Self-Hosted Bitwarden Docker: The Real Cost
Your password manager should cost less than your coffee. But DIY self-hosted Bitwarden looks cheaper than it is. Let's do the math on setup, security hardening, and the ops burden, plus show you when managed hosting wins.
Three Paths to a Self-Hosted Password Vault
Vaultwarden is an unofficial, lightweight Rust-based implementation of Bitwarden. It runs on Docker, uses 50 MB RAM (vs 4+ GB for official Bitwarden), and includes premium features for free: TOTP, emergency access, attachments, everything.
So why don't more people run it? Because the sticker price ($4.50/month for a Hetzner CX22 VPS) doesn't include the real costs: setup time, SSL certificate management, security hardening, backup testing, and ongoing maintenance.
Here are your three realistic options:
Option 1: Official Bitwarden Cloud Free tier: 1 user, unlimited passwords. Families plan: $3.33/month (6 users, annual billing). All updates, backups, and security handled by Bitwarden Inc. No ops burden.
Option 2: DIY Vaultwarden on Docker You manage everything. Setup: 45 minutes plus a reverse proxy (Caddy or Nginx) plus SSL cert (Let's Encrypt) plus security hardening (disable signups, set admin token, firewall). Ongoing: system updates, Docker updates, Vaultwarden updates, backup verification, failure recovery planning. True cost: $4.50/month VPS plus $1,700-2,000/year in labor and risk.
Option 3: Managed Vaultwarden (Opsily) Vaultwarden with zero ops. We handle Docker, SSL, updates, backups, monitoring, security hardening. You get a password vault that just works. No hidden maintenance cost.
Why Managed Vaultwarden Makes Sense
Enterprise-grade infrastructure without the complexity
Zero ops overhead
We manage updates, backups, SSL renewal, firewall rules, and security patching. You never ssh into a server. You never wonder if backups are working. You never stay up at night wondering if a zero-day matters to you.
Predictable managed Docker costs
Vaultwarden on a VPS costs $4.50/month plus $1,700-2,000/year in your own labor. Managed hosting costs one flat rate, all-in. No spreadsheet required. No hidden cleanup after you deploy.
EU data residency
Your vault stays in ISO 27001-certified German data centers. GDPR compliant. No data leaves the EU. Full control over where your passwords live.
Docker Setup: The Short Version
If you decide to self-host anyway, here's the path.
Step 1: Choose a VPS Hetzner CX22 ARM (EUR 3.29/month) or DigitalOcean Standard (USD 4/month). Both support Docker. Skip free tiers; a password vault needs reliability.
Step 2: Install Docker and Vaultwarden One of two approaches:
- Single container:
docker runwith environment variables (fast, simpler) - Docker Compose: YAML file defining the stack (easier to manage updates, backups)
Most guides use docker-compose. Set up a compose.yml, point to a reverse proxy, restart Vaultwarden when you need to.
Step 3: Reverse Proxy and SSL
Vaultwarden doesn't handle HTTPS itself. You need Caddy (recommended, automatic cert renewal) or Nginx (more control, more work). Point vault.yourdomain.com to your VPS, let Caddy fetch a Let's Encrypt certificate, done.
Step 4: Security Hardening This is non-negotiable:
- Disable open user registration immediately after creating your first account. Without this, anyone on the internet can sign up and use your vault.
- Set a strong admin token (ADMIN_TOKEN in env). Anyone with this token can reset your master password.
- Configure your firewall to allow only ports 443 (HTTPS) and 22 (SSH) from trusted IPs.
- Set up offsite backups. Test restoring from a backup. Test it again.
The Maintenance Cost of DIY
Setup is the easy part. Maintenance is the cost.
Every month:
- Docker releases security updates. You apply them manually.
- Vaultwarden releases updates. You test on a staging instance, then deploy.
- Ubuntu or your Linux distro releases kernel patches. You schedule maintenance windows.
Every quarter:
- You test a full restore from your backup. (If you haven't tested this, you don't have backups.)
- You review your firewall rules. Are there ports open you forgot about?
- You check disk usage. Are logs filling up? Is the database bloating?
Once a year:
- You audit what you're paying for and what you're actually using.
- You review the security audit reports from Vaultwarden's GitHub. Are there issues you need to patch urgently?
- You plan for hardware refresh or server migration. What if your VPS provider drops your plan or raises prices?
If anything breaks (power loss, disk full, corrupted database, DDoS), you troubleshoot it at 2am. While your team can't access their passwords.
Managed hosting absorbs all of this. We own the maintenance calendar. You own the vault.
Built for Privacy and Compliance
GDPR Compliant
Your vault data stays in EU data centers. Full GDPR compliance. No data transfers outside the EU.
Encrypted Backups
Nightly encrypted backups. Your data is encrypted at rest and in transit. We cannot read your vault.
Automated Updates
Security patches and feature updates applied automatically. No manual intervention required.
24/7 Monitoring
Your vault is monitored around the clock. If something fails, we fix it before you notice.
Frequently Asked Questions
Official Bitwarden self-hosted is a .NET-based server that requires 4+ GB RAM, multiple Docker containers, and significant resources. Vaultwarden is an unofficial Rust-based implementation that runs on 50 MB RAM in a single container. Both are compatible with all official Bitwarden clients (browser, mobile, desktop). Vaultwarden includes premium features (TOTP, emergency access, attachments) for free. The trade-off: Vaultwarden lacks enterprise features (SSO, directory sync, advanced policies), which most individual and small-team users don't need. Choose Bitwarden if you need enterprise features and don't mind the resource cost. Choose Vaultwarden if you want lightweight, feature-rich, and free.
Let Opsily Handle the Ops
Stop managing a password vault. Start just using one.