Vaultwarden Password Manager

First Services covered Pi-hole/AdGuard, a media server, and a dashboard - useful, but easy to go a few days without opening. A password manager gets opened dozens of times a day by everyone in the household, which makes it one of the best "real win" services to run early: you'll notice the value immediately, and you'll notice immediately if it's down.

What Vaultwarden actually is

Vaultwarden is a from-scratch, Rust-based reimplementation of the Bitwarden server, compatible with the official Bitwarden apps, browser extensions, and CLI - but far lighter to self-host than Bitwarden's own server (a heavier multi-container deployment - web vault, API, identity, admin, attachments, database, and more - run via Docker Compose, with an optional Kubernetes Helm chart for larger/HA setups). You get the full Bitwarden client ecosystem pointed at your own server instead of Bitwarden's cloud.

Worth noting: Bitwarden shipped a lighter single-container self-host option in late 2025 that narrows this gap somewhat. That option is new enough that its specifics (resource requirements, long-term support) were still shifting as of this writing, so check Bitwarden's current self-hosting docs rather than relying on older comparisons - this page included - if that path interests you.

Running it

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    ports:
      - "8082:80"
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true   # flip to false once your accounts exist
      - ADMIN_TOKEN=${ADMIN_TOKEN}
    restart: unless-stopped

• SIGNUPS_ALLOWED - leave it true just long enough to create your own account(s), then change it to false and run docker compose up -d again, so nothing else on your network can sign up to your instance. (Adding someone later doesn't need it turned back on - invite them from the /admin panel instead.)
• ADMIN_TOKEN - protects the /admin panel (user management, diagnostics). Generate a real random value and keep it in a .env file (see Docker Compose Basics), never hardcoded in the compose file itself.

⚠️ Risk: never expose the /admin panel (or the whole instance) to the public internet without a strong ADMIN_TOKEN and a plan for keeping it patched - a password manager is one of the highest-value targets on your entire network, precisely because of what it stores.

The TLS requirement you'll hit immediately

This is worth knowing before you're confused by it: Vaultwarden needs HTTPS to be usable at all. The web vault does its encryption in your browser using the Web Crypto API, which browsers only enable in a secure context - an https:// address, or localhost on the same machine. Open http://192.168.1.50:8082 from another device and the page loads, but you can't create an account or log in. The browser extensions and mobile apps want an HTTPS server too.

A proper reverse proxy with automatic TLS isn't covered until Reverse Proxy and TLS in Intermediate, so you have two reasonable paths:

• Read the Reverse Proxy and TLS page out of order (recommended). If you want to actually use Vaultwarden day to day - extension autofill, phone app - this is the real fix, and a reasonable exception to the tier ordering. Vaultwarden is one of the most common reasons people set up TLS earlier than "intended."
• Use an SSH tunnel as a stopgap. Because localhost counts as a secure context, you can reach the web vault through a tunnel from your everyday machine:

  ssh -L 8082:localhost:8082 yourname@server-ip
  

  then open http://localhost:8082 in a browser on that machine (set DOMAIN=http://localhost:8082 until you have a real hostname). Good enough to create your account and try it out - not a way to run it long term, since the extension and phone apps still can't use it.

Backing it up

Everything that matters lives in the ./data folder from the compose file above - your entire encrypted vault. This is exactly what Backups 101 is for; make sure this folder is explicitly included in whatever backup scope you set up there. A lost, un-backed-up Vaultwarden instance means losing every password you stored in it, not just a service you can reinstall.

Next: Photo Backup with Immich.