Vaultwarden
gunkanmaki.vaultwarden
A Docker Compose file for Vaultwarden alone, generated from the catalog and checked by the safety inspector. No account needed.
Rust implementation of the Bitwarden server API, compatible with the official Bitwarden clients and extensions, covering vaults, organisations, collections, sends and file attachments.
Vaultwarden reimplements the Bitwarden server protocol as a single binary with a small fraction of the resource footprint of the official stack, which is what makes self-hosting practical on a modest machine. Because it speaks the same API, the standard desktop, mobile, browser and command-line clients connect unchanged, and encryption stays client-side: the server holds ciphertext it cannot read. Organisations, collections, sharing, file sends and emergency access are supported, including several capabilities that are paid tiers on the hosted service. A first deployment sets an admin token, registers the first account and connects a client against the deployment's own URL.
You know it worked when
- The web vault loads over HTTPS and an account can be registered.
- An official Bitwarden client connects using the deployment's own server URL.
- An item saved in one client appears in another after a sync.
- An organisation collection shared with a second user is visible to them.
- A backup of the data directory restores a working vault on a fresh instance.
Known sharp edges
- The official clients require the server to be reachable over HTTPS, so a deployment without TLS in front of it will not accept connections from them.
- The admin page is exposed whenever an admin token is set and grants full user administration, so it needs separate protection or should stay disabled.
- Open registration is enabled by default and anyone reaching the instance can create an account on it.
- The data directory holds every vault and there is no server-side recovery of a forgotten master password, so backups are the only protection against total loss.