Vaultwarden Self-Host: Complete 2026 Tutorial (Docker, Raspberry Pi, TLS)

📌 Self-hosting is NOT for everyone: before you start, be honest — are you up for handling reverse proxy, TLS certs, encrypted backups and monthly Docker upgrades? If the answer is "not really," a managed vault like NordPass at $1.49/month will cost you less than a Raspberry Pi outage while you're on vacation. If yes, this tutorial is for you.

Vaultwarden is the open source Rust rewrite of the Bitwarden server, designed to run on modest hardware (Raspberry Pi 4 is enough). This tutorial details a production-grade deployment with Docker Compose, automatic HTTPS Caddy proxy, and encrypted Backblaze B2 backups.

Vaultwarden runs your Bitwarden vault on your own hardware. 100% compatible with official clients. Setup in 30 minutes if you know Docker.

01 — Prerequisites

• A Linux server (Raspberry Pi 4, VPS, or homelab) with Docker installed
• A domain name pointing to the server's public IP (e.g., vault.yourdomain.com)
• Port 443 open in firewall / NAT
• 30 minutes
• ~50 MB storage for Vaultwarden + your future data

02 — Target Architecture

Internet → Cloudflare (optional) → Caddy reverse proxy with automatic Let's Encrypt → Vaultwarden container. Data stored on the host at /srv/vaultwarden/data.

Caddy handles HTTPS automatically via Let's Encrypt. Vaultwarden runs in an isolated Docker container.

03 — Docker Compose

Create the file /srv/vaultwarden/docker-compose.yml. The configuration uses the official vaultwarden/server:latest image, exposes the DOMAIN variable pointing to your HTTPS URL, disables external signups with SIGNUPS_ALLOWED: false, enables WebSockets for real-time sync, and mounts a ./data volume for persistence.

The Caddy configuration is minimal: a single reverse_proxy vaultwarden:80 directive plus standard security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).

The ADMIN_TOKEN is generated with openssl rand -base64 48 (to put in your local config only, never committed).

04 — Start Vaultwarden

Launch the service with docker compose up -d from the /srv/vaultwarden folder, then check logs with docker compose logs -f vaultwarden. Caddy obtains a Let's Encrypt certificate automatically within 30 seconds (visible in docker compose logs caddy).

05 — First Login + Hardening

1. Open https://vault.yourdomain.com in your browser
2. Create your account (the only one allowed: signups closed after)
3. IMMEDIATELY: Settings → Security → Two-step Login → enable TOTP
4. IMMEDIATELY: verify SIGNUPS_ALLOWED is false
5. Test autofill with your browser pointing to your custom URL

06 — Automatic Backups

An hourly bash script snapshots the SQLite database (consistent without service stop), zips the entire folder, encrypts with GPG client-side (recipient = your email), and uploads to Backblaze B2 (~$1/month for 100 GB).

The sequence:

1. docker exec vaultwarden sqlite3 /data/db.sqlite3 ".backup '/tmp/db_DATE.sqlite3'" for consistent snapshot
2. tar czf to archive
3. gpg --encrypt --recipient you@email.com for client-side encryption
4. b2 upload-file for remote upload
5. Local cleanup

Crontab: 0 * * * * /usr/local/bin/vaultwarden-backup.sh

Monthly test: restore a backup on a dev instance to verify integrity.

07 — Connect Official Bitwarden Clients

In each Bitwarden client (mobile, desktop, browser), before logging in:

1. Click the Settings gear (before login)
2. Server URL: https://vault.yourdomain.com
3. Save
4. Log in with your master password

All clients work exactly as with the official Bitwarden cloud.

08 — Maintenance

• Vaultwarden updates: docker compose pull && docker compose up -d (monthly recommended)
• Monitoring: Uptime Kuma (self-hosted) or Healthchecks.io (free) for downtime alerts
• Logs: docker compose logs --tail 200 vaultwarden
• Audit: follow github.com/dani-garcia/vaultwarden for potential CVEs

09 — Going Further

• Complete 2026 Bitwarden review
• Best password manager 2026 ranking — compare managed cloud vaults if self-hosting feels like too much
• Best LastPass alternatives 2026 — for teams migrating away from LastPass before deciding on self-host
• Public methodology

Tutorial based on Vaultwarden 1.31.x on Raspberry Pi 4 (Debian 12) in June 2026. Procedures tested on 2 production instances in parallel over 8 months.