> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Self-Host Vaultwarden with Docker

> Install Vaultwarden with Docker: run vaultwarden/server:latest on 127.0.0.1:8000, serve it over HTTPS with Nginx, create your account and turn off sign-ups.

To install Vaultwarden with Docker, run the `vaultwarden/server:latest` image with `DOMAIN="https://vault.example.com"`, a `./vw-data` volume and the port published on `127.0.0.1:8000`. Put Nginx with a Let's Encrypt certificate in front, because the web vault only works over HTTPS. Create your account, then set `SIGNUPS_ALLOWED=false`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 20 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 | [Docker](https://help.freakhosting.com/portals/other/how-to-install-docker.md), a domain, HTTPS |

## What is Vaultwarden?

Vaultwarden is an **unofficial**, lightweight server that implements the Bitwarden client API. The official Bitwarden apps, browser extensions and the bundled web vault work with it. It is not made or supported by Bitwarden, Inc.: the [Vaultwarden project](https://github.com/dani-garcia/vaultwarden) asks you to report problems to them, not to Bitwarden support.

## Before you start

* **HTTPS is required.** The web vault uses the browser's Web Crypto API, which only works in a secure context. Over plain `http://` it does not work.
* Point a subdomain such as `vault.example.com` at your server. See [point a domain to your server](https://help.freakhosting.com/portals/other/how-to-point-a-domain-to-your-server.md).
* [Install Docker](https://help.freakhosting.com/portals/other/how-to-install-docker.md) and [Nginx](https://help.freakhosting.com/portals/other/how-to-install-nginx.md). The commands use `sudo`; leave it out if you are `root`.
* A password vault is a high-value target. Follow the [Linux server security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md) first.

## How to install Vaultwarden with Docker Compose

**1. Create a project folder**

```bash theme={null}
mkdir -p ~/vaultwarden && cd ~/vaultwarden
```

**2. Create compose.yaml**

This is the [official compose example](https://github.com/dani-garcia/vaultwarden#docker-compose) with your domain filled in:

```yaml theme={null}
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data/:/data/
    ports:
      - "127.0.0.1:8000:80"
```

`DOMAIN` must be the exact `https://` address you will use. `127.0.0.1:8000` means only Nginx on the same server can reach the container. `SIGNUPS_ALLOWED` is `true` for now so you can create your account.

**3. Start it**

```bash theme={null}
sudo docker compose up -d
```

## How to set up HTTPS for Vaultwarden with Nginx

**1. Create the Nginx site**

Create `/etc/nginx/sites-available/vault.example.com` (Ubuntu / Debian) or `/etc/nginx/conf.d/vault.example.com.conf` (AlmaLinux / Rocky). This is based on the [Vaultwarden Nginx example](https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples):

```nginx theme={null}
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      "";
}

server {
    listen 80;
    listen [::]:80;
    server_name vault.example.com;

    client_max_body_size 525M;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
```

The `Upgrade` headers let WebSocket notifications through, so clients sync changes straight away. If another site already defines a `map $http_upgrade` block, keep only one.

**2. Enable, test and reload**

```bash theme={null}
sudo ln -s /etc/nginx/sites-available/vault.example.com /etc/nginx/sites-enabled/   # Ubuntu / Debian only
sudo nginx -t
sudo systemctl reload nginx
```

On AlmaLinux / Rocky, also run `sudo setsebool -P httpd_can_network_connect 1` so SELinux lets Nginx reach the container.

**3. Get a certificate**

```bash theme={null}
sudo certbot --nginx -d vault.example.com
```

Choose to redirect HTTP to HTTPS when asked. See [get a free SSL certificate with Certbot](https://help.freakhosting.com/portals/other/how-to-get-a-free-ssl-certificate-with-certbot.md).

## How to create your account and disable sign-ups

**1. Create your account**

Open `https://vault.example.com`, click **Create account** and choose a long master password. Vaultwarden cannot recover a lost master password.

**2. Turn off public registration**

In `compose.yaml`, change `SIGNUPS_ALLOWED: "true"` to `SIGNUPS_ALLOWED: "false"`, then recreate the container:

```bash theme={null}
sudo docker compose up -d
```

Anyone who can reach your server could otherwise register.

**3. Turn on two-step login**

In the web vault, open your account's security settings and set up two-step login, for example with an authenticator app.

> [!WARNING]
>
> Leave the `/admin` page disabled unless you need it. If you enable it with `ADMIN_TOKEN`, store an Argon2 hash created with `sudo docker exec -it vaultwarden /vaultwarden hash`, not the plain token. In `compose.yaml`, write every `$` in the hash as `$$`. See [Enabling admin page](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page).

## How to check it worked

```bash theme={null}
sudo docker compose ps
curl -I https://vault.example.com
```

The container shows `Up`, and `curl` returns a `200` status line. Log in from a Bitwarden app: on the login screen, choose the self-hosted option and enter `https://vault.example.com` as the server URL.

## How to back up Vaultwarden

All data is in `./vw-data`. The files that matter are `db.sqlite3` (the database), the `attachments` folder, `config.json` (if you used the admin page) and the `rsa_key*` files. Make a consistent copy of the database with the built-in command:

```bash theme={null}
sudo docker exec -it vaultwarden /vaultwarden backup
```

Then copy the whole `vw-data` folder off the server, ideally encrypted. See [encrypted backups with restic](https://help.freakhosting.com/portals/other/how-to-make-encrypted-backups-with-restic.md) and the official [backup guide](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault).

## How to update Vaultwarden

Bitwarden apps update themselves, so keep Vaultwarden current to avoid client errors. Back up first, then:

```bash theme={null}
cd ~/vaultwarden
sudo docker compose pull
sudo docker compose up -d
```

## Frequently asked questions

### Is Vaultwarden the same as Bitwarden?

No. Vaultwarden is a separate, community-built server that is compatible with the official Bitwarden clients. Bitwarden's own self-hosted server is a different product.

### Why does the web vault show an error over HTTP?

The web vault needs a secure context for the Web Crypto API. Serve it over HTTPS with a valid certificate.

### How do I add family or team members after disabling sign-ups?

Create an organization and invite them, or enable the admin page and invite them there. With `SIGNUPS_ALLOWED=false`, organization owners and admins can still invite users.

### How much RAM does Vaultwarden need?

The project does not publish a minimum. It is written in Rust and is designed for self-hosting where the resource-heavy official Bitwarden server would not be ideal.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Nginx reverse proxy](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-as-a-reverse-proxy.md)
>
> How proxying to a local port works.

> [card] [Back up Docker volumes](https://help.freakhosting.com/portals/other/how-to-back-up-docker-volumes.md)
>
> Copy container data safely.

> [card] [Secure Docker on a VPS](https://help.freakhosting.com/portals/other/how-to-secure-docker-on-a-vps.md)
>
> Keep container ports private.

> [card] [Linux server security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the server first.

***

> [!NOTE]
>
> **Checked against the official [Vaultwarden README and wiki](https://github.com/dani-garcia/vaultwarden)** on 4 November 2026 (image `vaultwarden/server:latest`); `compose.yaml` validated with `docker compose config` and the Nginx configuration syntax-tested on Ubuntu 24.04 LTS. Menu names in the Bitwarden clients can change between releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.