Homelab 3: your own password manager with Vaultwarden

Vaultwarden is an open-source server compatible with the Bitwarden apps: you keep the polished official apps on your phone and in your browser, and the server runs at home. It is small (a few dozen MB of RAM) and it is the service that protects all the others, so it gets the most care in this series.

A bit of history

Bitwarden, an open-source password manager, appeared in 2016. In 2018 Daniel García rewrote a compatible server in Rust, light enough for a Raspberry Pi; first called bitwarden_rs, it was renamed Vaultwarden in 2021. It speaks the same protocol, so the official Bitwarden apps and browser extensions work with it unchanged.

Why the server can be at home

Bitwarden apps encrypt your vault on the device, with a key derived from your master password, before anything is sent. The server stores ciphertext it cannot read. A stolen server leaks encrypted blobs; a forgotten master password, on the other hand, locks you out for good. Plan for the second case first.

1. Run it

services:
  vaultwarden:
    image: vaultwarden/server:1.37.4
    restart: unless-stopped
    ports:
      - "8200:80"
    volumes:
      - ./vw-data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.tld
      - SIGNUPS_ALLOWED=true

docker compose up -d

Publish it through your HTTPS proxy (Homelab 2): the web vault and the apps need HTTPS to work at all.

2. Create your account, then close the door

1. Open https://vault.yourdomain.tld, create your account.
2. Write the master password on paper and keep it at home. Not in a note app, not in the vault itself: a key locked inside the box it opens opens nothing.
3. Set SIGNUPS_ALLOWED=false and run docker compose up -d again. From now on, nobody else can register on your server.
4. Check it: a new registration attempt must be refused.

3. Connect the apps

In the Bitwarden app or browser extension, before logging in, choose a self-hosted server and enter your address. Everything else works as usual: autofill, phone unlock by fingerprint, password generator.

4. The backup that restores

From the official documentation: copy the database with SQLite's own backup command, which stays consistent while the server writes.

sqlite3 vw-data/db.sqlite3 ".backup '/backups/db-$(date '+%Y%m%d-%H%M').sqlite3'"

Also back up vw-data/attachments/ and the rsa_key* files. Run it every night, to another disk.

To restore: stop Vaultwarden, put the files back, and delete any db.sqlite3-wal left in the folder before starting again, or the restored database can be corrupted.

Do a test restore once, on another machine or another folder, and log in with the apps. A backup you have never restored is a hope.

Traps

The real risk at home is not the server being stolen, it is losing the master password. A device that is already unlocked will keep working for a while and hide the problem until it restarts. If you change your master password, write the new one on paper the same minute.

Also export your vault, encrypted, from time to time and keep the file offline: it is your way out if the server itself is gone.

Sources

• Vaultwarden, official repository
• Bitwarden

Found this useful? Tell us what to measure next.