Tutorial · 5 min read

Vaultwarden is a Rust implementation of the Bitwarden server API. It uses a fraction of the RAM the official stack requires, which makes it ideal for a small VPS.

Why self-host passwords?

You control encryption keys, audit logs, and data residency. A dedicated IPv4 on every LayerOne plan lets you point vault.example.com at your instance without NAT headaches.

Plan sizing

Family or small-team Vaultwarden deployments rarely need more than LayerOne Nano ($3/mo, 1 TB transfer). Upgrade to Starter if you run additional services on the same VM.

Deploy with Docker

docker run -d --name vaultwarden \
  -v /vw-data/:/data/ \
  -p 127.0.0.1:8080:80 \
  vaultwarden/server:latest

Bind the container to localhost and proxy HTTPS with Caddy or Nginx. Set DOMAIN and admin token environment variables per the Vaultwarden wiki.

Security basics

Enable fail2ban, keep the OS patched, and restrict admin endpoints. DDoS protection is included on all plans, which matters when your vault hostname is public.

Backups

Copy the /vw-data directory regularly. Optional snapshot add-ons provide point-in-time recovery; test a restore before you rely on them.

Billing

Hourly credit billing from the client dashboard keeps a personal vault affordable year-round. Add annual credit for a 20% effective discount if the server stays online continuously.