Vaultwarden

On the Seed, Vaultwarden and Caddy run as Docker containers, with Caddy accepting HTTPS connections and passing them on to Vaultwarden. From creating the Seed to a ready vault usually takes 1 to 3 minutes. As a last step, the installation signs in with the admin token and writes the address of your vault to /root/ready.txt, which you can read over SSH or in the VNC console. If a step fails, you will find failed.txt there instead with the reason, and /root/vaultwarden-install.log shows the full run. If neither file is there yet, the installation has not finished.

You create your user account yourself. Open the address from ready.txt, choose Create account and set a master password. Your device derives the key for your vault from it, the Seed never sees it, and that is why nobody can reset it. Until you close registration, anyone who knows the address can create an account. So right afterwards, sign in at /admin with the admin token from /root/vaultwarden-credentials.txt and turn off Allow new signups under General settings.

To add more people, use Invite User under Users in the admin area. Without a mail server they get no invitation email, but they can register with the invited address through Create account. For invitations, master password hints and sign-in codes by email, enter your mail server's details under SMTP Email Settings and check them with a test email.

In the Bitwarden apps for browser, phone and desktop, switch the server to self-hosted on the sign-in screen and enter your vault's address. Everyone on your team stores this address in their apps, so we recommend using your own domain from the start. Once your domain's A record points to the Seed's IPv4 address, switch Vaultwarden over with seed-tls domain vault.example.com via SSH. Your vault gets a Let's Encrypt certificate in the process, and the previous address redirects to the domain.

In /opt/vaultwarden, compose.yaml defines the containers vaultwarden and caddy, and .env holds the images with their versions, the address of your vault and, under VAULTWARDEN_ADMIN_TOKEN, the hash of the admin token. Vaultwarden stores settings from the admin area in config.json, and they take precedence over .env. The database with all encrypted vaults, the file attachments and config.json live in the Docker volume vaultwarden_vw_data, so include that volume in your backups. sqlite3 is already installed for consistent backups of the running SQLite database.

To update, replace the entire value of VAULTWARDEN_IMAGE in .env, including the @sha256 part, with the new version, for example docker.io/vaultwarden/server:1.38.0, then run docker compose pull and docker compose up -d in /opt/vaultwarden. CADDY_IMAGE updates Caddy in the same way, and apt update && apt upgrade takes care of Docker itself. Read the Vaultwarden release notes first and take a snapshot of the Seed. Both containers start automatically when the Seed reboots.

Our guide Set up Vaultwarden as your password manager shows how to import passwords from your previous password manager, set up daily backups with a cron job and restrict access to a VPN. The installation is already done on this Seed, so start at the section “Admin panel”. The directory and volume have the same names as in the guide.