Want your passwords in a vault you actually control? In this guide I’ll show you how to deploy Vaultwarden — a self-hosted Bitwarden-compatible password manager — as a Docker container with Tailscale for secure remote access. By the end, you’ll have your own private password vault running, and you’ll be able to install the official Bitwarden apps on your phone and laptop, pointing them to your own server instead of the cloud.
🎥 Watch the Video Tutorial
💡 Why Self-Hosted Vaultwarden?
Password managers are essential. But should you trust a company’s cloud with your master key?
Bitwarden is solid, but Vaultwarden is Bitwarden with one critical difference: your vault runs on your hardware, in your home lab, behind your firewall. You own the data. You control who can access it. You decide when it gets backed up.
The best part? Vaultwarden works with all official Bitwarden apps — Windows, Mac, Linux, iOS, Android. You point them to your self-hosted server instead of Bitwarden.com, log in with your master password, and everything works exactly the same.
It’s free, it’s lightweight, and it’s genuinely private.
🛠 What You’ll Need
- An Ubuntu Docker host (VM on Proxmox or bare metal) with Docker and Docker Compose installed
- Folder structure set up per my standard home lab layout (scripts, config, secrets directories)
- Tailscale account (free tier, for secure remote access)
- Tailscale auth key generated and ready to paste
- Familiarity with SSH, terminal commands, and Docker Compose
- Optional: Portainer for container visibility (not required, but helpful)
📋 Step-by-Step Setup
1. Generate Your Admin Token
SSH into your Docker host. You need an admin token to protect the Vaultwarden admin panel from unauthorized access. Generate one with:
openssl rand -hex 32
Copy the output — that’s your hashed VAULTWARDEN_ADMIN_TOKEN. You’ll use this in your environment variables.
2. Set Up Environment Variables
Create your .env file in your /media/docker/scripts/ folder with your timezone, domain, admin token, and Tailscale auth key.
Get your Tailscale auth key from Tailscale settings → Keys → Generate auth key (reusable, 90-day expiration).
3. Create the Docker Compose File
Create docker-compose.yml in your scripts/security folder with Vaultwarden and Tailscale services. The full file is available in my GitHub repository — grab it from there to save time.
4. Deploy Vaultwarden
Navigate to your cd /media/docker/scripts/security folder and run:
docker-compose up -d
Docker will pull the Vaultwarden and Tailscale images, create the network, and start both containers. This takes a few moments.
5. Enable Tailscale HTTPS
Once the containers are running, enable HTTPS via Tailscale’s certificate system:
docker exec -it ts-vaultwarden tailscale serve -bg http://127.0.0.1:80
Tailscale will generate an HTTPS certificate automatically. This takes a moment on first run.
6. Create Your First Account
Get your Tailscale URL from Tailscale’s dashboard:
https://vaultwarden.tailXXXX.ts.net
Navigate to this URL in your browser. You’ll see the Vaultwarden login screen. Click “Create account” and:
- Enter your email address
- Choose a very strong master password — this is the key to everything
- Add a password hint (optional)
- Check for data breaches (Vaultwarden can verify your password wasn’t leaked)
Once created, log in. You’ll see an empty vault ready for your passwords.
7. Install the Bitwarden App
Download the official Bitwarden app for your device:
- Browser Extension: Download here (Chrome, Firefox, Safari, Edge)
- Mobile: iOS and Android
- Desktop: Windows, Mac, Linux
When you first open the app, you’ll be asked for a server URL. Click “Self-hosted” and enter your Tailscale domain:
https://vaultwarden.tailXXXX.ts.net
Log in with your email and master password. The app will sync with your vault and you’re ready to save passwords.
8. Disable Sign-Ups (Optional, Recommended)
Once you’ve created all your accounts, disable future signups by setting SIGNUPS_ALLOWED=false in your environment variables, then restart:
docker-compose down && docker-compose up -d
This prevents unauthorized account creation.
🔐 Security Considerations
Do NOT expose Vaultwarden directly to the internet. Tailscale provides secure encrypted access without public exposure. If someone gains access to your Vaultwarden, they have all your passwords.
Best practices:
- Keep your
.envand secrets files private — don’t commit them to Git - Use a strong, unique admin token
- Regularly back up your
vw-datavolume - Only access Vaultwarden through Tailscale (never expose port 8084 directly)
- Keep Vaultwarden updated — Watchtower handles this automatically
- Use strong master passwords and enable breach checking
🚀 What’s Next?
Now you’ve got a self-hosted password vault. You can:
- Use it everywhere: Install the official Bitwarden app on every device and they all sync with your vault
- Share passwords with family: Create additional accounts for trusted family members
- Back it up: Export your vault regularly and store backups in a safe location
- Monitor it: Check the admin panel occasionally to verify everything’s working
✅ Conclusion
Vaultwarden gives you a truly private password vault. Your passwords run on your hardware, behind your firewall, accessible only through Tailscale’s encrypted tunnel. No subscription, no cloud company access, no dependency on anyone else’s infrastructure.
The setup is straightforward: generate an admin token, set environment variables, deploy with Docker Compose, and point your Bitwarden apps to your self-hosted server. Watchtower keeps it updated automatically. Tailscale handles secure remote access.
Your passwords are your attack surface. They shouldn’t depend on a cloud company. With Vaultwarden, they’re yours — and only yours.
📺 Watch the full video guide: https://youtu.be/MFyYz1jQQDo
If you found this helpful, like and subscribe to IT HomeLab Online on YouTube for more tutorials.
☕️ Support the channel: Patreon · Buy Me a Coffee