Vaultwarden Self Host on VPS

How to self-host Vaultwarden on your own VPS with daily cloud backups.

Overview

This Tutorial covers:

Setting up Vaulwarden on a Docker container using Portainer.io.
Reverse proxy via Nginx with SSL
Secure backup of the database
Encryption using age
Automatic upload to Dropbox
Disaster recovery procedure

Prerequisites

VPS running Ubuntu 24.04 (or similar)
Docker + Portainer already installed
Your domain configured via Nginx reverse proxy
Access to your VPS as root
Dropbox account for offsite backup

I'll be using "https://vault.your-domain.com" as the example domain name through the guide, make sure to replace it with your own sub and domain name each time.

Deploy the Vaultwarden container (on Portainer)

Go to Portainer

Click "Stacks" in the Side menu

Click "Add Stack"

Fill in Name and content

nginx

Name

vaultwarden

yaml

Content

version: "3.9"

services:

vaultwarden:

image: vaultwarden/server:latest

container_name: vaultwarden

restart: unless-stopped

ports:

- "127.0.0.1:8222:80"

volumes:

- /opt/vaultwarden/data:/data

environment:

DOMAIN: https://vault.your-domain.com

SIGNUPS_ALLOWED: false

WEBSOCKET_ENABLED: true

ADMIN_TOKEN: CHANGE_ME

LOG_LEVEL: warn

Before deploying the stack, generate the admin token in SSH:

bash

openssl rand -base64 48

replace "your-domain" in https://vault.your-domain.com with your domain. The vault. part is the sub domain name, you can change this too if you like.
replace CHANGE_ME with the generated token and deploy the stack
deploy the stack

Create DNS record

In your domain DNS panel add: (I'm using easyhost.be)

Type	Name	Value
A	vault	[your-vps-ip]

Add Vaultwarden to Nginx

We will NOT edit the existing file (safer). We will create a new one.

Create Config

bash

sudo nano /etc/nginx/sites-available/vault.your-domain

Add:

nginx

server {

server_name https://vault.your-domain.com;

location / {

proxy_pass http://127.0.0.1:8222;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection "upgrade";

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

Save (press ctrl + o, then enter, then ctrl + x)

Enable it:

bash

sudo ln -s /etc/nginx/sites-available/vault.your-domain /etc/nginx/sites-enabled/

Get HTTPS Certificate

Run:

bash

sudo certbot --nginx -d vault.your-domain.com

Choose redirect to HTTPS when asked.
This will automatically add SSL config like the main site should have.

Reload Nginx and Test

bash

sudo systemctl reload nginx

Access the admin panel

Open in your browser
https://vault.your-domain.com/admin

Vaultwarden will ask for the ADMIN_TOKEN you generated earlier with:

bash

openssl rand -base64 48

paste that token and you'll be logged into the admin interface

Create new User

In the admin panel go to Invite User
Vaultwarden Admin Users

Vaultwarden Admin Invite User
Enter the email for that user.
Go back to https://vault.your-domain.com and click Create Account
Vaultwarden Create Account
Enable Two-step login for extra security.
Vaultwarden Two-step Login

Attention
For the Master Password, write this down on a paper and keep it safe.
You cannot and should not store this password in Vaultwarden.
Because your Vaulwarden master password is NOT recoverable.
Not by you, not by the server, not even by Bitwarden devs.
If you lose it, your vault is permanently encrypted garbage.

Find Container Volume

Go to Portainer, go into Vaultwarden container and scroll down to Volumes
Portainer Vaultwarden Volumes
run this command:

bash

ls /opt/vaultwarden/data

It should give you this or similar as result:

bash

config.json db.sqlite3-shm icon_cache tmp

db.sqlite3 db.sqlite3-wal rsa_key.pem

Test manual backup

We'll create a backup folder:

bash

mkdir -p /root/backups/vaultwarden

Now copy the database:

bash

cp -r /opt/vaultwarden/data /root/backups/vaultwarden/backup-$(date +%F)

Confirm with:

bash

ls /root/backups/vaultwarden

You should see:

bash

backup-yyyy-mm-dd

Obviously yyyy-mm-dd will be the current year, month and day.

Make Automatic daily backups

Create a backup script:

bash

nano /root/backup-vaultwarden.sh

Add this as it's content:

bash

#!/bin/bash

BACKUP_DIR="/root/backups/vaultwarden"

DATA_DIR="/opt/vaultwarden/data"

DATE=$(date +%F)

mkdir -p $BACKUP_DIR

# Stop container

docker stop vaultwarden

# Copy database

cp -r $DATA_DIR $BACKUP_DIR/backup-$DATE

# Start again

docker start vaultwarden

# Delete backups older than 14 days

find $BACKUP_DIR -type f -mtime +14 -delete

save (press ctrl + 0, then enter, then ctrl + x) Make the file executable:

bash

chmod +x /root/backup-vaultwarden.sh

Schedule nightly backups

Open cron:

bash

crontab -e

Choose 1 if asked.

Add this line at the bottom:

bash

0 4 * * * /root/backup-vaultwarden.sh >> /root/backup.log 2>&1

This means:

Every day at 04:00 will a backup be taken.

Install the Encryption tool

on the VPS (SSH):

bash

apt install age -y

Create your Peronal Backup key

This key is the only thing that can decrypt your vault backups.

Run:

bash

age-keygen -o /riit/vaultwarden-backup.key

You should sees something like:

bash

Public key: age1m9v...abcxyz

Two important things were created:

File	Purpose
`/root/vaulwarden-backup.key`	SECRET - keep forever
public key (printed)	used to encrypt

Attention
Download vaultwarden-backup.key to your PC using FileZilla or winSCP and save it on a USB drive and write it down as well on that same paper you wrote the Vaultwarden master password on. If you lose this file, your backups are unrecoverable.

Modify the backup script to encrypt

Open the script:

bash

nano /root/backup-vaultwarden.sh

Update the script:

bash

#!/bin/bash

BACKUP_DIR="/root/backups/vaultwarden"

DATA_DIR="/opt/vaultwarden/data"

DATE=$(date +%F)

TMP_DIR="/tmp/vaultwarden-backup"

mkdir -p $BACKUP_DIR

rm -rf $TMP_DIR

mkdir -p $TMP_DIR

# Stop container

docker stop vaultwarden

# Copy database

cp -r $DATA_DIR $BACKUP_DIR/backup-$DATE

cp -r $DATA_DIR $TMP_DIR/data

# Start container again immediately

docker start vaultwarden

# Create archive

tar -czf $TMP_DIR/backup-$DATE.tar.gz -C $TMP_DIR data

# Encrypt archive

age -r $(grep '^# public key:' /root/vaultwarden-backup.key | cut -d' ' -f4) \

-o $BACKUP_DIR/backup-$DATE.tar.gz.age \

$TMP_DIR/backup-$DATE.tar.gz

# Remove unencrypted files

rm -rf $TMP_DIR

rm -f $BACKUP_DIR/*.tar.gz

# Delete backups older than 14 days

find $BACKUP_DIR -type f -mtime +14 -delete

save (press ctrl + 0, then enter, then ctrl + x) Make executable again just in case:

bash

chmod +x /root/backup-vaultwarden.sh

Test Encrypt backup

Run manually once:

bash

/root/backup-vaultwarden.sh

Then check:

bash

ls /root/backups/vaultwarden

You should see

bash

backup-yyyy-mm-dd.tar.gz.age

Obviously yyyy-mm-dd will be the current year, month and day.

Restore backups

It's important to understand this process, you should only execute these steps when needed.

Download Age on your pc (not the VPS)
Look for age-vx.x.x-windows-amd64.zip if you're using windows
Extract this zip file and copy age.exe and age-keygen.exe to another folder on your pc. e.g.: Documents/age. You should then place the vaultwarden-backup.key from step 14 in that same folder Documents/age. If you hadn't downloaded that file yet, now it's the time to do so.
Then download as well the encrypted backup file (the most recent one) using FileZilla or winSCP and place it in that same folder.
Now you should have a total of 4 files in Documents/age.
Type cmd in the path bar on the top and press enter
Documents/age cmd
Run this command:

bash

age -d -i vaultwarden-backup.key backup-2026-02-15.tar.gz.age > backup.tar.gz

You'll see this file in Documents/age:
Documents/age backup.tar
Windows can extract tar.gz file directly. or run:

bash

tar -xzf backup.tar.gz

You should now see a data folder and that is exactly what goes back into a new Vaulwarden server.
Documents/age data folder

Install rclone on the VPS

Now to make automatic backups instead of having to do it manually, we can install rclone on the VPS:

bash

apt install rclone -y

Install rclone on your pc

Go to rclone authorize and extract the downloaded zip file.
go into this extracted folder, type cmd in the path bar on the top and press enter.
rclone cmd
Run the follow command:

bash

rclone authorize "dropbox"

This will open your browser automatically, login to dropbox and allow access.
At the end it should print a long JSON token, copy that entire JSON string. Don't close this window yet just incase you need to copy it again in the next step.

Connect the VPS to Dropbox

Of course you can also use OneDrive, GoogleDrive or any online cloud service supporting rclone. Start setup:

bash

rclone config

You'll see a menu, follow exactly:

bash

n) New remove

name> dropbox

Storage> dropbox

client_id> (press enter)

client_secret> (press enter)

Edit advanced config> n

Use auto config> n

paste the JSON token from your PC when prompted.

Test Dropbox connection

Run this command:

bash

rclone lsd dropbox:

You should see your Dropbox folders (if any).

Now create a folder for backups:

bash

rsclone mkdir dropbox:vaultwarden-backups

Modify the backup script to auto upload

open the script again:

bash

nano /rook/backup-vaultwarden.sh

Update the script:

bash

nano /root/backup-vaultwarden.sh

Update the script:

bash

#!/bin/bash

BACKUP_DIR="/root/backups/vaultwarden"

DATA_DIR="/opt/vaultwarden/data"

DATE=$(date +%F)

TMP_DIR="/tmp/vaultwarden-backup"

mkdir -p $BACKUP_DIR

rm -rf $TMP_DIR

mkdir -p $TMP_DIR

# Stop container

docker stop vaultwarden

# Copy database

cp -r $DATA_DIR $TMP_DIR/data

# Start container again immediately

docker start vaultwarden

# Create archive

tar -czf $TMP_DIR/backup-$DATE.tar.gz -C $TMP_DIR data

# Encrypt archive

age -r $(grep '^# public key:' /root/vaultwarden-backup.key | cut -d' ' -f4) \

-o $BACKUP_DIR/backup-$DATE.tar.gz.age \

$TMP_DIR/backup-$DATE.tar.gz

# Remove unencrypted files

rm -rf $TMP_DIR

rm -f $BACKUP_DIR/*.tar.gz

# Delete backups older than 14 days

find $BACKUP_DIR -type f -mtime +14 -delete

# Auto upload to dropbox

rclone copy $BACKUP_DIR dropbox:vaultwarden-backups --progress

save (press ctrl + 0, then enter, then ctrl + x) Make executable again just in case:

Final Test

Run following command:

bash

/root/backup-vaultwarden.sh

Now check Dropbox website and you should see a backup-yyyy-mm-dd.tar.gz.age file the vaultwarden-backups folder.

Conclusion

Now at the end of this tutorial if you have followed everything you should have a fully setup Vaultwarden container and a script running once daily that

stops vaultwarden briefly
backups database
encrypt backup
uploads to dropbox
removes unencrypted backup files
keeps 30 days history (on vps, dropbox is unaffected).

Table of Contents

Overview

Prerequisites

Deploy the Vaultwarden container (on Portainer)

Create DNS record

Add Vaultwarden to Nginx

Create Config

Get HTTPS Certificate

Reload Nginx and Test

Access the admin panel

Create new User

Find Container Volume

Test manual backup

Make Automatic daily backups

Schedule nightly backups

Install the Encryption tool

Create your Peronal Backup key

Modify the backup script to encrypt

Test Encrypt backup

Restore backups

Install rclone on the VPS

Install rclone on your pc

Connect the VPS to Dropbox

Test Dropbox connection

Modify the backup script to auto upload

Final Test

Conclusion