# How do I self-host Vaultwarden on a VPS?

> Run Vaultwarden with Docker Compose and Caddy on a Dusk VPS, $5.25 a month on 12 months. Automatic HTTPS, signups closed, backup steps.

- URL: https://gloamport.com/guides/how-to-self-host-vaultwarden/
- Last updated: 2026-11-10
- Publisher: Gloamport (https://gloamport.com)

Vaultwarden is a small server that speaks the Bitwarden API. This guide follows the Vaultwarden wiki: Docker Compose, Caddy for HTTPS, then signups closed and a backup.

**Quick answer — How do I self-host Vaultwarden on a VPS?**

To self-host Vaultwarden on a VPS, run the vaultwarden/server image with Docker Compose, put Caddy in front for automatic HTTPS on a domain you own, create your account, then turn signups off. Gloamport’s Dusk plan, 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic, costs $5.25 a month on the 12-month term.

## What does the Vaultwarden Compose setup contain?

| Part | Value | Note |
| --- | --- | --- |
| Vaultwarden image | `vaultwarden/server:latest` | Data stored in ./vw-data mounted at /data |
| Reverse proxy | caddy:2 | Ports 80, 443 and 443/udp published |
| DOMAIN variable | https://vault.example.com | Required behind a reverse proxy; HTTPS is needed for attachments |
| Certificates | Caddy, ACME HTTP-01 challenge | The domain must reach the VPS on port 80 |
| Signups | SIGNUPS_ALLOWED | True to create your account, then false |
| Admin page | ADMIN_TOKEN | Off until a token is set; the wiki recommends an argon2 hash |
| Suggested plan | Dusk: 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic | Gloamport plan list |

*Prices checked on November 10, 2026.*

## Is it a good idea to host your own password manager?

It suits you if you accept the job of keeping it up, backed up and patched. Vaultwarden stores your vault encrypted, but the server still decides who can log in and holds the only copy unless you make others. Lose the data and there is no provider to restore it.

Three facts shape the decision. No plan includes backups: keep your own copy of anything you cannot lose. A vault is only as available as the VPS that carries it, so keep an offline export of your vault as well. And the domain you use for it is public in DNS and in certificate logs, so choose one without your name in it. If those points are acceptable, a single small VPS is a normal home for it.

## How to install Vaultwarden with Docker Compose and Caddy

You need a domain whose A record points at the VPS. The commands run on Debian 13 or Ubuntu 24.04.

1. **Install Docker Engine with the Compose plugin** — Follow the Docker install page for Debian or Ubuntu, then run the apt install line for docker-ce and docker-compose-plugin from the first code block. Check it with docker run hello-world.
2. **Create the project folder and the Caddyfile** — Make a vaultwarden folder and write the Caddyfile and docker-compose.yml from the code blocks. Replace vault.example.com with your domain and the e-mail with an address for the certificate. The address is for the certificate authority, not for Gloamport.
3. **Open the web ports** — Ports 80 and 443 must reach the VPS: the HTTP-01 challenge needs port 80 to obtain the certificate. If you use ufw or another firewall, allow 80/tcp, 443/tcp and 443/udp as well as SSH.
4. **Start the stack** — Run docker compose up -d in the folder. Caddy requests the certificate on first start. Open https://vault.example.com and create your account.
5. **Close the signups** — Set SIGNUPS_ALLOWED to "false" in the compose file and run docker compose up -d again. New accounts can then only be added by invitation or by you.
6. **Back up the data folder** — Use the Vaultwarden backup procedure in the last code block, on a schedule, with one copy stored off the VPS.

*Install Docker, then start the stack*

```bash
# After adding Docker's apt repository (docs.docker.com/engine/install/debian/)
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo docker run hello-world

mkdir -p ~/vaultwarden && cd ~/vaultwarden
# write docker-compose.yml and Caddyfile (below), then:
sudo docker compose up -d
```

*docker-compose.yml (from the Vaultwarden wiki, domain changed)*

```yaml
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data
    environment:
      DOMAIN: "https://vault.example.com"
      EMAIL: "you@example.com"
```

*Caddyfile*

```text
{$DOMAIN} {
  tls {$EMAIL}
  encode zstd gzip
  reverse_proxy vaultwarden:80 {
    header_up X-Real-IP {remote_host}
  }
}
```

*Admin token hash and backup (Vaultwarden wiki)*

```bash
# Optional admin page: hash a long random password, put the result in ADMIN_TOKEN
sudo docker exec -it vaultwarden /vaultwarden hash

# Database backup while the server runs (SQLite online backup)
sqlite3 vw-data/db.sqlite3 ".backup '/root/backups/db-$(date +%Y%m%d-%H%M).sqlite3'"

# Also copy: vw-data/attachments/, vw-data/config.json, vw-data/rsa_key*
```

## What should you back up from a Vaultwarden server?

Back up db.sqlite3, the attachments folder, config.json and the rsa_key files. The Vaultwarden backup page lists db.sqlite3 and attachments as required, config.json and the rsa_key files as recommended, and sends and the icon cache as optional. It says to use SQLite’s own .backup command rather than copying the file while it is open, and to avoid relying on file-system or VM snapshots.

The page also warns that config.json holds some plaintext secrets, so encrypt it before it leaves the VPS. Run the backup daily, keep one copy elsewhere, and restore it once on a spare machine to prove it works. Vaultwarden versions from 1.32.1 also have a built-in backup command in the wiki.

## Which Gloamport plan runs Vaultwarden?

Dusk is the plan we would start from: 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic at $5.25 a month on the 12-month term, $10.50 on a single month. The Vaultwarden wiki gives no sizing figures and we have not benchmarked it, so treat Dusk as a starting point. If you also run a chat server and a search engine on the same VPS, Gloam (2 vCPU, 4 GB RAM, 80 GB NVMe, 4 TB traffic, $8.25 a month on the 12-month term) is listed for A Matrix server, Vaultwarden and SearXNG together.

No identity check, now or later: no ID upload, no selfie, no proof of address, no card and no phone number. According to Gloamport’s survey of 10 November 2026, 28 of the 49 providers listed ask for no ID document at sign-up. The [plans and terms](https://gloamport.com/pricing/ "How much does a Gloamport VPS cost?") page lists every size.

## How do you protect the admin page and the server?

Leave the admin page off unless you need it, and secure SSH before anything else. The wiki says the admin page exists only once an authentication token is set, that the token acts as the password for the admin area, and that HTTPS should be active before you turn it on. It recommends storing the token as an argon2 hash so it cannot simply be read from the configuration.

On the host, use key-only SSH and a firewall, as in [How do I harden SSH on a new VPS?](https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ "How do I harden SSH on a new VPS?"). A password manager server is a prime target, so apply updates by pulling the images again and running docker compose up -d. For a second service on the same VPS see [How do I host a Matrix server on a VPS?](https://gloamport.com/guides/how-to-host-a-matrix-server/ "How do I host a Matrix server on a VPS?").

**In summary**

- Vaultwarden runs from vaultwarden/server with its data in ./vw-data.
- Caddy fetches the HTTPS certificate with the HTTP-01 challenge; the domain must reach port 80.
- Set DOMAIN to the https URL; the wiki says HTTPS is needed for attachments.
- Create your account, then set SIGNUPS_ALLOWED to false.
- The admin page needs an ADMIN_TOKEN; the wiki recommends an argon2 hash.
- Back up db.sqlite3 with .backup, plus attachments, config.json and rsa_key files.
- Dusk, $5.25 a month on 12 months, is a starting plan.

## Self-hosting Vaultwarden: common questions

### Do I need a domain name?

Yes for the setup here. DOMAIN must be an https URL and Caddy gets its certificate for that name. The wiki describes a DNS-challenge route for private instances without public access.

### Is Vaultwarden the same as Bitwarden?

No. Vaultwarden is a separate, lighter server that works with Bitwarden clients. You use the Bitwarden apps and point them at your own server address.

### How do I stop other people creating accounts?

Set SIGNUPS_ALLOWED to false after you have made your account, then recreate the container. Invitations can still add users when registration is closed.

### What if the VPS dies?

You restore from your backup. No plan includes backups: keep your own copy of anything you cannot lose. Keep the encrypted backup off the VPS and test a restore once.

### Which images does Gloamport offer?

Images: Debian 13, Debian 12, Ubuntu 24.04 LTS, AlmaLinux 10, Rocky Linux 10. Docker runs on Debian 13 and Ubuntu 24.04, both listed.

## Sources

1. [Vaultwarden wiki: Using Docker Compose](https://github.com/dani-garcia/vaultwarden/wiki/Using-Docker-Compose) — Vaultwarden project (checked 2026-11-10)
2. [Vaultwarden wiki: Enabling admin page](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page) — Vaultwarden project (checked 2026-11-10)
3. [Vaultwarden wiki: Backing up your vault](https://github.com/dani-garcia/vaultwarden/wiki/Backing-up-your-vault) — Vaultwarden project (checked 2026-11-10)
4. [Install Docker Engine on Debian](https://docs.docker.com/engine/install/debian/) — Docker Inc. (checked 2026-11-10)

---

Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.