Self-Host Your Password Manager on a VPS: Vaultwarden + Caddy in 15 Minutes

说明与用途

在 VPS 上使用 Caddy 15 分钟部署 Vaultwarden：Docker 设置、防火墙、反向代理、HTTPS 和备份策略。

问题

Deploy a lightweight, self‑hosted password manager on a VPS with minimal resources and secure HTTPS.

结果

Vaultwarden runs on a VPS using ~100–200 MB RAM, accessible via a custom domain with automatic Let’s Encrypt certificates, and clients can sync securely.

工作流

• 1. Configure firewall and create data directory, generate ADMIN_TOKEN
• 2. Install Docker and create docker‑compose.yml for Vaultwarden
• 3. Start Vaultwarden container
• 4. Install Caddy, create Caddyfile to reverse‑proxy to Vaultwarden
• 5. Reload Caddy to obtain certificate
• 6. Create first account, then disable SIGNUPS_ALLOWED
• 7. Connect Bitwarden clients to the self‑hosted URL
• 8. Set up regular backups of the data directory

证据

Vaultwarden is a lightweight Rust implementation of the Bitwarden server. It works with all the official clients (browser extensions, iOS/Android and desktop apps), and the vault is a single directory with SQLite on your own server.

来源

The port is bound to 127.0.0.1 only: the service reaches the internet through Caddy.

来源

Open https://vault.example.com, create your account and immediately change SIGNUPS_ALLOWED=true to false in docker-compose.yml, then run docker compose up -d again.

来源

The whole vault is the ./data directory. Keep a copy outside this server: for example an encrypted restic repository on a nightly systemd timer.

来源