Neckrez

How to Self-Host Vaultwarden on a VPS (Docker + Caddy, HTTPS)

Run your own Bitwarden-compatible password manager on a VPS with Docker and Caddy. Setup, lock-down and backups in about ten minutes.

To self-host Vaultwarden, you need a small VPS, Docker and a reverse proxy that gives you HTTPS. This guide gets you a working, Bitwarden-compatible password manager on your own domain, with sign-ups closed and a backup routine, in about ten minutes.

What Vaultwarden needs from a VPS

Vaultwarden is a light server written in Rust that speaks the Bitwarden API. The official Bitwarden apps and browser extensions connect to it as usual. Your vault lives on a server you control.

  • Server size - the smallest plan is enough for a personal or family vault.
  • A domain name - Bitwarden clients require HTTPS, so point an A record at the server IP before you start.
  • Open ports - 80 and 443 for Caddy, plus SSH for you.

Rule of thumb: start on the smallest plan and resize only if you actually see pressure. A password vault is a tiny workload.

How to do it on Neckrez

  • Sign up - an email address is enough, with no KYC, no ID and no card.
  • Top up the balance - pay in crypto from $15, for example with USDT on a cheap network.
  • Pick plan, location and OS - the Quark plan with Ubuntu or Debian works well, in a region close to you.
  • Wait about a minute - the server comes up with full root and a dedicated IPv4.
  • Pay by the hour - billing stops when you destroy the server.

Point your domain at the IPv4, then log in over SSH and install the packages:

apt update && apt install -y docker.io docker-compose-v2 caddy
mkdir -p /opt/vaultwarden && cd /opt/vaultwarden
nano docker-compose.yml

Paste this into docker-compose.yml, replacing the domain with yours:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8080:80"

Start the container and let Caddy fetch a certificate and proxy to it:

docker compose up -d
echo 'vault.example.com {
    reverse_proxy 127.0.0.1:8080
}' > /etc/caddy/Caddyfile
systemctl reload caddy

Close sign-ups after your first account

Open https://vault.example.com, create your account, then switch sign-ups off so nobody else can register on your server. Family members can be added later by temporarily turning sign-ups back on.

sed -i 's/SIGNUPS_ALLOWED: "true"/SIGNUPS_ALLOWED: "false"/' docker-compose.yml
docker compose up -d

One honest caveat: you are now the admin of your own password store. If the server is lost and you have no backup, the vault is gone.

Back up the vault

Everything Vaultwarden stores sits in the vw-data folder. Stop the container, archive the folder, start it again, then copy the archive off the server.

cd /opt/vaultwarden
docker compose stop
tar czf /root/vw-backup-$(date +%F).tar.gz vw-data
docker compose start

On Vultr, DigitalOcean and Hetzner servers you can also take an on-demand snapshot, kept for 7 days. Treat it as an extra, not a replacement for a copy stored elsewhere. See our crypto VPS hosting page for the full picture.

FAQ

Do the official Bitwarden apps work with Vaultwarden? Yes. In the app, choose self-hosted on the login screen and enter your server URL.

Can I run it without a domain? Not in practice. The clients expect HTTPS, and Caddy needs a domain name to issue a certificate.

Get started

Neckrez plans start from $10/month and are billed hourly, so you pay only while the server exists. Deploy your server and have your vault running in minutes.