How to Install Vaultwarden with Docker on Ubuntu 22.04

Vaultwarden is an unofficial port of Bitwarden server written in Rust language. It is compatible with the official Bitwarden clients and is less resource-heavy than Bitwarden. It implements almost all features of Bitwarden barring a few. It uses the Bitwarden API to provide features like organization support, attachments, authenticator, U2F, Yubikey, Duo support, and support for email alias services.

In this tutorial, you will learn how to set up your copy of Vaultwarden on a Ubuntu 22.04 server.

Prerequisites

• A server running Ubuntu 22.04.

• A non-root user with sudo privileges.

• The uncomplicated Firewall(UFW) is enabled and running.

• A Fully Qualified domain name (FQDN) pointing to the server like, vaultwarden.example.com.

• Everything is updated.
  $ sudo apt update && sudo apt upgrade


Step 1 – Configure Firewall

Before installing any packages, the first step is configuring the firewall to allow HTTP and HTTPS connections.

Check the status of the firewall.
$ sudo ufw status


You should see something like the following.
Status: active

To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)


Allow HTTP and HTTPs ports.

$ sudo ufw allow http
$ sudo ufw allow https


Check the status again to confirm.
$ sudo ufw status
Status: active

To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
80/tcp ALLOW Anywhere
443 ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)


Step 2 – Install Docker and Docker Compose

Add Docker’s official GPG key.
$ curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker.gpg


Run the following command to add the Docker repository.
$ echo
"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null


Update the system to include Docker’s repository.
$ sudo apt update


Install Docker.
$ sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin


This tutorial will be using the Docker Compose v2 plugin instead of the older legacy binary. Therefore, the command for running it has changed from docker-compose to docker compose and this is reflected here.

Docker runs with elevated privileges so you will need to use sudo frequently to run commands. The better option is to add your Linux user account to the docker user group.
$ sudo usermod -aG docker ${USER}


The ${USER} variable picks up the currently logged-in system account. If you are not logged in with the user you want to give privileges to, replace ${USER} with the username.

To apply for the new group membership, log out of the server and back in, or use the following command. You will be prompted for the user’s password.
$ su - ${USER}


Step 3 – Create Docker Compose File for Vaultwarden

Create a new directory for Vaultwarden.
$ mkdir vaultwarden


Switch to the directory.
$ cd vaultwarden


Create the Docker compose file and open it for editing.
$ nano docker-compose.yml


Paste the following code in it. Replace the DOMAIN and EMAIL variables with the appropriate values.
version: '3'

caddy:
image: caddy:2
container_name: caddy
restart: always
ports:
- 80:80 # Needed for the ACME HTTP-01 challenge.
- 443:443
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- ./caddy-config:/config
- ./caddy-data:/data
environment:
DOMAIN: "https://vaultwarden.example.com" # Your domain.
EMAIL: "[email protected]" # The email address to use for ACME registration.
LOG_FILE: "/data/access.log"


Save the file by pressing Ctrl + X and entering Y when prompted.

We are setting up Vaultwarden and the Caddy web server in a single Docker compose file. Let us take a look at all the options defined in the file.

• image refers to the location of the Docker images of Vaultwarden and Caddy on Dockerhub.
• container_name allows you to apply a label to your docker container, for use when referencing the container within a Docker network.
• restart specifies a restart policy for the container. Setting it to always means that a container if exited, will automatically get restarted.
• environment section sets the variables required by Vaultwarden and Caddy. If the SMTP port of your service is 587, set the value of the variable SMTP_SECURITY to starttls and if the SMTP port of your service is 465, set the value of the variable SMTP_SECURITY to force_tls. The domain variable is necessary for email verification to work. We have enabled Web sockets for the notifications to work.
• volume defines the directories present on the server to store persistent data. The /vw-data directory on the server is mapped to the /data directory in the container which stores all the data Vaultwarden requires. In the same way, the location of the Caddy file, Caddy configuration, and caddy’s data are mapped to respective directories in the container. Docker will automatically create the respective directories on the server configured under the Volume section.
• ports tell the container to publish ports or a range of ports to the host.

Step 4 – Additional Vaultwarden Configuration

Disabling Registration

If you don’t want your Vaultwarden installation open for user registrations, you can disable it by adding the following variable under the environment section of the Docker compose file.
environment:
WEBSOCKET_ENABLED: "true" # Enable WebSocket notifications.
SIGNUPS_ALLOWED: "false"
....


Disable Invitations

Even after disabling user registrations, an existing user who is part of an organization can still invite new users. To stop that, use the following variable.
INVITATIONS_ALLOWED: "false"


Disable Password Hints

Vaultwarden sends password hints via email and also shows them on the password hint page. To disable the feature, set the value of the SHOW_PASSWORD_HINT variable.
SHOW_PASSWORD_HINT: "false"


Disabling Admin Panel

Vaultwarden hosts static files for its web interface. You can disable this by setting the following variable to false.
WEB_VAULT_ENABLED: "false"


You can override the Vault files by providing your static files to host by using the configuration under the volumes section in the Compose file.
volumes:
- ./vw-data:/data
- /path/to/static/files_directory:/web-vault


Vaultwarden Log

Vaultwarden logs only to standard output. You can configure it to log to a file.
LOG_FILE: "/data/vaultwarden.log"


To reduce the number of log messages, you can set the log level to warn while also setting the variable EXTENDED_LOGGING as true.
LOG_LEVEL: "warn"
EXTENDED_LOGGING: "true"


Step 5 – Create Caddy File for Vaultwarden

Now that we have configured Vaultwarden, let us create a caddy file for Vaultwarden and open it for editing.
$ nano Caddyfile


Paste the following code in it.
{$DOMAIN}:443 {
log {
level INFO
output file {$LOG_FILE} {
roll_size 10MB
roll_keep 10
}
}

# Proxy everything else to Rocket
reverse_proxy vaultwarden:80 {
# Send the true remote IP to Rocket, so that vaultwarden can put this in the
# log, so that fail2ban can ban the correct IP.
header_up X-Real-IP {remote_host}
}
}


Save the file by pressing Ctrl + X and entering Y when prompted.

Step 6 – Run Vaultwarden

Start the Vaultwarden Docker container.
$ docker compose up -d


You can check the status of the container using the following command.
$ docker ps


You will get a similar output.
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4ad23954f1d5 caddy:2 "caddy run --config …" About a minute ago Up About a minute 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 2019/tcp caddy
d55a037850bc vaultwarden/server:latest "/usr/bin/dumb-init …" About a minute ago Up About a minute (healthy) 80/tcp, 3012/tcp vaultwarden


Step 7 – Use Vaultwarden with Bitwarden Clients

Open the URL https://vaultwarden.example.com in your browser.

The first step is to create an account. Click the Create Account button to proceed.

Enter your account details and click the Submit button to proceed. You will be redirected to the login page. Enter your account details to log in.

You need to unlock your account’s full features by verifying your email. Click the Send Email button to send the verification mail.

You will get the following mail. Click the link to verify your email address.

Now that we have our Vaultwarden account ready, it is time to use it with a Bitwarden client. For our tutorial, we are using the Chrome extension. Install it by grabbing it from Bitwarden’s website.

Click on the extension icon to bring out the Vaultwarden sign-in screen.

Click the gear icon on the top left of the popup to bring the advanced settings page. Fill https://vaultwarden.example.com as the server URL.

Click the Save button to apply the setting. Log in with your Vaultwarden credentials to log in to the app.

Once logged in, you are taken to the app page and can start using Bitwarden.

Step 8 – Backup Vaultwarden

Vaultwarden stores its data in an SQLite database. One way is to simply copy the .sqlite3 file from the /vw-data folder. But it is not the recommended solution as the database won’t be in a consistent state due to Vaultwarden running. To backup in a reliable way, we will use the SQLite backup command.

Install sqlite3 package.
$ sudo apt install sqlite3


Create a directory for the backups.
$ mkdir ~/vw-backups


Remove the read, write and execute permissions from the group and other users.
$ chmod go-rwx ~/vw-backups


Create the Vaultwarden backups service file and open it for editing.
$ sudo nano /etc/systemd/system/vaultwarden-backup.service


Paste the following code in it.
[Unit] Description=backup the vaultwarden sqlite database

Save the file by pressing Ctrl + X and entering Y when prompted.

Start the service to test the service and take a backup.
$ sudo systemctl start vaultwarden-backup.service


Check if the backup file is present.
$ ls -l ~/vw-backups


You should see the listing for the backup file.
total 192
-rw-r--r-- 1 root root 196608 Jul 31 17:25 backup-2022-07-31T17_25_04+00_00.sqlite3


To create a regular schedule for the backups, create and open the systemd timer unit file. You need to make sure the file name matches the file name of the service.
$ sudo nano /etc/systemd/system/vaultwarden-backup.timer


Paste the following code in it.
[Unit] Description=schedule vaultwarden backups

Save the file by pressing Ctrl + X and entering Y when prompted. This will schedule the backup to occur at 4 am daily.

Start and enable the timer unit service.
$ sudo systemctl enable vaultwarden-backup.timer
$ sudo systemctl start vaultwarden-backup.timer


Check the status of the timer service.
$ systemctl status vaultwarden-backup.timer
? vaultwarden-backup.timer - schedule vaultwarden backups
Loaded: loaded (/etc/systemd/system/vaultwarden-backup.timer; enabled; vendor preset: enabled)
Active: active (waiting) since Sun 2022-07-31 17:27:03 UTC; 7s ago
Trigger: Mon 2022-08-01 04:00:00 UTC; 10h left
Triggers: ? vaultwarden-backup.service

Jul 31 17:27:03 vaultwarden systemd[1]: Started schedule vaultwarden backups.


This just backs up the data. You should make sure the database file is backed up regularly offsite or to your local system. To back up the remaining stuff, you can do so by copying everything under the ~/vaultwarden/vw-data folder. Of the remaining stuff, the attachments directory, the config.json file, and the rsa_key* files must be backed up. The sends and the icon_cache directories are optional and should be backed up if they are large enough and you need them. They are strictly optional.

Step 9 – Restore Vaultwarden

To restore the Vaultwarden data, make sure the container is stopped. You can replace everything under the data directory with its backed up version. When restoring the SQLite backup, make sure to delete the existing db.sqlite3-wal file to avoid corruption.

Step 10 – Update Vaultwarden

Upgrading Vaultwarden is a simple step. Switch to Vaultwarden’s Docker compose directory.
$ cd ~/vaultwarden


Next, stop and remove the existing container. Your data will be retained though.
$ docker compose down --remove-orphans


Pull the latest version of the Gitlab docker image.
$ docker compose pull


Start the containers again.
$ docker compose up -d


Your Vaultwarden installation is updated and started again.

Conclusion

This concludes our tutorial on installing and configuring Vaultwarden on a Ubuntu 22.04 server. If you have any questions, post them in the comments below.