Vaultwarden Self-Host: Complete 2026 Tutorial (Docker, Raspberry Pi, TLS)

📌 Self-hosting is NOT for everyone: before you start, be honest - are you up for handling reverse proxy, TLS certs, encrypted backups and monthly Docker upgrades? If the answer is "not really," a managed vault like NordPass at $1.49/month will cost you less than a Raspberry Pi outage while you're on vacation. If yes, this tutorial is for you.

New to the idea? Start with our overview of self-hosted password managers.

Vaultwarden is the open source Rust rewrite of the Bitwarden server, designed to run on modest hardware (Raspberry Pi 4 is enough). This tutorial details a production-grade deployment with Docker Compose, automatic HTTPS Caddy proxy, and encrypted Backblaze B2 backups.

Vaultwarden runs your Bitwarden vault on your own hardware. 100% compatible with official clients. Setup in 30 minutes if you know Docker.

01 - Prerequisites

• A Linux server (Raspberry Pi 4, VPS, or homelab) with Docker installed
• A domain name pointing to the server's public IP (e.g., vault.yourdomain.com)
• Port 443 open in firewall / NAT
• 30 minutes
• ~50 MB storage for Vaultwarden + your future data

02 - Target Architecture

Internet → Cloudflare (optional) → Caddy reverse proxy with automatic Let's Encrypt → Vaultwarden container. Data stored on the host at /srv/vaultwarden/data.

Caddy handles HTTPS automatically via Let's Encrypt. Vaultwarden runs in an isolated Docker container.

03 - Docker Compose

Create the file /srv/vaultwarden/docker-compose.yml. The configuration uses the official vaultwarden/server:latest image, exposes the DOMAIN variable pointing to your HTTPS URL, disables external signups with SIGNUPS_ALLOWED: false, enables WebSockets for real-time sync, and mounts a ./data volume for persistence.

The Caddy configuration is minimal: a single reverse_proxy vaultwarden:80 directive plus standard security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).

The ADMIN_TOKEN is generated with openssl rand -base64 48 (to put in your local config only, never committed).

04 - Start Vaultwarden

Launch the service with docker compose up -d from the /srv/vaultwarden folder, then check logs with docker compose logs -f vaultwarden. Caddy obtains a Let's Encrypt certificate automatically within 30 seconds (visible in docker compose logs caddy).

05 - First Login + Hardening

1. Open https://vault.yourdomain.com in your browser
2. Create your account (the only one allowed: signups closed after)
3. IMMEDIATELY: Settings → Security → Two-step Login → enable TOTP
4. IMMEDIATELY: verify SIGNUPS_ALLOWED is false
5. Test autofill with your browser pointing to your custom URL

06 - Automatic Backups

An hourly bash script snapshots the SQLite database (consistent without service stop), zips the entire folder, encrypts with GPG client-side (recipient = your email), and uploads to Backblaze B2 (~$1/month for 100 GB).

The sequence:

1. docker exec vaultwarden sqlite3 /data/db.sqlite3 ".backup '/tmp/db_DATE.sqlite3'" for consistent snapshot
2. tar czf to archive
3. gpg --encrypt --recipient you@email.com for client-side encryption
4. b2 upload-file for remote upload
5. Local cleanup

Crontab: 0 * * * * /usr/local/bin/vaultwarden-backup.sh

Monthly test: restore a backup on a dev instance to verify integrity.

07 - Connect Official Bitwarden Clients

In each Bitwarden client (mobile, desktop, browser), before logging in:

1. Click the Settings gear (before login)
2. Server URL: https://vault.yourdomain.com
3. Save
4. Log in with your master password

All clients work exactly as with the official Bitwarden cloud.

08 - Maintenance

• Vaultwarden updates: docker compose pull && docker compose up -d (monthly recommended)
• Monitoring: Uptime Kuma (self-hosted) or Healthchecks.io (free) for downtime alerts
• Logs: docker compose logs --tail 200 vaultwarden
• Audit: follow github.com/dani-garcia/vaultwarden for potential CVEs

09 - Going Further

• Best self-hosted password managers 2026 - Vaultwarden vs Bitwarden self-host, KeePassXC, Passbolt and Psono compared
• Complete 2026 Bitwarden review
• Best password manager 2026 ranking - compare managed cloud vaults if self-hosting feels like too much
• Best LastPass alternatives 2026 - for teams migrating away from LastPass before deciding on self-host
• Public methodology

Tutorial based on Vaultwarden 1.31.x on Raspberry Pi 4 (Debian 12) in June 2026. Procedures validated against the official Vaultwarden documentation.