# Vaultwarden

> A Bitwarden-compatible password server, private until you claim it over SSH.

Vaultwarden is a lightweight server that speaks Bitwarden's API, so the official Bitwarden apps and browser extensions work with it. We run the project's vaultwarden/server image with its SQLite database in /opt/vaultwarden/data, on 127.0.0.1:8080, and generate the admin page's token on the server (in /root/vaultwarden-admin.txt; Vaultwarden only sees an Argon2 hash of it).

## Details

- Installs on: Ubuntu and Debian; AlmaLinux, Rocky Linux and Fedora
- Smallest plan: Budget (1 vCPU, 2 GB RAM)
- Public ports: 80/tcp, 443/tcp
- Project site: https://github.com/dani-garcia/vaultwarden

## After the server is ready

1. From your computer, run `ssh -L 8080:127.0.0.1:8080 root@<your IPv4>`, open `http://localhost:8080` and create your account. Choose a master password you won't forget: nobody can recover it.
2. Point a domain at the server, allow ports 80 and 443 in the panel firewall, and run `vps9-https vault.example.com`. Vaultwarden moves to https://vault.example.com and new sign-ups are turned off.
3. In each Bitwarden app, choose a self-hosted server and enter https://vault.example.com.
4. For the admin page at https://vault.example.com/admin, run `cat /root/vaultwarden-admin.txt` for its token.

## Questions

### Is Vaultwarden the same as Bitwarden?

No. Vaultwarden is an independent, community-written server that implements Bitwarden's API, so Bitwarden's official apps and browser extensions work with it. It isn't made or supported by Bitwarden, Inc. Most features work, including organizations, attachments and Send; the project's wiki lists the differences.

### Does Vaultwarden need HTTPS?

Yes. The web vault uses the browser's Web Crypto API, which browsers only allow on HTTPS pages and on localhost. That's why you create your account through an SSH tunnel to localhost first, then run `vps9-https` to put it on your domain with a Let's Encrypt certificate.

### How do I add family members once sign-ups are closed?

Invite them from the admin page (/admin, with the token in /root/vaultwarden-admin.txt). Invitations go out by email, so set up SMTP in the admin page first. Without email, set `SIGNUPS_ALLOWED=true` in /opt/vaultwarden/vaultwarden.env, run `/usr/local/lib/vps9/vaultwarden-run`, let them register, then set it back to false and run it again.

### What if the server is lost?

The Bitwarden apps keep an encrypted copy of your vault for reading offline, but changes need the server. Keep backups of /opt/vaultwarden/data somewhere else and test a restore. A [snapshot](https://vpsnine.com/help/snapshots) is a useful extra, not a replacement for an off-server copy.

## Order it

Pick Vaultwarden in the order form, or use `"app": "vaultwarden"` in the API or `vps9 servers create --app vaultwarden`. See [all one-click apps](https://vpsnine.com/apps) and [plans](https://vpsnine.com/plans).