Vaultwarden: your own password vault

Vaultwarden is a lightweight server for the Bitwarden apps and browser extensions. Your passwords are then stored on your own VPS. That does call for care: if your server breaks or your backup is missing, you lose your passwords.

Each recipe builds on the working folder /srv/diensten with Caddy from Your working folder with compose.yaml, .env and Caddy. You add a service to compose.yaml, a block to the Caddyfile, and an A and AAAA record for the name (see A and AAAA records in My Domains).

1. DNS

Create an A and AAAA record for kluis.example.com.

2. compose.yaml

  vaultwarden:
    image: vaultwarden/server:1.37.5
    restart: unless-stopped
    environment:
      DOMAIN: "https://kluis.example.com"
      SIGNUPS_ALLOWED: "true"
      ADMIN_TOKEN: ${VW_ADMIN_TOKEN}
    volumes:
      - ./vw-data:/data

Check the Vaultwarden releases page to see which version is the latest and put it in the tag.

3. Caddyfile and starting

kluis.example.com {
	reverse_proxy vaultwarden:80
}

anna@web1:/srv/diensten$ sudo docker compose up -d
anna@web1:/srv/diensten$ sudo docker compose exec -w /etc/caddy caddy caddy reload

4. The admin token in .env

You protect the admin page /admin with a token. Don't put a readable password in it, but a hash. You create that hash with Vaultwarden itself, now that the container is running:

anna@web1:/srv/diensten$ sudo docker compose exec vaultwarden /vaultwarden hash
Password:
Confirm Password:

ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$...'

In .env, add the line VW_ADMIN_TOKEN='$argon2id$...', with single quotes. Restart the container with sudo docker compose up -d. You log in to /admin with the password you typed, not with the hash.

5. Closing registration

1. Open https://kluis.example.com and create your own account, plus those of your family or colleagues.
2. In compose.yaml, set SIGNUPS_ALLOWED: "false".
3. Run sudo docker compose up -d.

After that, you invite new people via the admin page. If you want invitations to go out by email, set up SMTP via a mailbox on port 587 (see Reverse DNS and sending mail from your VPS).

Backup

Everything is stored in the folder /srv/diensten/vw-data: the database, attachments and keys. Include it in your restic backup (see Backing up databases and Docker volumes properly) and test restoring it. The Vaultwarden wiki describes how to copy the database safely while it is running.

Tip: Your apps and browser extensions keep a copy of your vault. If your server goes down for a while, you can still read your passwords, but not change them.