Install a Self-Hosted Bitwarden/Vaultwarden Password Vault on Debian 🌱

What is Bitwarden?

Bitwarden is a free and open-source password management service that stores sensitive information such as website credentials in an encrypted vault. The Bitwarden platform offers a variety of client applications including a web interface, desktop applications, browser extensions, mobile apps, and a CLI. Bitwarden offers a cloud-hosted service as well as the ability to deploy the solution on-premises. -

Install Bitwarden/Vaultwarden

  1. Log into the Linux device
  2. Run the following commands in a terminal window
    # update software repositories
    sudo apt update
    # install available software updates
    sudo apt upgrade -y
    # install prerequisites
    sudo apt install git curl build-essential pkg-config libssl-dev openssl libssl1.1 libmariadb-dev-compat libmariadb-dev -y
    # add nodejs software repository
    curl -sL | sudo bash -
    # install nodejs
    sudo apt install nodejs -y
    # install rust, enter 1 at the prompt
    curl -sSf | sudo sh
    # configure the shell
    source $HOME/.cargo/env
    # clone vaultwarden from git
    git clone ./vaultwarden
    # cd into the new directory
    cd vaultwarden/
    # checkout latest version
    git checkout "$(git tag --sort=v:refname | tail -n1)"
    # build vaultwarden with mysql support
    cargo build --features mysql,sqlite --release
    # cd back one directory
    cd ..
    # clone web from git
    git clone ./web
    # cd into the new web
    cd web/
    # checkout the latest version
    git checkout "$(git tag --sort=v:refname | tail -n1)"
    # update submodule
    git submodule update --init --recursive
    # download web patch
    wget$(git tag --sort=v:refname | tail -n1).patch
    # apply patch
    git apply $(git tag --sort=v:refname | tail -n1).patch --verbose
    # clean npm cache
    npm cache clean --force
    # initialize npm
    npm run sub:init
    # install npm dependencies
    npm install
    # fix npm vulnerabilities
    npm audit fix
    # build web vault
    npm run dist:bit:selfhost
    # copy the build directory into vaultwarden/web-vault
    cp -a build ../vaultwarden/target/release/web-vault
    # cd into vaultwarden
    cd ../vaultwarden/target/release/
    # create a data directory
    mkdir data
    # run vaultwarden
  3. Open a web browser and navigate to https://DNSorIP:8000
  4. Click the Create Account button
  5. Complete the form by entering an Email Address, Name, Master Password and Password Hint (optional) > Click Submit
  6. Login with the account created in the last step
  7. Welcome to your self-hosted Bitwarden password vault

Run Bitwarden/Vaultwarden as a Service (Optional, but recommended)

  1. Press CTRL + C to kill the running Vaultwarden process
  2. Continue with the following steps to run Vaultwarden as a service
    # cd to vaultwarden/target/release
    cd ~/vaultwarden/target/release
    # copy the .env template
    sudo cp ../../.env.template /etc/vaultwarden.env
    # copy vaultwarden executable
    sudo cp vaultwarden /usr/bin/vaultwarden
    # make vaultwarden executable
    sudo chmod +x /usr/bin/vaultwarden
    # create vaultwarden user
    sudo useradd -m -d /var/lib/vaultwarden vaultwarden
    # copy existing data directory
    sudo cp -R data /var/lib/vaultwarden/
    # copy web-vault directory
    sudo cp -R web-vault /var/lib/vaultwarden/
    # set ownership permissions
    sudo chown -R vaultwarden:vaultwarden /var/lib/vaultwarden
    # create service file
    sudo nano /etc/systemd/system/vaultwarden.service
  3. Paste the following configuration into vaultwarden.service

    Description=Vaultwarden Server

    # Only sqlite



  4. Press CTRL+O, Enter, CTRL+X to write the changes to vaultwarden.service
  5. Continue with the following commands to enable the site and start vaultwarden:
    # reload systemd services
    sudo systemctl daemon-reload
    # start vaultwarden service on boot and now
    sudo systemctl enable vaultwarden --now
  6. Refresh the open web browser to verify Bitwarden is accessible