¶ Overview
Vaultwarden is a self-hosted version of the popular password manager Bitwarden. I primarily use this to manage credentials for my various services in my homelab. This service runs on a separate server than the primary one so I can perform maintenance without worrying about losing access to Vaultwarden.
¶ Setup
Vaultwarden is run as a container using Docker Compose to define the service. This allows for better control over how the service is run.
¶ Docker Compose
The following is the directory structure for the service:
vaultwarden/
├── db/
├── data/
├── docker-compose.yaml
└── .env
Make sure both the
dataandconfigfolders as well as their contents are owner by the1000:1000user. This can be accomplish by using the following command:sudo chown -R 1000:1000 data configfrom inside the openbao folder.
A snippet of the docker-compose.yaml and .env files that I use are below:
# docker-compose.yaml
services:
vaultwarden-db:
image: postgres:16-alpine
container_name: vaultwarden-db
user: "1000:1000"
restart: unless-stopped
environment:
POSTGRES_USER: vaultwarden
POSTGRES_PASSWORD: changeme
POSTGRES_DB: vaultwarden
networks:
- vaultwarden
volumes:
- ./DB:/var/lib/postgresql/data
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
user: "1000:1000"
depends_on:
- vaultwarden-db
networks:
- traefik
- vaultwarden
ports:
- 9445:80 #map any custom port to use (replace 9445 not 80)
volumes:
- ./Data:/data:rw
environment:
# - ROCKET_TLS={certs="/ssl/certs/certs.pem",key="/ssl/private/key.pem"} // Environment variable is specific to the Rocket web server
- DATABASE_URL=postgresql://vaultwarden:changeme@vaultwarden-db:5432/vaultwarden
- ADMIN_TOKEN=${ADMIN_TOKEN}
- WEBSOCKET_ENABLED=${WEBSOCKET_ENABLED}
- SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED}
- DOMAIN=${DOMAIN}
env_file:
- .env
networks:
vaultwarden:
internal: true
name: vaultwarden
# .env
#General Settings
ADMIN_TOKEN=""
WEBSOCKET_ENABLED=true
SIGNUPS_ALLOWED=true ##change to false once create the admin account
DOMAIN=http://vaultwarden.example.com #replace example.com with your domain
¶ Initial Login
Once you have Vaultwardren up and running you should be able to access it either via the values of the DOMAIN or via the IP address of the server and the port you exposed Vaultwarden on.
From there you will need to create an account. Unless you have integrated this instance with an email server you won't have to worry about using a proper email address or verifying the email when creating your account. You will just need to enter an email and password, then you should be able to login.
