Install Vaultwarden with Docker

This guide shows how to self-host Vaultwarden, a lightweight open-source server compatible with the Bitwarden password manager, with Docker Compose on your Linux server. It covers automatic backups, HTTPS via a reverse proxy and connecting the official Bitwarden apps.

Prerequisites:

✓ A server running a current Linux distribution (e.g. Ubuntu 24.04 or Debian 13) — Vaultwarden needs very few resources

✓ Docker and Docker Compose installed on the server

✓ A domain name pointing to your server's IP address — required for a secure HTTPS setup

Step 1: Create the Docker Compose File

Create Directory and File

mkdir vaultwarden && cd vaultwarden && nano docker-compose.yml

Paste the following content into the file. This configuration includes Vaultwarden itself and an automatic weekly, password-protected backup of your vault data. Replace vault.yourdomain.com with your domain and YOUR_BACKUP_PASSWORD with a secure password:

docker-compose.yml

services: vaultwarden: image: vaultwarden/server:latest restart: always environment: - DOMAIN=https://vault.yourdomain.com volumes: - ./vw-data:/data ports: - 127.0.0.1:8080:80 backup: image: ttionya/vaultwarden-backup:latest restart: always volumes: - ./vw-data:/bitwarden/data - ./rclone-config:/config environment: - CRON=0 0 * * 0 - ZIP_ENABLE=TRUE - ZIP_PASSWORD=YOUR_BACKUP_PASSWORD - BACKUP_KEEP_DAYS=28

Binding to 127.0.0.1:8080 ensures Vaultwarden is only accessible locally. External access is handled by the reverse proxy in Step 3.

Step 2: Start the Containers

The backup container uploads backups via rclone. First create an rclone remote named BitwardenBackup (e.g. SFTP or S3 storage outside the server) with the first command, then start both containers:

Configure Backup and Start

docker compose run --rm backup rclone config docker compose up -d

Docker will pull the required images and start both containers in the background.

Step 3: Set Up a Reverse Proxy for HTTPS (Required)

A password manager must only be accessed over a secure HTTPS connection. The container exposes the web server on port 8080 locally — this should never be opened directly to the internet.

You must set up a reverse proxy to forward traffic from your public domain (e.g. https://vault.yourdomain.com) to the local Vaultwarden container (http://localhost:8080). The reverse proxy also handles the SSL certificate for HTTPS. Common options are Nginx Proxy Manager, Traefik, or Caddy.

Critical: Never access or use your Vaultwarden instance over an unencrypted HTTP connection. Always use a reverse proxy with a valid SSL certificate before creating any accounts or storing any passwords.

Step 4: Create Your Account

Once your reverse proxy is set up and HTTPS is working, you can create your main account. Afterwards, consider adding SIGNUPS_ALLOWED=false to the environment section and restarting with docker compose up -d, so that nobody else can register:

1.Open your browser and navigate to your secure domain (e.g. https://vault.yourdomain.com)

2.Click Create Account

3.Fill in your details and set a strong master password — this is the only password you will need to remember

Step 5: Connect Bitwarden Clients

All official Bitwarden browser extensions and mobile apps are fully compatible with your self-hosted Vaultwarden instance:

1.Download the official Bitwarden client for your browser or device

2.On the login screen, open the server selection and choose Self-hosted

3.Enter your full instance URL in the Server URL field (e.g. https://vault.yourdomain.com)

4.Save the settings and log in with the account you created in Step 4

Further Documentation

For advanced configuration options, environment variables, and admin panel setup, refer to the official Vaultwarden documentation.

Vaultwarden Wiki

Download Bitwarden Clients