Vaultwarden VPS

Who it suits

One person, a family or a small team who want their passwords on a server they control and like the Bitwarden apps. Vaultwarden is an independent community project, not Bitwarden's own server: if you need Bitwarden's support or its compliance paperwork, use Bitwarden's cloud or its self-hosted edition.

Which plan

Budget (2 GB) is plenty. Vaultwarden is one small process with SQLite, and the project publishes no minimum; attachments and Sends are the part that grows, and they live on the disk rather than in memory.

What we install

Vaultwarden is a lightweight server that speaks Bitwarden's API, so the official Bitwarden apps and browser extensions work with it. We run the project's vaultwarden/server image with its SQLite database in /opt/vaultwarden/data, on 127.0.0.1:8080, and generate the admin page's token on the server (in /root/vaultwarden-admin.txt; Vaultwarden only sees an Argon2 hash of it).

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. /var/lib/vps9-setup.exit appears when the installer has finished, holding 0 if it worked. Vaultwarden is ready when curl http://127.0.0.1:8080/alive answers on the server. Nothing outside the server can reach it yet.

What you still do

1. From your computer, run ssh -L 8080:127.0.0.1:8080 root@<your IPv4>, open http://localhost:8080 and create your account. Choose a master password you won't forget: nobody can recover it.
2. Point a domain at the server, allow ports 80 and 443 in the panel firewall, and run vps9-https vault.example.com. Vaultwarden moves to https://vault.example.com and new sign-ups are turned off.
3. In each Bitwarden app, choose a self-hosted server and enter https://vault.example.com.
4. For the admin page at https://vault.example.com/admin, run cat /root/vaultwarden-admin.txt for its token.

Exposure and security

Nothing answers publicly at first: Vaultwarden is bound to 127.0.0.1:8080, so you create your account through an SSH tunnel, where your browser treats http://localhost as secure (the web vault needs that). Sign-ups are open only there. vps9-https then puts Caddy in front on ports 80 and 443, sets Vaultwarden's DOMAIN and turns sign-ups off. The admin page at /admin asks for a token only root can read. Never serve it over plain HTTP.

Backups and upgrades

We turn on the operating system's automatic security updates (security fixes only, never an automatic reboot). Vaultwarden itself is yours to update: after reading the release notes, run docker pull vaultwarden/server:latest and /usr/local/lib/vps9/vaultwarden-run. Back up /opt/vaultwarden/data off the server: db.sqlite3 (copy it with sqlite3's .backup command), the attachments and sends folders, config.json and the rsa_key files. We run the hardware, the network and the first-boot install; after that, Vaultwarden is yours to run, and we don't manage, update or back it up for you.

Order it from your terminal

$ vps9 servers create --plan budget --image ubuntu-24.04 --app vaultwarden --hostname web-1 --key key_8f2c

{
  "plan": "budget",
  "image": "ubuntu-24.04",
  "hostname": "web-1",
  "app": "vaultwarden"
}