Vaultwarden VPS - Getting Started Guide

Software Included

Component	Details
Ubuntu	24.04 LTS
Vaultwarden	Latest (SQLite database)
Nginx	Reverse proxy with SSL
Certbot	Let's Encrypt SSL
Fail2Ban	SSH + Vaultwarden brute-force protection

Step 1 - Access Your Vault

Vaultwarden is available immediately after your VPS is created. Open your browser and go to:

https://your.server.ip

Note: Vaultwarden uses a self-signed SSL certificate by default. Your browser will show a security warning - this is expected. Click "Advanced" and proceed. You can install a proper Let's Encrypt certificate later (see Step 4).

Step 2 - Create Your Account

On the login page, click Create account. Enter your email address, name, and choose a master password.

Important: Your master password is used to encrypt all your data. Vaultwarden never stores it - if you lose it, your data cannot be recovered. Choose a strong, memorable password.

After registration, log in with your email and master password. This is your personal vault where you can store passwords, notes, cards, and identities.

Step 3 - Connect Bitwarden Clients

Vaultwarden is compatible with all official Bitwarden clients. Download the one you need:

• Browser extension: Chrome, Firefox, Edge, Safari
• Desktop app: Windows, macOS, Linux
• Mobile app: iOS, Android

Before logging in, you need to point the client to your server. In any Bitwarden client:

1. On the login screen, click the region selector (or gear icon) and choose Self-hosted
2. Enter your server URL: https://your.server.ip
3. Save and log in with your email and master password

Once connected, all your passwords sync automatically across all devices.

Step 4 - Set Up a Domain and SSL (Recommended)

For the best experience with Bitwarden clients, set up a domain with a proper SSL certificate:

1. Create a DNS A record pointing your domain to the server IP:

   Type	Name	Value
   A	vault	your.server.ip

2. SSH into your server and run the SSL script:

   /opt/setup/get-ssl.sh vault.yourdomain.com

3. Update the Vaultwarden config:

   sed -i "s|^DOMAIN=.*|DOMAIN=https://vault.yourdomain.com|" /opt/vaultwarden/.env
   systemctl restart vaultwarden

4. Update the server URL in your Bitwarden clients to https://vault.yourdomain.com

DNS changes usually take a few minutes, but can take up to 24 hours. Check the status at dnschecker.org.

Step 5 - Admin Panel (Optional)

Vaultwarden includes an admin panel for managing users, organizations, and server settings. To enable it, SSH into your server and set an admin token:

# Add ADMIN_TOKEN to the config
echo 'ADMIN_TOKEN=your-secret-token-here' >> /opt/vaultwarden/.env
systemctl restart vaultwarden

Then open https://your.server.ip/admin and enter the token. From the admin panel you can:

• Invite or delete users
• Disable open registration
• Manage organizations
• View server diagnostics

Fail2Ban - Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect both SSH and the Vaultwarden web interface from brute-force attacks.

Rule	Max Attempts	Ban Duration
SSH	5 failed logins	1 hour
Vaultwarden web login	5 failed logins	1 hour

Useful commands:

# Check banned IPs
fail2ban-client status sshd
fail2ban-client status vaultwarden

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

If you accidentally lock yourself out, connect via VNC console in your client panel and unban your IP.

Useful Commands

# Service management
systemctl status vaultwarden     # check Vaultwarden status
systemctl restart vaultwarden    # restart Vaultwarden
systemctl status nginx           # check Nginx status

# Configuration
nano /opt/vaultwarden/.env       # edit Vaultwarden settings

# Database backup (SQLite)
cp /opt/vaultwarden/data/db.sqlite3 /root/vaultwarden-backup-$(date +%Y%m%d).sqlite3

# View logs
journalctl -u vaultwarden -f    # Vaultwarden service log
cat /opt/vaultwarden/data/vaultwarden.log  # application log

Updates

Vaultwarden is installed as a standalone binary and does not update automatically. To update, replace the binary with a newer version extracted from the official Docker image:

# On a machine with Docker, extract the new binary:
docker pull vaultwarden/server:latest-alpine
CID=$(docker create vaultwarden/server:latest-alpine)
docker cp $CID:/vaultwarden /tmp/vaultwarden
docker rm $CID

# Copy to your server and replace:
scp /tmp/vaultwarden root@your.server.ip:/tmp/
ssh root@your.server.ip "systemctl stop vaultwarden && cp /tmp/vaultwarden /opt/vaultwarden/vaultwarden && chmod +x /opt/vaultwarden/vaultwarden && systemctl start vaultwarden"

OS updates can be applied via SSH:

apt update && apt upgrade -y

• Vaultwarden Wiki: github.com/dani-garcia/vaultwarden/wiki
• Bitwarden Help Center: bitwarden.com/help
• Bitwarden Clients: bitwarden.com/download