How to install Vaultwarden with Docker: A complete guide to self-hosting your passwords

Vaultwarden lets you host a password manager compatible with Bitwarden clients on your own server. This way, you can decide where the information is stored, who can access the service, and how backups are performed.

It is important to clarify from the beginning that Vaultwarden is not the official Bitwarden serverIt's an independent, community-driven implementation written in Rust that replicates much of Bitwarden's API. Because of this, it can be used with Bitwarden's official mobile apps, desktop programs, and extensions.

Self-hosting the service provides more control, but It does not automatically guarantee greater securityFrom that moment on, you are responsible for installing updates, securing access, reviewing logs, maintaining HTTPS, and ensuring that backups can be restored.

What you need to install Vaultwarden with Docker

Before you begin, you'll need a Docker-compatible system that remains powered on when you want to synchronize passwords. This could be a Linux server, a NAS, a mini PC, or a Raspberry Pi with an architecture supported by the image.

You will also need:

• Docker Engine installed and working.
• The current add-on of Docker Compose.
• A folder where the data can be permanently stored.
• Access to a terminal with permissions to manage Docker.
• A secure access method if you will be using the service from other devices.

There is no universal memory or storage requirement for all installations. Consumption depends on the number of users, attachments, storage size, and other services running on the same computer. For home use, it's usually a lightweight application, but you should reserve enough space for the data and its backups.

Check the installation using:

docker --version
docker compose version

If both commands show a version, you can continue.

How to install Vaultwarden with Docker Compose

Create a dedicated folder and enter it:

mkdir vaultwarden
cd vaultwarden

Inside the folder, create a file called compose.yml with this initial configuration:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8080:80"

The assembly ./vw-data:/data It is essential. The folder /data It contains the database, attachments, configuration, and keys used by the server. If you delete the container without preserving this folder, you will lose the stored information.

The address 127.0.0.1 This initial installation only responds on the server itself. It's a suitable configuration for testing Vaultwarden without yet exposing the port to the network.

Start the container:

docker compose up -d

Check its status:

docker compose ps
docker compose logs --tail=100 vaultwarden

From the same device you can open:

http://localhost:8080

Access via localhost This is used to complete the initial setup. To connect from another computer, a mobile app, or an extension, you will need to set up a secure address using HTTPS.

How to create your first account and close the registration

Open the web interface, create your first account, and verify that you can log in. Use a long, unique, and easy-to-remember master password, as it protects access to the entire warehouse.

After creating the necessary accounts, edit compose.yml and changes:

SIGNUPS_ALLOWED: "true"

by:

SIGNUPS_ALLOWED: "false"

Apply the change by recreating the container:

docker compose up -d

Vaultwarden allows anonymous users to create accounts by default. Keeping registration open unnecessarily makes it easier for third parties to take up space or use your server without permission.

If you later enable the administration panel, you will be able to send invitations even with public registration disabled.

Why Vaultwarden Needs HTTPS

The web store uses the browser's Web Crypto API. These cryptographic features are typically only available in secure contexts, such as HTTPS or localhost.

For this reason, opening http://192.168.1.50:8080 From another computer, errors may be displayed even if the container is running. Publishing the port on the network does not replace HTTPS configuration.

There are three common ways to use Vaultwarden:

• Server only: access via localhost, useful for testing.
• On a private network or VPN: restricted access, but maintaining a valid HTTPS certificate.
• From the Internet: domain, reverse proxy, valid certificate, and properly configured firewall.

You don't have to open Vaultwarden publicly to use it outside your home. A VPN can restrict access to your authorized devices, but the address used by clients must still have a certificate they recognize.

How to configure HTTPS with Caddy

Caddy is one of the simplest options because it can automatically request and renew certificates through ACME. To use a public certificate, the domain must resolve to your server and the necessary ports must be accessible.

A joint Vaultwarden and Caddy configuration can use this file. compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "false"
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2
    container_name: vaultwarden-caddy
    restart: unless-stopped
    depends_on:
      - vaultwarden
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-data:/data
      - ./caddy-config:/config

Replaces vault.example.com for your actual domain. Then create a file called Caddyfile:

vault.example.com {
    reverse_proxy vaultwarden:80 {
        header_up X-Real-IP {remote_host}
    }
}

Activate services:

docker compose up -d

Caddy will send requests to the container over the internal network created by Compose. The current configuration can also handle WebSocket notifications through the same destination, so there's no need to publish another Vaultwarden port.

The variable DOMAIN must contain the exact external URL, including https://An incorrect address can cause problems with attachments, links, authentication, or clients.

How to connect the official Bitwarden apps

On the extension's login screen, mobile app, or desktop program, open the server selector and choose the option Self-hosted.

Enter the full address:

https://vault.example.com

Save the settings before logging in. Each client must be connected to the same server for changes to be synchronized correctly.

If you use a certificate issued by a private authority, you'll need to properly install and trust that authority on all devices. To avoid compatibility issues, it's preferable to use a valid public certificate or a private solution whose chain of trust you can properly control.

Once the client is connected, you can Import Chrome passwords to Vaultwarden and check that they appear on all your devices.

How to protect the administration panel

Vaultwarden offers an optional panel in /adminFrom there you can review users, organizations, diagnostics and certain server options.

If you don't need the panel, the safest thing to do is leave it disabledTo enable it, you must configure ADMIN_TOKENInstead of storing a password in plain text, it generates an Argon2id hash:

docker run --rm -it vaultwarden/server /vaultwarden hash

The command will prompt for the password twice and return a string that begins with $argon2id$.

A convenient way to avoid problems with dollar signs is to save it in a file .env located next to compose.yml:

VAULTWARDEN_ADMIN_TOKEN='$argon2id$v=19$m=...'

Then add to the service:

environment:
  ADMIN_TOKEN: "${VAULTWARDEN_ADMIN_TOKEN}"

If you write the hash directly inside compose.yml, you must double each dollar sign as $$ to prevent Docker Compose from trying to interpret it as a variable.

Check the processed configuration using:

docker compose config

The panel should only be accessed via HTTPS. If possible, restrict its path to the local network, a VPN, or specific IP addresses.

Please note that after saving options from /adminVaultwarden creates config.jsonIts values ​​take precedence over equivalent environment variables. This precedence explains many cases where editing Compose appears to produce no change.

Essential measures to protect Vaultwarden

Security doesn't end with enabling HTTPS. At a minimum, apply these measures:

• Disable the open registry using SIGNUPS_ALLOWED=false.
• Use a unique and strong master password.
• Active two-step authentication for all accounts.
• Save the authentication recovery code in another secure location.
• Regularly update the image and host system.
• Do not mount unnecessary folders or the Docker socket inside the container.
• Limit the ports that are truly necessary using the firewall.
• Do not publicly expose the database or the folder vw-data.

Fail2ban can block addresses that accumulate failed login attempts, but it must be configured carefully when a reverse proxy is present. Caddy or Nginx must transmit the real IP address; otherwise, Fail2ban could block the proxy's own address.

You can also disable the display of password hints. These hints can facilitate guessing attacks when the server is publicly accessible.

To learn more about these practices, you can consult how use password managers securely.

How to set up email notifications

The SMTP configuration allows you to send invitations, verifications, and notifications. You will need to specify the server, sender, port, security method, and credentials provided by your email service.

Don't confuse SMTP emails with a backup of the vault. Nor should you rely on them as the sole means of account recovery. If you forget your master password and don't have another recovery method set up, you could lose access to your encrypted data.

After saving the settings, send a test message and check the logs if it doesn't arrive. Also check your spam folders and SMTP provider restrictions.

How to make a full backup of Vaultwarden

The SQLite database stores users, items, devices, and organizations, but It does not contain all the filesAttachments and certain submissions are stored in separate directories.

A complete copy should include:

• db.sqlite3 or a consistent copy of the database.
• The folder attachments.
• The folder sends, if you want to keep those files.
• The file config.json, if you use the panel.
• The files rsa_key*.
• The Compose files, Caddy and their variables.

For a simple and consistent backup, you can temporarily stop Vaultwarden and archive the folder:

docker compose stop vaultwarden
tar -czf vaultwarden-backup-$(date +%F).tar.gz vw-data compose.yml Caddyfile .env
docker compose start vaultwarden

The file may contain the administration token and SMTP credentials. Encrypt it before copying it to another computer or remote storage.

If you don't want to stop the service, Vaultwarden includes a command that uses the SQLite copy mechanism:

docker exec vaultwarden /vaultwarden backup

This command protects the database, but you should still back up attachments, configuration files, and keys. Automate backups, keep at least one off-server, and periodically test a restore.

How to update Vaultwarden with Docker

Create a verified copy before updating. Then run:

docker compose pull
docker compose up -d

Check the status and latest messages:

docker compose ps
docker compose logs --tail=100 vaultwarden

Docker will download the image and recreate the container, preserving vw-dataDo not use global cleanup commands without first checking which containers, images, and networks they will remove.

In installations where stability is critical, you can fix a specific version of the image instead of always using the default. latestThis way you can review the release notes and decide when to apply each update.

Common mistakes when installing Vaultwarden with Docker

The interface works on localhost, but not from another computer.

The port is limited to 127.0.0.1 Or the browser rejects cryptographic functions when accessing via HTTP. Configure an HTTPS address before using the service from other devices.

The official client cannot connect to the server

Select the environment Self-hosted and enter the exact address with https://Check the certificate, DNS, proxy, and variable DOMAIN.

The container starts up, but the data disappears when it's recreated.

The volume control is not installed correctly. Please check that ./vw-data:/data appears in the settings and that you are running Compose from the expected folder.

I can't create another account

Si SIGNUPS_ALLOWED is in falseThe behavior is correct. Send an invitation from the panel or temporarily enable registration only while you create the account.

The ADMIN_TOKEN hash is not working

Check the interpolation of the signs $Use a file .env with single quotes or double the symbols if you insert the string directly into Compose.

Environmental variables appear to be ignored

Check if it exists vw-data/config.jsonOptions saved from the panel may override variables defined in compose.yml.

The certificates work in the browser, but not on the mobile device.

The device may not trust the entire certificate chain. Use a recognized authority or properly install your private authority and its certificates.

The attachments fail

Check that DOMAIN match the external address and ensure the proxy allows the necessary request size. Also check the available space and permissions of vw-data.

Vaultwarden cannot write inside vw-data

The host folder has incompatible permissions. Check the owner and permissions based on the error shown in the logs. Do not use chmod 777 as a permanent solution.

Fail2ban blocks an incorrect address

The proxy is not transmitting the real IP address, or Fail2ban is reading the wrong field. Configure it correctly. X-Real-IP or the header corresponding to your proxy.

The restored copy does not contain the attachments

Only SQLite was backed up. Please also restore the folders. attachments y sends, in addition to the RSA configuration and keys.

Vaultwarden allows you to use organizations and collections to share family passwords using compatible clients. Before adding more users, verify that HTTPS, two-step authentication, and backups are working correctly.

The result can be a fast, private, and adaptable password manager, but its security depends on maintenance. Control over the server is only advantageous when accompanied by updates, restricted access, and a proven recovery strategy.