Skip to content

Template

Self-host Vaultwarden on a server you own.

A lightweight server for the Bitwarden protocol, so the official Bitwarden apps, browser extensions and CLI all work against it. It installs as an ordinary app that deploys, backs up and rolls back like yours.

Connect your first serverRead the Vaultwarden guide

At a glance

Image
vaultwarden/server:1.37.2-alpine
Port
80, behind kamal-proxy
Health check
/alive
Volumes
data
Singleton
yes

What the install does

  • Generates a 64-character ADMIN_TOKEN, once, as a secret
  • Turns self-signup off and invitations on, so an admin invites people
  • Sets IP_HEADER, so rate limits apply per client rather than to everyone at once
  • Registers the data volume for backup, stopping the container so each backup is consistent

Installing does not deploy. Point an A record for the domain at the server, then press Deploy.

Before you start

  • 01

    A registered server and a ready runner.

  • 02

    A hostname. Bitwarden clients need HTTPS, and passkeys and attachment links are tied to the domain, so set your own before the first deploy.

  • 03

    Somewhere off the machine for backups. A password manager with no off-machine backup is one disk failure from losing every vault on it.

FAQ

Questions about Vaultwarden.

Read the Vaultwarden guide
Can anyone sign up to my Vaultwarden?

No. The install sets SIGNUPS_ALLOWED to false and INVITATIONS_ALLOWED to true, so only people an admin invites can create an account.

Which Bitwarden clients work?

The official apps, browser extensions and CLI. Choose self-hosted on the sign-in screen and enter your domain. Clients from 2026.8.0 onwards need Vaultwarden 1.37.2 or newer, which is the version the template installs.

How are backups taken?

The SQLite database, attachments and keys all live in one data volume. Vaultwarden stands down for each backup and each restore, so both are consistent and both are a short outage. Set a schedule and a bucket on the volume.

How do I upgrade?

Change the image tag on the app and deploy. Read Vaultwarden's release notes first: it upgrades the database on start, and it does not go back down.

Run your own password manager.

Connect a server, install Vaultwarden, and deploy when the domain points at it.

Connect your first serverAll templates

Sign-ups are paused while the app is in maintenance.