Vaultwarden

Self-Hosted Password Manager Setup with Vaultwarden on Docker

by

You probably use a password manager, but relying on a cloud-only service means your vault lives on someone else’s infrastructure. A self-hosted password manager puts that vault on your own hardware, under your control, while still giving you the same autofill, browser extension, and mobile app experience.

Why Self-Host a Password Manager

Cloud password managers are convenient, but they introduce a single point of failure. If the service has an outage, you lose access. If the vendor changes pricing or terms, you either pay more or migrate. If their servers are breached, your vault is exposed even if the provider claims zero-knowledge encryption.

Self-hosting removes those risks. You keep the data on your NAS or homelab server. You control backups. You control who can reach the admin panel. And if the internet goes down, your vault is still available on the local network.

Vaultwarden: The Lightweight Option

Vaultwarden is the most popular self-hosted password manager for homelabs. It is a Rust implementation of the Bitwarden server API, lightweight, and runs well in a single Docker container. It supports the official Bitwarden browser extension and mobile apps, so you do not need to switch clients.

Deploy with Docker Compose:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - ./vw-data:/data
    environment:
      - DOMAIN=https://vault.pentiumsoak.com
      - SIGNUPS_ALLOWED=false
      - ADMIN_TOKEN=${ADMIN_TOKEN}

After the container is running, visit https://vault.pentiumsoak.com, create an admin account, and then point your Bitwarden client to your self-hosted server URL.

Bitwarden RS: Alternative

Bitwarden RS is another lightweight option, though Vaultwarden has largely superseded it in active development. The setup is nearly identical: a single container, SQLite database, and standard Bitwarden compatibility. Choose Vaultwarden unless you have a specific reason to stick with the older project.

Backup Strategy

Your password vault is only as reliable as your backup. Export encrypted backups regularly through the admin panel or the Bitwarden CLI. Store those backups on a separate drive or cloud bucket with client-side encryption. Treat the vault like any other critical dataset: test restores, verify integrity, and keep an offline copy.

Security Hardening

Exposing a password manager to the internet requires care. Put it behind a reverse proxy with HTTPS, enable two-factor authentication on all accounts, restrict admin access by IP if possible, and fail2ban the login endpoint. Keep the container image updated. The convenience of self-hosting disappears if you skip these basics.

Why This Works Better

Many guides only cover password generation and vault setup, but the real value of self-hosting is operational control. A self-hosted password manager gives you the same UX as cloud Bitwarden with none of the vendor dependency. It fits naturally into a homelab stack behind your reverse proxy, protected by your firewall rules, and backed by your storage pool.

Final Thoughts

Start with Vaultwarden in Docker, import your existing Bitwarden export, and migrate one device at a time. Once the server is stable, add backup jobs, monitoring, and 2FA. Your homelab will feel more complete when even your passwords live under your own roof.

Related Posts

If you’re building a self-hosted stack, these guides on pentiumsoak.com might help:

Leave a Comment