How to Deploy Vaultwarden with Automatic Backups

Every business needs a password manager, and Vaultwarden is the best self-hosted option. It is compatible with all Bitwarden clients, includes all premium features for free, and runs on minimal hardware. Here is how to deploy it with automatic encrypted backups.

Step 1: Create the Docker Compose File

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=false
      - ADMIN_TOKEN=a_very_long_random_string_here
      - SMTP_HOST=smtp.yourdomain.com
      - SMTP_FROM=vault@yourdomain.com
      - SMTP_PORT=587
      - SMTP_SECURITY=starttls
      - SMTP_USERNAME=vault@yourdomain.com
      - SMTP_PASSWORD=your_smtp_password
    ports:
      - "127.0.0.1:8082:80"

volumes:
  vaultwarden_data:
    driver: local

Key settings explained:

• SIGNUPS_ALLOWED=false: Disable public registration. You create accounts through the admin panel.
• ADMIN_TOKEN: Generate a random 40-character string. Use this to access the admin panel at /admin.
• Port binding to 127.0.0.1: Only the reverse proxy can reach Vaultwarden. It is not exposed directly to the internet.

Step 2: Configure the Reverse Proxy

In Nginx Proxy Manager, add a proxy host for vault.yourdomain.com pointing to vaultwarden:80 (the container name and internal port). Enable WebSocket support. Request an SSL certificate. Force SSL.

Step 3: Configure SMTP for Email Notifications

Vaultwarden sends emails for new device logins, password resets, and administrative alerts. Configure SMTP credentials in the environment variables above. Without SMTP, users cannot recover their accounts if they lose their master password.

Step 4: Set Up Automatic Encrypted Backups

Create a backup script that runs nightly. This script exports the Vaultwarden database, encrypts it, and copies it to offsite storage:

#!/bin/bash
# /opt/vaultwarden/backup.sh

BACKUP_DIR="/mnt/backups/vaultwarden"
DATE=$(date +%Y-%m-%d)
ENCRYPTION_KEY="your_backup_encryption_key"

# Stop Vaultwarden briefly for a consistent backup
docker stop vaultwarden

# Create encrypted backup
sqlite3 /opt/vaultwarden/data/db.sqlite3 ".backup /tmp/vaultwarden-backup.sqlite3"

gpg --batch --yes --passphrase "$ENCRYPTION_KEY" \
  -c /tmp/vaultwarden-backup.sqlite3

# Copy to backup location
cp /tmp/vaultwarden-backup.sqlite3.gpg "$BACKUP_DIR/vaultwarden-$DATE.sqlite3.gpg"

# Copy attachments
cp -r /opt/vaultwarden/data/attachments "$BACKUP_DIR/attachments-$DATE/"

# Start Vaultwarden
docker start vaultwarden

# Clean up old backups (keep 30 days)
find "$BACKUP_DIR" -name "vaultwarden-*.gpg" -mtime +30 -delete
find "$BACKUP_DIR" -name "attachments-*" -mtime +30 -exec rm -rf {} \;

rm /tmp/vaultwarden-backup.sqlite3

Schedule it with cron:

crontab -e
# Add: 0 3 * * * /opt/vaultwarden/backup.sh

Step 5: Invite Your Team

Log into the admin panel at https://vault.yourdomain.com/admin using your ADMIN_TOKEN. Create accounts for each team member. Create an organisation for shared passwords. Create collections for Finance, IT, Marketing, and HR. Assign users to collections.

Your team installs the Bitwarden browser extension, desktop app, or mobile app. Point the server URL to https://vault.yourdomain.com. Log in. Done.

Enforce Security Policies

In the admin panel, you can enforce policies for all users:

• Require two-factor authentication via TOTP or WebAuthn
• Set minimum password length for generated passwords
• Disable password export to prevent mass data extraction

These policies cannot be bypassed by individual users. They are enforced server-side.

If configuring backups and SSL sounds like your weekend is not your own, VPS1 deploys Vaultwarden with automated encrypted backups. Your team gets a password manager. You get the assurance that every credential is secured and backed up.