Vaultwarden

Point a domain at your server

Bitwarden's own apps refuse to connect over plain HTTP, so you'll need a subdomain with real HTTPS, for example vault.yourdomain.com. In your domain registrar's DNS settings, add an A record for that subdomain pointing at your server's IP address. This can take anywhere from a few minutes to a few hours to take effect. Then open the two ports it needs: sudo ufw allow 80,443/tcp.

Write the compose file

Vaultwarden joins the shared web network instead of exposing its own port. The proxy reaches it internally, by container name.

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      DOMAIN: "https://vault.yourdomain.com"
      SIGNUPS_ALLOWED: "true"
      ADMIN_TOKEN: "REPLACE-WITH-A-GENERATED-TOKEN"
    volumes:
      - ./vw-data:/data
    networks:
      - web

networks:
  web:
    external: true

Start it: docker compose up -d.

Wire it into the shared reverse proxy

This site uses one Caddy instance for the whole server, not one per app, and every tool guide points back to the same setup rather than each showing its own. If you haven't set it up yet, the domains and HTTPS deep dive is the canonical walkthrough, including the exact port and Caddyfile block for every tool on this site. Once it's running, connecting Vaultwarden is one block in the shared Caddyfile:

vault.yourdomain.com {
    reverse_proxy vaultwarden:80
}

Then reload it: docker compose restart caddy in the proxy's folder.

Create your account

Visit your domain and click "Create Account." Use a real email and a strong master password, this password encrypts your entire vault, and losing it means losing everything in it, with no reset option.

Lock the door behind you

Now that your account exists, stop anyone else from registering one. Change SIGNUPS_ALLOWED to "false" in the compose file and run docker compose up -d again to apply it.

Install the apps

Install the official Bitwarden apps, not a Vaultwarden-branded one; there isn't one. In each app's settings, before logging in, toggle "Self-hosted" and enter your server URL, then log in with the account you just created.