Disclosure: I run Buran.host, a small VPS reseller, so I show everything on my own server. The steps work on any Ubuntu 22.04/24.04 VPS with Docker.

Vaultwarden is a lightweight Rust implementation of the Bitwarden server. It works with all the official clients (browser extensions, iOS/Android and desktop apps), and the vault is a single directory with SQLite on your own server. It uses roughly 100–200 MB of RAM, so even the smallest plan is enough.

1. Firewall and directory 

apt update && apt install -y ufw ufw allow OpenSSH && ufw allow 80/tcp && ufw allow 443/tcp && ufw --force enable mkdir -p /opt/vaultwarden/data && cd /opt/vaultwarden echo "ADMIN_TOKEN=$(openssl rand -base64 48)" > .env # save this token

Docker must be installed (on Ubuntu: curl -fsSL https://get.docker.com | sh).

2. docker-compose.yml 

services: vaultwarden: image: vaultwarden/server:latest restart: unless-stopped env_file: .env environment: - DOMAIN=https://vault.example.com - SIGNUPS_ALLOWED=true - WEB_VAULT_ENABLED=true ports: - "127.0.0.1:8085:80" volumes: - ./data:/data

The port is bound to 127.0.0.1 only: the service reaches the internet through Caddy. Start it with docker compose up -d.

3. HTTPS with Caddy

Point an A record for vault.example.com at your server's IP first. Then:

apt install -y caddy cat > /etc/caddy/Caddyfile <<'EOF' vault.example.com { reverse_proxy 127.0.0.1:8085 } EOF systemctl reload caddy

Caddy obtains and renews the Let's Encrypt certificate by itself.

4. Close registration

Open https://vault.example.com, create your account and immediately change SIGNUPS_ALLOWED=true to false in docker-compose.yml, then run docker compose up -d again. Otherwise anyone who finds the address can create an account on your server.

The admin panel lives at /admin. Here the token is stored in plain form: that is acceptable for a personal server, but the project recommends storing an Argon2 hash in ADMIN_TOKEN (generated with the vaultwarden hash command) if you keep the admin panel enabled.

5. Connect your clients

In any Bitwarden client, choose Self-hosted on the login screen and enter https://vault.example.com. After that, sign in as usual.

6. Backups — do not skip this

The whole vault is the ./data directory. Keep a copy outside this server: for example an encrypted restic repository on a nightly systemd timer. A copy on the same disk will not save you if the server itself is lost. Test the restore: a backup you have never restored is a hope, not a backup.

What you get

Your own password server: your domain, your disk, updates in your hands. The one honest downside: administration is now your job — image updates, backups, monitoring.

A longer version with FAQ: https://buran.host/guides/vaultwarden-vps