Deployment examples

This page is an index of standalone deployment examples. If adding a new example, please create a new category if appropriate, and keep things organized in general.

Google Cloud

• https://github.com/dadatuputi/bitwarden_gcloud

  Vaultwarden installation optimized for Google Cloud's 'always free' e2-micro compute instance

Heroku

• https://github.com/davidjameshowell/vaultwarden_heroku

  Installs vaultwarden on Heroku using all free addons. Takes about 15 minutes to install.

Fly.io

• https://github.com/nosovk/vaultwarden-fly-io/blob/main/fly.toml

Installs vaultwarden with SQLite database. But you need to create volume for database flyctl volumes create vaultwarden_data -a [your app name] -s 1

Kubernetes

• https://github.com/icicimov/kubernetes-bitwarden_rs

  Sets up a fully functional and secure vaultwarden application in Kubernetes behind nginx-ingress-controller and AWS ELBv1. It provides a little bit more than just simple deployment but you can use all or just part of the manifests depending on your needs and setup.

• https://github.com/Skeen/helm-bitwarden_rs

  Sets up a fully functional and secure vaultwarden application in Kubernetes behind an nginx controller of your choice. It works well and is tested with the microk8s setup. There is support for generating SSL certificates via cert-manager too.

• https://github.com/guerzon/vaultwarden

  Deploy Vaultwarden to Kubernetes clusters using Helm. This chart supports important customizations such as providing image tags and custom registry values, using an external MySQL or PostgreSQL database, using ingress controllers such as nginx-ingress and AWS LB Ingress Controller, using service accounts, configuring SMTP, and configuring storage options. The chart is well-documented and will continue to introduce more configuration options in the future.

Raspberry Pi

• https://github.com/martient/vaultwarden-ansible

  Ansible deployment for vaultwarden on raspberry pi, for migrate from the previous configuration, follow the guides linked on the page.

• https://dietpi.com/

  DietPi is a lightweight Debian-based distribution (image) for all kinds of devices like Raspberry Pi, Odroid, NanoPi and others. It offers a software script for installing various programs including Vaultwarden. That spares the user tinkering with installation commands.

  More information about the installation process and first access to Vaultwarden on DietPi can be found at https://dietpi.com/docs/software/cloud/#vaultwarden

Shared hosting

• https://github.com/jjlin/vaultwarden-shared-hosting

  Sample config for running vaultwarden on DreamHost, but should be readily adaptable to many other shared hosting services.

https://lab.uberspace.de/guide_vaultwarden.html?highlight=bitwarden

Instructions on how to install from source and run on Uberspace shared hosting provider.

NixOS (by tklitschi)

There's a example bitwarden config for NixOS. It's not very complex, you have the backend option, for the type of Database you wanna use, the Backupdir for a dedicated Backup systemdserive, the option to enable it and the config Option. For the Config Option you simply pass the .env Variables from the .env template in nix syntax. Secrets ( SMTP_PASSWORD,... ) store inside another .env file outside /nix/store and include by services.vaultwarden.environmentFile See Proxy Examples for a nixos-nginx example config.

Example Config

{ pkgs, ... }:
{
  services.bitwarden_rs = {
    enable = true;
    backupDir = "/mnt/bitwarden";
    config = {
      WEB_VAULT_FOLDER = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
      WEB_VAULT_ENABLED = true;
      LOG_FILE = "/var/log/bitwarden";
      WEBSOCKET_ENABLED = true;
      WEBSOCKET_ADDRESS = "0.0.0.0";
      WEBSOCKET_PORT = 3012;
      SIGNUPS_VERIFY = true;
 #    ADMIN_TOKEN = (import /etc/nixos/secret/bitwarden.nix).ADMIN_TOKEN;
      DOMAIN = "https://exmaple.com";
 #    YUBICO_CLIENT_ID = (import /etc/nixos/secret/bitwarden.nix).YUBICO_CLIENT_ID;
 #    YUBICO_SECRET_KEY = (import /etc/nixos/secret/bitwarden.nix).YUBICO_SECRET_KEY;
      YUBICO_SERVER = "https://api.yubico.com/wsapi/2.0/verify";
      SMTP_HOST = "mx.example.com";
      SMTP_FROM = "[email protected]";
      SMTP_FROM_NAME = "Bitwarden_RS";
      SMTP_PORT = 587;
      SMTP_SSL = true;
#     SMTP_USERNAME = (import /etc/nixos/secret/bitwarden.nix).SMTP_USERNAME;
#     SMTP_PASSWORD = (import /etc/nixos/secret/bitwarden.nix).SMTP_PASSWORD;
      SMTP_TIMEOUT = 15;
      ROCKET_PORT = 8812;
    };
    environmentFile = "/etc/nixos/secret/bitwarden.env";
  };
}

If you have any Questions about this part, feel Free to contact me. I on @litschi:litschi.xyz on matrix an litschi on IRC (hackint and freenode) or simply ask in the vaultwarden matrix.org chanel.

QNAP NAS (ARM and x86)

• https://github.com/umireon/vaultwarden-qnap

You can install Vaultwarden into your secure network-attached storage (NAS) with Let's Encrypt. Due to the QNAP's built-in HTTP(S) server, you cannot publish Vaultwarden on the standard HTTP(S) port (80 / 443).

Dokku

This is a script that automatically sets up vaultwarden using the docker image uploaded to DockerHub and creates a Dokku app. The script assumes you have a global domain set up (i.e. the file /home/dokku/VHOST exists). Follow the prompts to set it up.

#!/usr/bin/env bash

set -euo pipefail

APPNAME=""

read -rp "Enter the name of the app: " APPNAME

# check if app name is empty
if [ -z "$APPNAME" ]; then
    echo "App name empty. Using default name: vaultwarden"
    APPNAME="vaultwarden"
fi

# check if dokku plugin exists
if ! dokku plugin:list | grep letsencrypt; then
    sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git
fi
# check if global email for letsencrypt is set
if ! dokku config:get --global DOKKU_LETSENCRYPT_EMAIL; then
    read -rp "Enter email address for letsencrypt: " EMAIL
    dokku config:set --global DOKKU_LETSENCRYPT_EMAIL="$EMAIL"
fi

# pull the latest image
IMAGE_NAME="vaultwarden/server"
docker pull $IMAGE_NAME
image_sha="$(docker inspect --format='{{index .RepoDigests 0}}' $IMAGE_NAME)"
echo "Calculated image sha: $image_sha"
dokku apps:create "$APPNAME"
dokku storage:ensure-directory "$APPNAME"
dokku storage:mount "$APPNAME" /var/lib/dokku/data/storage/"$APPNAME":/data
dokku domains:add $APPNAME $APPNAME."$(cat /home/dokku/VHOST)"
dokku letsencrypt:enable "$APPNAME"
dokku proxy:ports-add "$APPNAME" http:80:80
dokku proxy:ports-add "$APPNAME" https:443:80
dokku proxy:ports-remove "$APPNAME" http:80:5000
dokku proxy:ports-remove "$APPNAME" https:443:5000
dokku git:from-image "$APPNAME" "$image_sha"

Copy the above script to your dokku host and run it. Once the script succeeds, the web vault will be available at https://$APPNAME.dokku.me.

To update your vaultwarden server, run the following (remembering to replace $APP_NAME with your app's name):

docker rmi -f vaultwarden/server
docker pull vaultwarden/server:latest
image_sha="$(docker inspect --format='{{index .RepoDigests 0}}' vaultwarden/server)"
dokku git:from-image $APP_NAME $image_sha

Azure

• https://github.com/adamhnat/vaultwarden-azure

  Vaultwarden installation optimized for Azure Container App service with fileshare for data

Digital Ocean

• https://github.com/HarrisonLeach1/vaultwarden_digitalocean

  Vaultwarden installation for Digital Ocean's cheapest droplet. Resources setup via terraform