Self-hosting Vaultwarden requires manual certificate and backup oversight
A new guide details setting up Vaultwarden with Caddy, highlighting that administrators must manage their own TLS renewals, backups, and security configurations.
A recent technical guide published on October 28, 2026, outlines the process for deploying a self-hosted password manager using Vaultwarden and Caddy on a virtual private server. The tutorial targets developers and system administrators who prefer controlling their own data infrastructure rather than relying on third-party cloud services. It emphasizes that while the initial setup is rapid, ongoing maintenance responsibilities shift entirely to the user.
What happened
The article provides a step-by-step walkthrough for installing Vaultwarden, a lightweight Rust-based implementation of the Bitwarden server, on an Ubuntu VPS. The author demonstrates how to configure Docker containers, set up a reverse proxy with Caddy, and secure the connection using Let's Encrypt certificates. The guide notes that Caddy handles certificate acquisition and renewal automatically, reducing some operational overhead. However, it explicitly states that administration, including image updates, backups, and monitoring, becomes the sole responsibility of the server owner.
The instructions cover essential security hardening measures, such as configuring a firewall to allow only necessary ports and binding the application service to the local loopback interface. The author stresses the importance of disabling public sign-ups immediately after creating the initial admin account to prevent unauthorized access. Additionally, the guide recommends generating a secure hash for the admin token rather than storing it in plain text, although it acknowledges that plain text storage may be acceptable for low-risk personal servers.
Key details
- Vaultwarden consumes approximately 100–200 MB of RAM, making it suitable for small or entry-level VPS plans.
- The entire password vault is stored in a single
./datadirectory using SQLite, simplifying file-level backups. - Caddy is used as the web server to automatically obtain and renew TLS certificates from Let's Encrypt.
- Public registration must be disabled by setting
SIGNUPS_ALLOWED=falseafter the first account is created. - Backups should be stored off-server, such as in an encrypted restic repository, to protect against total server loss.
- The admin panel token should ideally be an Argon2 hash generated via the
vaultwarden hashcommand for enhanced security.
Background
Self-hosting involves running software on infrastructure you control, such as a rented virtual private server, rather than using a software-as-a-service provider. This approach offers greater privacy and data sovereignty but requires technical competence in Linux system administration, containerization, and network security. Vaultwarden is popular in this space because it is compatible with official Bitwarden clients while being significantly lighter on resources than the official Bitwarden server implementation.
TLS certificates are digital credentials that encrypt traffic between a user's browser and the server. Services like Let's Encrypt provide these certificates for free, but they expire regularly, typically every 90 days. Automated tools like Caddy can handle the renewal process, but failures can occur due to network issues, configuration errors, or domain misconfigurations. Without proper monitoring, an expired certificate will cause browsers to display security warnings, blocking user access to the password vault.
Why it matters
For teams and individuals managing self-hosted critical infrastructure, the shift from consumer to administrator introduces significant operational risks. The guide highlights that a backup kept on the same disk as the live data is insufficient. If the server hardware fails or the instance is corrupted, both the live data and the backup are lost. This underscores the need for robust, off-site backup strategies and regular restore testing, which are often overlooked in quick-start tutorials.
Furthermore, reliance on automated certificate management does not eliminate the need for visibility. While Caddy attempts to renew certificates automatically, silent failures can leave a service inaccessible. For a password manager, downtime means users cannot retrieve credentials, potentially locking them out of other critical systems. Administrators must ensure they have external monitoring in place to detect when certificates are nearing expiration or when the service itself becomes unresponsive.
What you can do
- Implement an off-site backup strategy using tools like restic or rclone to copy the
./datadirectory to a separate storage location. - Schedule regular restore tests to verify that backup files are intact and can be successfully deployed to a new instance.
- Disable public sign-ups immediately after initial setup by modifying the environment variables in your Docker configuration.
- Use strong authentication for the admin panel by generating an Argon2 hash instead of relying on plain text tokens.
- Set up external monitoring for HTTPS availability and TLS certificate expiration dates to receive alerts before service disruption occurs.
- Keep the host operating system and Docker images updated to patch security vulnerabilities promptly.
