selfhost
← All apps

Vaultwarden

Store passwords and share credentials with your household.

Choose your deployment and the way you want to use Selfhost. The instructions below follow that choice.

Set up Vaultwarden

Editable Compose files in your own directory.

  • Create your vault accounts and configure SMTP as required, then disable general registration.
  • Set DOMAIN to the reachable vault URL before adding OIDC.
selfhost app --directory ./vaultwarden init vaultwarden

Initialization writes portable files and does not start the app. Review compose.yaml, the private .env and any files in files/, then start it: 

selfhost app --directory ./vaultwarden start

No Selfhost dashboard or background service is needed. You can also start these files directly: 

cd vaultwarden
docker compose -f compose.yaml up -d

Connect an existing installation

Use Existing apps → Link an app in the dashboard, or the CLI’s existing-app commands. Choose Vaultwarden, its URL and, optionally, its exact Docker container on a connected server.

Save existing.json with your app URL. Add server_id and container for container inspection and actions. 

{
  "profile": "vaultwarden",
  "name": "Vaultwarden",
  "url": "https://app.example.com"
}
selfhost existing link --file existing.json
selfhost existing list
selfhost existing inspect EXISTING_ID

Linking enables the existing-app profile’s supported inspection and actions. It does not import Compose or attach the new-deployment settings and onboarding profiles described below.

Existing app commands, permissions and unlinking

Before configuring integrations

  • SSO retains the master password and does not grant vault administration.
  • The SQLite action creates a database snapshot, not a complete vault backup.
  • Database placement includes PostgreSQL, MySQL and MariaDB using app-specific connection settings. Select a fresh or already migrated database before first start; changing the engine does not convert existing data.
  • Admin-page config.json settings override environment values; reconcile those before applying Selfhost settings.
  • Back up attachments, sends, RSA keys, configuration and the database together.
  • MySQL and MariaDB source bindings currently require TLS mode disable and a private network. Sources requiring TLS are rejected by these bindings; certificate-aware custom deployments remain manual. PostgreSQL retains its native TLS modes.

Vaultwarden integrations

Compose service: vaultwarden. These operations use the profile saved when this deployment is created.

  • Settings changed through Vaultwarden /admin are stored in /data/config.json and override these environment values. Reconcile those overrides in Vaultwarden before expecting a Selfhost edit or OIDC connection to take effect.
  • The SQLite snapshot action excludes attachments, sends, keys and configuration. Back up the complete data volume separately.

Native settings

Changes use the app’s Compose environment. Unrelated settings are preserved.

Supported fields (15)
Public vault URL domain
Set the externally reachable URL. Existing admin-page config.json overrides environment settings. string
Allow new registrations signups
Disable after creating your accounts; invitations remain available. stringChoices: true, false
Registration email domains signup-domains
Comma-separated domains allowed to register even when general registration is disabled. string
Require verified registration email verify-email
Configure SMTP before enabling. stringChoices: true, false
Administration token or Argon2 hash admin-token
Protects /admin. An Argon2 PHC hash is recommended. Keep a separate backup of this credential. secret
SMTP host smtp-host
string
Sender email smtp-from
string
SMTP username smtp-user
string
SMTP password smtp-password
secret
SMTP transport smtp-security
stringChoices: starttls, force_tls, off
Enable OpenID Connect sso-enabled
stringChoices: true, false
OIDC issuer sso-issuer
string
OIDC client ID sso-client
string
OIDC secret sso-secret
secret
Require SSO for sign-in sso-only
Keep disabled until your OIDC login has been tested. A vault master password is still required. stringChoices: true, false

Save a JSON map of the field IDs you want to change as changes.json. Replace FIELD_ID with an ID from the supported fields above, and use its declared value type. Review the plan and replace REVIEWED_REVISION with the revision it returns. 

{
  "FIELD_ID": "YOUR_VALUE"
}
selfhost app --directory ./vaultwarden config vaultwarden
selfhost app --directory ./vaultwarden plan vaultwarden changes.json
selfhost app --directory ./vaultwarden apply vaultwarden changes.json --revision REVIEWED_REVISION

Saved changes need service recreation to become active. Existing interpolated environment values stay under your control in .env or Compose.

Identity provider login

Selfhost can register a client with a supported provider and configure this app. Callback path: /identity/connect/oidc-signin.

No administrator role is assigned by Selfhost. Check the app’s first-login policy and retain a local recovery account.

Save connection.json and replace the URLs. Supply SELFHOST_IDP_TOKEN privately in your shell. 

{
  "provider": "zitadel",
  "issuer": "https://identity.example.com",
  "app_url": "https://app.example.com",
  "name": "Vaultwarden"
}
selfhost app --directory ./vaultwarden connect-account vaultwarden connection.json
selfhost app --directory ./vaultwarden connect-plan vaultwarden connection.json
selfhost app --directory ./vaultwarden connect vaultwarden connection.json --revision REVIEWED_REVISION

Test sign-in in a separate browser session. HTTPS domains and HTTP loopback development origins are supported by Selfhost; the chosen app and provider must also accept the resulting callback. Provider permissions, localhost and recovery.

Database placement

This recipe supports postgres, mysql, mariadb. Workspace projects can choose a dedicated database, a shared source with a separate database and account, or an existing external database before their first start.

  • postgres adapter TLS modes: disable, require, verify-full. Use a private network for connections with TLS disabled.
  • mysql adapter TLS modes: disable. Use a private network for connections with TLS disabled.
  • mariadb adapter TLS modes: disable. Use a private network for connections with TLS disabled.

Standalone directories use the generated Compose and environment files directly. Configure the database there before first start. Selfhost’s source provisioning commands belong to workspace projects and are optional.

Database setup, CLI commands and backups

App actions

Create SQLite snapshot

Create a consistent database snapshot in /data. This does not include attachments, sends, configuration or encryption keys, and does not back up external SQL databases. Copy the snapshot and all remaining data to independent storage.

selfhost app --directory ./vaultwarden action vaultwarden sqlite-backup

App configuration reference

Versions and updates

This deployment uses the following images. Existing projects retain their saved recipe and images. A new catalogue version does not silently update them.

  • vaultwarden: vaultwarden/server:1.37.3

Review compatibility and back up app data before an update. Choose an image version and review the change.

Keep control of your setup

Selfhost remains optional. Your app runs using ordinary Compose files, its own settings and persistent data. Keep the Compose project name and volumes to preserve storage. Configuration exports and setting backups do not include application data.

Standalone CLI guide · Backups and removal · Vaultwarden documentation

Built by Obiente. Your services, your configuration.

Licensed under AGPL-3.0-or-later.