Self-Host Your Password Manager on a VPS: Vaultwarden + Caddy in 15 Minutes

Description and use

Deploy Vaultwarden on a VPS with Caddy in 15 minutes: Docker setup, firewall, reverse‑proxy, HTTPS, and backup strategy.

Problem

Deploy a lightweight, self‑hosted password manager on a VPS with minimal resources and secure HTTPS.

Outcome

Vaultwarden runs on a VPS using ~100–200 MB RAM, accessible via a custom domain with automatic Let’s Encrypt certificates, and clients can sync securely.

Workflow

• 1. Configure firewall and create data directory, generate ADMIN_TOKEN
• 2. Install Docker and create docker‑compose.yml for Vaultwarden
• 3. Start Vaultwarden container
• 4. Install Caddy, create Caddyfile to reverse‑proxy to Vaultwarden
• 5. Reload Caddy to obtain certificate
• 6. Create first account, then disable SIGNUPS_ALLOWED
• 7. Connect Bitwarden clients to the self‑hosted URL
• 8. Set up regular backups of the data directory

Evidence

Vaultwarden is a lightweight Rust implementation of the Bitwarden server. It works with all the official clients (browser extensions, iOS/Android and desktop apps), and the vault is a single directory with SQLite on your own server.

Source

The port is bound to 127.0.0.1 only: the service reaches the internet through Caddy.

Source

Open https://vault.example.com, create your account and immediately change SIGNUPS_ALLOWED=true to false in docker-compose.yml, then run docker compose up -d again.

Source

The whole vault is the ./data directory. Keep a copy outside this server: for example an encrypted restic repository on a nightly systemd timer.

Source