Running your own Bitwarden instance gives you complete control over your password data. For developers and power users, self-hosting eliminates reliance on third-party servers while providing customization options unavailable in the cloud version.

This guide walks through deploying Bitwarden on a Linux server using Docker, configuring SSL with Let’s Encrypt, and performing essential first-time setup tasks.

Why Self-Host Bitwarden?

The cloud-hosted Bitwarden service is solid, but self-hosting offers distinct advantages. You decide where data resides, who accesses it, and when upgrades happen. Organizations with compliance requirements often need on-premises solutions. Developers may want to test integrations without production data.

The trade-off is clear: you accept responsibility for backups, updates, and server maintenance. If that trade-off suits your needs, read on.

Prerequisites

Before beginning, ensure you have:

• A Linux server (Ubuntu 22.04 LTS recommended) with at least 2GB RAM
• Docker and Docker Compose installed
• A domain name pointing to your server’s IP address
• Basic familiarity with command-line operations

Installing Docker and Docker Compose

If Docker is not yet installed, set it up first:

# Update package lists
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER

# Install Docker Compose
sudo apt install docker-compose-plugin

# Verify installation
docker --version
docker compose version

Reboot or log out for group membership to take effect.

Deploying Bitwarden

The official Bitwarden deployment uses a simplified installation script. Run these commands on your server:

# Create a directory for Bitwarden
mkdir -p ~/bitwarden && cd ~/bitwarden

# Download the installation script
curl -L -o bitwarden.sh https://go.bwds.io/bwds.sh
chmod +x bitwarden.sh

# Run the installer
./bitwarden.sh install

The installer prompts for several configuration values:

1. Domain name: Enter your fully qualified domain (e.g., vault.example.com)
2. Bitwarden installation ID: Generate free IDs at bitwarden.com/host
3. Installation key: Also obtained from the same page
4. SSL certificate: Choose “Let’s Encrypt” for automatic free certificates, or provide your own
5. Database: Accept the default SQLite for single-user deployments, or configure MySQL for multi-user production use

After configuration, start the services:

./bitwarden.sh start

Check service status:

./bitwarden.sh status

All containers should show as “running.” Access your vault at https://your-domain.com.

Initial Configuration

Create your first user account through the web interface. This account becomes the organization owner with full administrative capabilities.

After logging in, navigate to the admin panel at https://your-domain.com/admin. You’ll need the admin token generated during installation (found in ./bwdata/env/admin.token).

From the admin panel, you can:

• Enable or disable user registration
• Configure two-factor authentication requirements
• Set up SMTP for invitation emails
• View system statistics

Configuring SMTP for Email

Self-hosted Bitwarden requires SMTP configuration to send invitation emails and password reset links. Add these settings to your environment:

# Edit the environment file
nano ~/bitwarden/bwdata/env/global.override.env

Add these variables:

globalSettings__mail__smtp__host=smtp.example.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__useSsl=true
globalSettings__mail__smtp__username=your-smtp-username
globalSettings__mail__smtp__password=your-smtp-password
globalSettings__mail__smtp__from noreply@example.com

Restart services to apply changes:

./bitwarden.sh restart

Backup Strategy

Your Bitwarden data lives in the ./bwdata directory. Critical components include:

• ./bwdata/mssql/data — Database files (if using MSSQL)
• ./bwdata/core/attachments — Stored attachments
• ./bwdata/env — Configuration and secrets

Create a simple backup script:

#!/bin/bash
BACKUP_DIR="/path/to/backups"
DATE=$(date +%Y%m%d)

# Stop services
cd ~/bitwarden
./bitwarden.sh stop

# Archive data directory
tar -czf $BACKUP_DIR/bitwarden-$DATE.tar.gz bwdata

# Restart services
./bitwarden.sh start

# Rotate old backups (keep last 7)
find $BACKUP_DIR -name "bitwarden-*.tar.gz" -mtime +7 -delete

Schedule this script with cron to run daily.

Updating Your Instance

Bitwarden releases updates regularly. Update your self-hosted instance with:

cd ~/bitwarden
./bitwarden.sh update
./bitwarden.sh restart

Before updating, always backup your data. Check the Bitwarden Community Forum for any reported issues with specific versions.

Performance Considerations

For single-user or small team deployments, the default configuration works well. However, if you experience slowness:

• Switch from SQLite to MySQL for better concurrent access
• Increase allocated memory in Docker settings
• Consider adding a reverse proxy with caching (nginx-proxy-manager works well)

The default installation uses about 1GB RAM at idle. Performance scales reasonably well up to 50-100 users on a 4GB server.

Security Hardening

After initial setup, implement these hardening measures:

1. Enable fail2ban to protect against brute force attempts
2. Configure a firewall allowing only HTTP, HTTPS, and SSH:

   sudo ufw allow 22/tcp
   sudo ufw allow 80/tcp
   sudo ufw allow 443/tcp
   sudo ufw enable
   

3. Set up automatic security updates:

   sudo apt install unattended-upgrades
   sudo dpkg-reconfigure -plow unattended-upgrades
   

4. Use strong admin token and rotate it periodically

Conclusion

Once your instance is running, you get all Premium features without the subscription fee, plus organization support with collections and event logging. The initial setup time pays off in control over where your data lives and how it is managed.

Related Reading

• Best Hardware Security Key for Developers: A Practical Guide
• Bitwarden Vault Export Backup Guide: Complete Technical.
• Telegram vs Signal: Which Is Actually Safer? A Technical.

Built by theluckystrike — More at zovo.one