Vaultwarden Docker Compose Setup Guide: Self-Host Passwords

Securing digital credentials is a foundational pillar of modern cybersecurity. While cloud-based password managers offer convenience, many privacy-conscious users, developers, and system administrators prefer absolute ownership of their infrastructure. Vaultwarden—an unofficial, lightweight Bitwarden-compatible server written in Rust—allows you to self-host a robust, enterprise-grade password management system without the heavy RAM footprint of the official C# implementation.

By leveraging containerization, deploying this service becomes repeatable, secure, and easy to maintain. This comprehensive vaultwarden docker compose setup guide walks you through provisioning your own high-performance, self-hosted password vault from scratch using Docker Compose and a reverse proxy.

Understanding the Architecture

Vaultwarden implements the standard Bitwarden API, ensuring total compatibility with official Bitwarden browser extensions, desktop apps, and mobile clients (iOS and Android). Written in Rust, it consumes negligible CPU and typically requires less than 30 megabytes of RAM, making it ideal for running on low-power single-board computers like a Raspberry Pi, a local homelab server, or a minimal cloud Virtual Private Server (VPS).

Because password managers handle highly sensitive cryptographic data, security is paramount. Your Vaultwarden deployment must adhere to strict operational standards:

• HTTPS Enforcement: Modern browsers and the official Bitwarden clients strictly require a secure HTTPS connection to communicate with password manager backends.
• Persistent Storage: Container filesystems are ephemeral. You must map a Docker volume to ensure your SQLite or PostgreSQL database survives container updates and reboots.
• Disabled Registration: Once you create your administrative user account, open registration should be disabled to prevent unauthorized users from creating accounts on your instance.

Prerequisites for Deployment

Before launching your container stack, ensure your host environment meets the following baseline requirements:

• A Linux-based host operating system (Ubuntu, Debian, or AlmaLinux recommended).
• Docker Engine and Docker Compose installed and running with appropriate permissions.
• A registered domain name pointing to your server’s public IP address or local DNS resolver.
• A reverse proxy (such as Nginx Proxy Manager, Caddy, or Traefik) capable of handling automatic SSL/TLS certificate generation via Let’s Encrypt.

Step-by-Step Vaultwarden Docker Compose Setup

1. Create the Project Directory

Establish a dedicated directory on your host machine to keep your configuration files organized and maintainable.

mkdir -p /opt/vaultwarden
cd /opt/vaultwarden

2. Write the Docker Compose Configuration File

Create a file named docker-compose.yml using your preferred terminal text editor (such as nano or vim). Paste the following production-ready configuration:

version: "3.8"

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - WEBSOCKET_ENABLED=true
    volumes:
      - ./vw-data:/data
    ports:
      - 127.0.0.1:8080:80

Architectural Note: Binding the port explicitly to 127.0.0.1:8080 ensures that the Vaultwarden container is not exposed directly to the public internet. Instead, traffic must safely pass through your local reverse proxy.

3. Launch the Container Stack

Execute the following command in your terminal to download the image and start the container in detached mode:

docker compose up -d

Verify that the container is running smoothly by checking its health and logs:

docker compose ps
docker compose logs -f

Configuring the Reverse Proxy and SSL

Because Vaultwarden mandates HTTPS, you must configure a reverse proxy to terminate SSL. If you are using Caddy—renowned for its automatic HTTPS management—your configuration block will look remarkably concise:

vault.yourdomain.com {
    reverse_proxy 127.0.0.1:8080
}

If you prefer Nginx, ensure you forward the necessary headers so Vaultwarden can accurately log client IP addresses and manage WebSocket connections for real-time synchronization across devices:

server {
    listen 443 ssl;
    server_name vault.yourdomain.com;

    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;

    client_max_body_size 128M;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Locking Down Security

Once your domain resolves correctly and you can load the web interface via HTTPS, navigate to the site to create your master user account. Immediately after registering your primary administrative profile, edit your docker-compose.yml file or environment configuration to disable open sign-ups:

    environment:
      - WEBSOCKET_ENABLED=true
      - SIGNUP_ENABLED=false

Apply the configuration update by recreating the container:

docker compose down && docker compose up -d

Frequently Asked Questions

Can I use official Bitwarden apps with Vaultwarden?

Yes. Vaultwarden fully implements the Bitwarden server API specification. When opening any official browser extension, desktop application, or mobile client, simply click the gear icon (or region settings) on the login screen, input your self-hosted domain URL, and log in normally.

How do I handle backups for my self-hosted vault?

Because your persistent data is safely stored in the ./vw-data directory mapped in your Docker Compose file, backing up your vault is as simple as creating an encrypted archive of that folder using standard utilities like Borgmatic, Restic, or a cron-scheduled tar command. Ensure you back up regularly, as losing your encryption keys and database means losing access to your encrypted data permanently.

Is Vaultwarden secure enough for enterprise use?

Vaultwarden employs the exact same client-side zero-knowledge encryption model as Bitwarden. The master password and decryption keys never leave your local device; the server only stores encrypted ciphertext. Provided your server infrastructure, host operating system, and SSL certificates are properly maintained, it is exceptionally secure.

Conclusion

By following this vaultwarden docker compose setup guide, you have successfully deployed a fast, secure, and private password management system on your own infrastructure. You now maintain total ownership of your digital identity credentials without sacrificing the cross-platform synchronization features you rely on daily.

Ready to level up your homelab further? Explore our other deep-dive guides on container orchestration, automated backups, and secure networking to fortify your self-hosted ecosystem today.

Disclosure: BriteHacks is reader-supported. When you buy through links on our site or deploy infrastructure, we may earn an affiliate commission at no extra cost to you. As an Amazon Associate, we earn from qualifying purchases.