How to Host Vaultwarden (Bitwarden) on Contabo VPS: Secure Private Password Vault

The Risks of Commercial Password Vaults (LastPass Breaches)

High-profile security breaches at commercial password managers like LastPass have proven that centralizing millions of encrypted vaults in a single corporate target invites continuous cyberattacks. Vaultwarden is a lightweight, open-source Bitwarden-compatible server written in Rust. Self-hosting your vault on a private VPS ensures only you hold the keys, eliminating third-party subscription fees and third-party data collection.

Step 1: Launching Vaultwarden via Docker Compose

mkdir -p ~/vaultwarden/data
cd ~/vaultwarden
nano docker-compose.yml

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      - WEBSOCKET_ENABLED=true
      - SIGNUPS_ALLOWED=false
      - INVITATIONS_ALLOWED=true
      - ADMIN_TOKEN=YOUR_64_CHARACTER_ADMIN_SECRET
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8080:80"
      - "127.0.0.1:3012:3012"

docker compose up -d

Step 2: Securing with Nginx and SSL

Bitwarden client extensions strictly require valid HTTPS encryption using WebCrypto APIs. Configure your Nginx reverse proxy block with WebSocket support on port 3012 to enable real-time vault synchronization across devices.

sudo nano /etc/nginx/sites-available/vault.yourdomain.com

server {
    listen 80;
    server_name vault.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name vault.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://127.0.0.1:3012;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Step 3: Connecting Bitwarden Apps

Open the official Bitwarden browser extension or mobile app on iOS/Android. In the top corner, click the gear icon (Settings), set Server URL to https://vault.yourdomain.com, and log in with your master password.