration
• Backups
• Recovery
• Updates

If you just want a service to screenshot and post on social media, then this isn’t for you.

If you want to seriously start your self-hosting journey, it’s actually very suitable as your first serious service.

Because a password vault will force you to complete many fundamental habits.