Vaultwarden: self-hosting a password manager in 30 minutes

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - WEBSOCKET_ENABLED=true
      - SIGNUPS_ALLOWED=${VAULTWARDEN_SIGNUPS_ALLOWED}
      - ADMIN_TOKEN=${VAULTWARDEN_ADMIN_TOKEN}
    volumes:
      - ./vaultwarden-data:/data

  nginx:
    image: ${NGINX_IMAGE}
    container_name: nginx-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOMAIN=${VAULTWARDEN_DOMAIN}
    volumes:
      - ./nginx-templates:/opt/nginx-templates:ro
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - vaultwarden

# Basic settings
VAULTWARDEN_DOMAIN=vault.yourdomain.com
NGINX_IMAGE=your-preferred-nginx-image:latest

# Vaultwarden settings
VAULTWARDEN_SIGNUPS_ALLOWED=false
VAULTWARDEN_ADMIN_TOKEN=your_secure_generated_token

openssl rand -base64 48

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name __VAULTWARDEN_DOMAIN__;

    ssl_certificate /etc/letsencrypt/live/__VAULTWARDEN_DOMAIN__/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/__VAULTWARDEN_DOMAIN__/privkey.pem;

    client_max_body_size 128m;

    # WebSocket for live-sync (since Vaultwarden 1.29+ uses the same port 80)
    location /notifications/hub {
        proxy_pass http://vaultwarden:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        proxy_pass http://vaultwarden:80;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
    }
}

docker compose up -d

python3 -c "
import json
with open('./vaultwarden-data/config.json') as f:
    c = json.load(f)
c.update({
    'smtp_host': 'mail.your-provider.com',
    'smtp_port': 587,
    'smtp_security': 'starttls',
    'smtp_username': 'your-username',
    'smtp_password': 'your-password',
    'smtp_from': 'no-reply@yourdomain.com',
    'smtp_from_name': 'Vaultwarden',
    '_enable_smtp': True,
})
with open('./vaultwarden-data/config.json', 'w') as f:
    json.dump(c, f, indent=2)
"

docker compose restart vaultwarden

# Open signups
sed -i 's/VAULTWARDEN_SIGNUPS_ALLOWED=false/VAULTWARDEN_SIGNUPS_ALLOWED=true/' .env
docker compose up -d --force-recreate vaultwarden

# Close after the user has created an account
sed -i 's/VAULTWARDEN_SIGNUPS_ALLOWED=true/VAULTWARDEN_SIGNUPS_ALLOWED=false/' .env
docker compose up -d --force-recreate vaultwarden

sqlite3 ./vaultwarden-data/db.sqlite3 ".backup /backup/db.sqlite3"