I use a password manager for everything — every account, every service. My passwords are the most sensitive data I generate. I'd been on a hosted password manager and the service worked fine, but I spent more time than I'd like thinking about what happens if the company has a breach, gets acquired, or changes its pricing.
Vaultwarden is the self-hosted answer. It's a Rust reimplementation of the Bitwarden server that's compatible with all official Bitwarden clients — the same browser extensions, desktop apps, and mobile apps work without any modification. You run the server, your clients connect to it, your passwords never leave your infrastructure.
HTTPS is absolutely required — password managers should never run on plain HTTP. This guide includes the Nginx and SSL setup as a mandatory part of the installation.
Self-hosting your password manager means your vault is under your control, not on someone else's servers.
I run Vaultwarden on Tencent Cloud Lighthouse. It uses less than 100 MB RAM — it runs comfortably on the entry-level plan alongside other services. The key reason to use a reliable cloud server for a password manager specifically: uptime — if Vaultwarden is down, you can't access new passwords. Lighthouse's stable infrastructure and the ability to configure automatic snapshots means your vault data is both available and backed up. HTTPS is required for Vaultwarden, and Lighthouse's OrcaTerm makes it easy to set up Certbot without a local SSH client.
- Key Takeaways
| Requirement | Notes |
|---|---|
| Cloud server | Tencent Cloud Lighthouse — select Docker CE application image for pre-installed Docker |
| Docker + Compose | Pre-installed with Docker CE image; or install manually |
| Domain name + HTTPS | Required — Bitwarden clients reject HTTP connections |
| Strong server security | Password manager = high-value target |
ssh ubuntu@YOUR_SERVER_IP
sudo apt update && sudo apt upgrade -y
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
newgrp docker
sudo apt install -y nginx
sudo ufw allow ssh
sudo ufw allow 'Nginx Full'
sudo ufw enable
mkdir -p ~/apps/vaultwarden && cd ~/apps/vaultwarden
Create .env:
nano .env
# Admin token — set a strong random value
# Access admin panel at: https://vault.yourdomain.com/admin
ADMIN_TOKEN=generate_a_strong_random_token_here
# Domain (required for WebSocket and push notifications)
DOMAIN=https://vault.yourdomain.com
# Enable user registration (set to false after creating your account)
SIGNUPS_ALLOWED=true
# Email settings (for password reset, 2FA, etc.)
SMTP_HOST=smtp.mailgun.org
SMTP_FROM=vaultwarden@yourdomain.com
SMTP_FROM_NAME=Vaultwarden
SMTP_PORT=587
SMTP_SSL=true
SMTP_USERNAME=postmaster@mg.yourdomain.com
SMTP_PASSWORD=your_smtp_password
chmod 600 .env
Create docker-compose.yml:
version: '3.8'
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
ports:
- "3012:3012" # WebSocket notifications
- "8080:80" # Web vault
volumes:
- vaultwarden_data:/data
env_file:
- .env
volumes:
vaultwarden_data:
docker compose up -d
docker compose logs -f vaultwarden
# Wait for: Rocket has launched from http://0.0.0.0:80
sudo nano /etc/nginx/sites-available/vaultwarden
server {
listen 80;
server_name vault.yourdomain.com;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# WebSocket notifications (required for real-time sync)
location /notifications/hub {
proxy_pass http://127.0.0.1:3012;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location /notifications/hub/negotiate {
proxy_pass http://127.0.0.1:8080;
}
}
sudo ln -s /etc/nginx/sites-available/vaultwarden /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d vault.yourdomain.com
HTTPS is mandatory for Vaultwarden. The Bitwarden mobile apps and browser extensions will refuse to connect to an HTTP endpoint.
Visit https://vault.yourdomain.com.
After creating your account, disable registration in .env:
SIGNUPS_ALLOWED=false
docker compose restart vaultwarden
This prevents anyone else from creating accounts on your server.
https://vault.yourdomain.comhttps://vault.yourdomain.comSame process — find the server settings on the login screen and enter your server URL.
Access the admin panel at https://vault.yourdomain.com/admin.
Enter the ADMIN_TOKEN from your .env file.
From here you can:
Useful admin settings:
Organizations: Enable (allows shared vaults between users)
Emergency Access: Enable (lets trusted contacts access your vault if needed)
Send: Enable (secure file/text sharing)
Your password vault is critical data. Back it up frequently and to multiple locations.
nano ~/backup_vaultwarden.sh
#!/bin/bash
BACKUP_DIR=/home/ubuntu/backups/vaultwarden
DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p $BACKUP_DIR
# Backup the entire Vaultwarden data volume
docker run --rm \
-v vaultwarden_vaultwarden_data:/data \
-v $BACKUP_DIR:/backup \
alpine tar czf /backup/vaultwarden_$DATE.tar.gz -C /data .
# Keep 30 days of backups (passwords are important!)
find $BACKUP_DIR -name "vaultwarden_*.tar.gz" -mtime +30 -delete
echo "Vaultwarden backup: $DATE"
echo "Backup size: $(du -sh $BACKUP_DIR/vaultwarden_$DATE.tar.gz | cut -f1)"
chmod +x ~/backup_vaultwarden.sh
# Run twice daily (password vault is critical)
(crontab -l; echo "0 6,18 * * * ~/backup_vaultwarden.sh") | crontab -
Also export your vault manually periodically:
Every Bitwarden client enforces HTTPS connections. Attempting to connect to an HTTP Vaultwarden instance results in:
Verify HTTPS is working before trying to connect clients:
curl -I https://vault.yourdomain.com
# Should return: HTTP/2 200
If you get a certificate error, fix Certbot before proceeding:
sudo certbot renew --force-renewal
sudo systemctl reload nginx
docker compose pull && docker compose up -d| Issue | Likely Cause | Fix |
|---|---|---|
| Connection refused | Service not running or wrong port | Check systemctl status SERVICE and verify firewall rules |
| Permission denied | Wrong file ownership or permissions | Check file ownership with ls -la and use chown/chmod to fix |
| 502 Bad Gateway | Backend service not running | Restart the backend service; check logs with journalctl -u SERVICE |
| SSL certificate error | Certificate expired or domain mismatch | Run sudo certbot renew and verify domain DNS points to server IP |
| Service not starting | Config error or missing dependency | Check logs with journalctl -u SERVICE -n 50 for specific error |
| Out of disk space | Logs or data accumulation | Run df -h to identify usage; clean logs or attach CBS storage |
| High memory usage | Too many processes or memory leak | Check with htop; consider upgrading instance plan if consistently high |
| Firewall blocking traffic | Port not open in UFW or Lighthouse console | Open port in Lighthouse console firewall AND sudo ufw allow PORT |
Does Vaultwarden conflict with Lighthouse's console-level firewall?
No — they operate at different layers. Lighthouse's console firewall blocks at the network infrastructure level. Vaultwarden operates at the OS level. Both provide independent protection layers.
How do I check if Vaultwarden is working correctly?
Check the service status with sudo systemctl status vaultwarden. Review logs for recent activity. Most security tools have a test or dry-run mode to verify configuration.
What should I do if Vaultwarden blocks a legitimate user or IP?
Most security tools have a whitelist mechanism. Add trusted IPs to the whitelist/ignore list. For Fail2ban, use fail2ban-client set JAIL unbanip IP_ADDRESS.
How often should I review security logs?
For personal servers, a weekly review of auth logs and firewall logs is reasonable. For production or sensitive servers, set up log monitoring with alerts for suspicious patterns (unusually high fail rates, unusual hours).
Self-host your password manager:
👉 Tencent Cloud Lighthouse — Secure VPS for sensitive applications
👉 View current pricing and promotions
👉 Explore all active deals and offers