What is it for?
Vaultwarden is a lightweight version of the Bitwarden server. You keep using the official Bitwarden apps (phone, browser, desktop), but your passwords are stored, encrypted, on your own server.
Who is it for?
Everyone: it is often the very first app people self-host.
Good to know
Bitwarden apps require HTTPS: Vaultwarden must sit behind a reverse proxy with a certificate.
After installing
- Sign-ups are closed for safety. To create your account, set SIGNUPS_ALLOWED to "true", restart with docker compose up -d, sign up, then set it back to "false" and restart.
- In the Bitwarden app, choose "Self-hosted" and enter your server address.
The docker-compose
Example behind Traefik. To adapt it (Nginx Proxy Manager, local port…) with a line-by-line explanation, use the generator (in French).
# docker-compose.yml : Vaultwarden
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
user: "1000:1000"
read_only: true
tmpfs:
- /tmp
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
environment:
DOMAIN: https://vault.mydomain.com
SIGNUPS_ALLOWED: "false"
ROCKET_PORT: "8080"
TZ: Europe/Paris
volumes:
- ./data:/data
networks:
- traefik
labels:
- traefik.enable=true
- traefik.http.routers.vaultwarden.rule=Host(`vault.mydomain.com`)
- traefik.http.routers.vaultwarden.entrypoints=websecure
- traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt
- traefik.http.services.vaultwarden.loadbalancer.server.port=8080
networks:
traefik:
external: true