How to Deploy Bitwarden with Docker for Self-Hosted Password Management

First, create a dedicated system user for Bitwarden to avoid running as root. This follows security best practices and prevents permission issues.

sudo useradd -r -m -d /opt/bitwarden -s /bin/false bitwarden
sudo mkdir -p /opt/bitwarden
sudo chown -R bitwarden:bitwarden /opt/bitwarden

Switch to the bitwarden user and navigate to the installation directory:

sudo -u bitwarden -s /bin/bash
cd /opt/bitwarden

Verify the user and directory setup:

whoami
pwd
ls -la /opt/bitwarden

You should see bitwarden as the current user and /opt/bitwarden as the current directory.

Download the official Bitwarden installation script. This script automates the Docker Compose setup and configuration process.

curl -Lso bitwarden.sh https://go.btwrdn.co/bw-sh
chmod 700 bitwarden.sh

Verify the script downloaded correctly:

ls -la bitwarden.sh
head -5 bitwarden.sh

You should see the script file with execute permissions and the beginning of the shell script content.

Before running the installation, you need to register your self-hosted instance with Bitwarden to get an Installation ID and Key. Visit https://bitwarden.com/host in your browser.

Fill out the registration form:

• Enter your admin email address
• Select your region (US or EU)
• Agree to the terms

Copy the Installation ID and Installation Key that are generated. You'll need these in the next step.

Store these values temporarily in environment variables for easy access:

export BW_INSTALLATION_ID="your-installation-id-here"
export BW_INSTALLATION_KEY="your-installation-key-here"

Execute the installation script to set up the initial configuration:

./bitwarden.sh install

The script will prompt you for several configuration values:

• Domain name: Enter your full domain (e.g., bitwarden.yourdomain.com)
• Let's Encrypt SSL: Choose 'y' for automatic SSL certificates
• Installation ID: Paste the ID from step 3
• Installation Key: Paste the key from step 3
• Database: Accept default (MSSQL) or specify PostgreSQL

The installation creates the directory structure and downloads Docker images:

ls -la bwdata/
ls -la bwdata/env/

Verify the installation created the necessary files:

find bwdata/ -name "*.yml" -o -name "*.env" | head -10

You should see docker-compose files and environment configuration files.

Edit the global environment configuration to customize your deployment:

nano bwdata/env/global.override.env

Add or modify these essential settings:

# Domain configuration
BW_DOMAIN=bitwarden.yourdomain.com

# Database settings (PostgreSQL example)
BW_DB_PROVIDER=postgresql
BW_DB_SERVER=db
BW_DB_DATABASE=bitwarden
BW_DB_USERNAME=bitwarden
BW_DB_PASSWORD=your-strong-database-password

# Installation credentials
BW_INSTALLATION_ID=your-installation-id
BW_INSTALLATION_KEY=your-installation-key

# SMTP configuration for email notifications
globalSettings__mail__smtp__host=smtp.yourdomain.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__username=bitwarden@yourdomain.com
globalSettings__mail__smtp__password=your-smtp-password

# Security settings
globalSettings__disableUserRegistration=true
globalSettings__requireHttps=true

Save the file and verify the configuration:

cat bwdata/env/global.override.env | grep -E "BW_DOMAIN|BW_DB_PROVIDER"

If you're using Let's Encrypt (recommended), ensure your domain DNS is properly configured and ports 80/443 are accessible. The installation script handles certificate generation automatically.

For custom SSL certificates, place them in the SSL directory:

mkdir -p bwdata/ssl/bitwarden.yourdomain.com/
# Copy your certificate files:
# cp your-cert.crt bwdata/ssl/bitwarden.yourdomain.com/certificate.crt
# cp your-private.key bwdata/ssl/bitwarden.yourdomain.com/private.key

Configure the nginx settings if needed:

nano bwdata/nginx/default.conf

Test the SSL configuration will work:

openssl s_client -connect bitwarden.yourdomain.com:443 -servername bitwarden.yourdomain.com < /dev/null

Start all Bitwarden services using the management script:

./bitwarden.sh start

Monitor the startup process and check container status:

docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
docker logs bitwarden-api
docker logs bitwarden-web

Verify all containers are running healthy:

docker ps | grep -E "bitwarden|postgres|mssql" | wc -l

You should see 6-8 containers running (web, api, identity, admin, icons, notifications, events, database).

Test the web interface by visiting your domain:

curl -I https://bitwarden.yourdomain.com
echo "Visit https://bitwarden.yourdomain.com in your browser"

The response should show HTTP 200 OK and you should see the Bitwarden login page in your browser.

Access the admin panel to create your first user account. Navigate to https://bitwarden.yourdomain.com/admin in your browser.

If admin registration is disabled, temporarily enable it:

echo "globalSettings__disableUserRegistration=false" >> bwdata/env/global.override.env
./bitwarden.sh restart

Create your admin account through the web interface, then immediately disable registration:

sed -i 's/globalSettings__disableUserRegistration=false/globalSettings__disableUserRegistration=true/' bwdata/env/global.override.env
./bitwarden.sh restart

Verify your account creation and admin access:

docker logs bitwarden-api | grep -i "user.*created"
docker logs bitwarden-identity | tail -20

Test login functionality by accessing the vault and creating a test entry to ensure everything works correctly.

Configure fail2ban to protect against brute force attacks:

sudo apt install fail2ban -y
sudo nano /etc/fail2ban/jail.local

Add Bitwarden-specific jail configuration:

[bitwarden]
enabled = true
port = 80,443
filter = bitwarden
logpath = /opt/bitwarden/bwdata/logs/api/*.txt
maxretry = 3
bantime = 3600
findtime = 600

Create the fail2ban filter:

sudo nano /etc/fail2ban/filter.d/bitwarden.conf

[Definition]
failregex = ^.*Invalid username or password.*.*$
ignoreregex =

Set up automated backups of the database and configuration:

mkdir -p /opt/bitwarden/backups
nano /opt/bitwarden/backup.sh

#!/bin/bash
BACKUP_DIR="/opt/bitwarden/backups"
DATE=$(date +%Y%m%d_%H%M%S)

# Backup database
docker exec bitwarden-db pg_dump -U bitwarden bitwarden > "$BACKUP_DIR/db_backup_$DATE.sql"

# Backup configuration
tar -czf "$BACKUP_DIR/config_backup_$DATE.tar.gz" -C /opt/bitwarden bwdata/env bwdata/ssl

# Keep only last 7 days of backups
find "$BACKUP_DIR" -name "*backup*" -mtime +7 -delete

Make the backup script executable and add to crontab:

chmod +x /opt/bitwarden/backup.sh
echo "0 2 * * * /opt/bitwarden/backup.sh" | crontab -

Verify the security configuration:

sudo fail2ban-client status bitwarden
ls -la /opt/bitwarden/backups/

Set up log rotation to prevent disk space issues:

sudo nano /etc/logrotate.d/bitwarden

/opt/bitwarden/bwdata/logs/*/*.txt {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

Create a health check script to monitor service status:

nano /opt/bitwarden/health-check.sh

#!/bin/bash
HEALTH_URL="https://bitwarden.yourdomain.com/alive"
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$HEALTH_URL")

if [ "$STATUS" != "200" ]; then
    echo "$(date): Bitwarden health check failed - HTTP $STATUS" >> /var/log/bitwarden-health.log
    # Optional: send alert email or restart services
    /opt/bitwarden/bitwarden.sh restart
else
    echo "$(date): Bitwarden health check passed" >> /var/log/bitwarden-health.log
fi

Set up the health check to run every 5 minutes:

chmod +x /opt/bitwarden/health-check.sh
echo "*/5 * * * * /opt/bitwarden/health-check.sh" | crontab -

Configure update notifications and create an update procedure:

nano /opt/bitwarden/update.sh

#!/bin/bash
echo "Starting Bitwarden update process..."
./bitwarden.sh updateself
./bitwarden.sh update
echo "Update completed. Checking service status..."
docker ps --format "table {{.Names}}\t{{.Status}}"
echo "Update log: $(date)" >> /opt/bitwarden/update.log

Verify monitoring setup:

chmod +x /opt/bitwarden/update.sh
tail -f /var/log/bitwarden-health.log &
./health-check.sh
kill %1