Vaultwarden Password Manager

First Services covered Pi-hole/AdGuard, a media server, and a dashboard - useful, but easy to go a few days without opening. A password manager gets opened dozens of times a day by everyone in the household, which makes it one of the best "real win" services to run early: you'll notice the value immediately, and you'll notice immediately if it's down.

What Vaultwarden actually is

Vaultwarden is a from-scratch, Rust-based reimplementation of the Bitwarden server, compatible with the official Bitwarden apps, browser extensions, and CLI - but far lighter to self-host than Bitwarden's own server (which is designed for enterprise deployment via Docker Swarm/Kubernetes). You get the full Bitwarden client ecosystem pointed at your own server instead of Bitwarden's cloud.

Running it

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    ports:
      - "8082:80"
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=false
      - ADMIN_TOKEN=${ADMIN_TOKEN}
    restart: unless-stopped

• SIGNUPS_ALLOWED=false - set this after creating your own account(s), so a Vaultwarden instance briefly visible on your LAN can't be signed up to by anything else on the network.
• ADMIN_TOKEN - protects the /admin panel (user management, diagnostics). Generate a real random value and keep it in a .env file (see Docker Compose Basics), never hardcoded in the compose file itself.

⚠️ Risk: never expose the /admin panel (or the whole instance) to the public internet without a strong ADMIN_TOKEN and a plan for keeping it patched - a password manager is one of the highest-value targets on your entire network, precisely because of what it stores.

The TLS requirement you'll hit immediately

This is worth knowing before you're confused by it: Bitwarden's official browser extensions and mobile apps require a secure context (HTTPS) to connect to a server - a plain http://192.168.1.50:8082 works fine in a regular browser tab for occasional use via the web vault, but the extension and mobile apps will refuse to sync against a plain HTTP address.

You have two reasonable paths, since a proper reverse proxy with automatic TLS isn't covered until Reverse Proxy and TLS in Intermediate:

• Use the web vault only, for now. Log in at http://server-ip:8082 in a browser on your LAN. Not as convenient as the extension's autofill, but fully functional, and a fine way to run this for the rest of the Beginner tier.
• Read the Reverse Proxy and TLS page out of order. If daily-driver extension/app support matters to you now, it's a reasonable exception to the tier ordering - Vaultwarden is one of the more common reasons people jump ahead to set up TLS earlier than "intended."

Backing it up

Everything that matters lives in the ./data folder from the compose file above - your entire encrypted vault. This is exactly what Backups 101 is for; make sure this folder is explicitly included in whatever backup scope you set up there. A lost, un-backed-up Vaultwarden instance means losing every password you stored in it, not just a service you can reinstall.

Next: Photo Backup with Immich.