Vaultwarden Hosting on Your Own VPS

Tutorial · 5 min read

Vaultwarden is a Rust implementation of the Bitwarden server API. It uses a fraction of the RAM the official stack requires, which makes it ideal for a small VPS.

Why self-host passwords?

You control encryption keys, audit logs, and data residency. A dedicated IPv4 on every LayerOne plan lets you point vault.example.com at your instance without NAT headaches.

Plan sizing

Family or small-team Vaultwarden deployments rarely need more than LayerOne Nano ($3/mo, 1 GB RAM). Upgrade to Starter if you run additional services on the same VM.

Deploy with Docker

docker run -d --name vaultwarden \
  -v /vw-data/:/data/ \
  -p 127.0.0.1:8080:80 \
  vaultwarden/server:latest

Bind the container to localhost and proxy HTTPS with Caddy or Nginx. Set DOMAIN and admin token environment variables per the Vaultwarden wiki.

Security basics

Enable fail2ban, keep the OS patched, and restrict admin endpoints. DDoS protection is included on all plans, which matters when your vault hostname is public.

Backups

Copy the /vw-data directory regularly. Optional cluster backups are not off-site, so that copy is the restore path. Test a restore before you rely on it.

Billing

Hourly credit billing from the client dashboard keeps a personal vault affordable year-round. Add annual credit for a 20% effective discount if the server stays online continuously.

Recommended plan: LayerOne Nano. Compare plans on the pricing page.