My password vault runs on a box in my house now. Every credential I have syncs to my phone and my browser the same way it did when I paid Bitwarden for it, except the encrypted database lives on hardware I can walk over and touch.
That sentence is either reassuring or terrifying depending on how you feel about being your own backup department, and I want to be honest about both.
What it actually is
Vaultwarden is a reimplementation of the Bitwarden server in Rust. It speaks the same API as the official server, which is the whole point: the official Bitwarden browser extension, the mobile app, and the desktop client all work against it unchanged. You point them at your own server URL instead of bitwarden.com and they cannot tell the difference. The clients stay official and audited. Only the server is swapped.
The reason to run Vaultwarden instead of the official self-hosted Bitwarden server is footprint. The official server is a stack of containers and wants a real chunk of RAM. Vaultwarden is a single process with a SQLite database, sitting at around 50 MB resident. It runs in a Docker container inside an LXC on my cluster and I mostly forget it exists. It lives behind Traefik, which terminates TLS, so the clients reach it at https://vault.hm.example.com with a proper certificate.
The part that is not optional
Here is where self-hosting a vault stops being a fun weekend project and becomes a responsibility. That SQLite file, db.sqlite3, is the vault. Not a cache of it, not a copy, the actual encrypted store of every password I have. If I lose it and have no backup, I have locked myself out of my own life. Bitwarden's hosted service handles this with geo-redundant storage across regions. When you self-host, that is now your job.
So the backup discipline came before I trusted a single real password to it. Proxmox Backup Server takes a daily snapshot of the whole container. That covers hardware failure, a bad upgrade, a fat-fingered delete. It does not cover the house burning down, and a backup that only exists in the same building as the original is one accident away from not existing. The next step, and the one that actually brings this to parity with a hosted service, is an encrypted off-site copy. I am pushing the backup to Backblaze B2 through rclone with client-side encryption, so the copy that leaves the house is already ciphertext before it hits the wire and I hold the only key.
Why it is not behind my SSO
I run Authelia in front of most of my internal services, and Vaultwarden is deliberately not one of them. The Bitwarden browser extension and mobile app talk to the server's API directly on every sync. A forward-auth proxy answers unauthenticated requests with an HTML login page, which the extension has no idea what to do with, so it just fails to sync.
Vaultwarden does not need Authelia in front of it anyway. The vault is end-to-end encrypted with a master password the server never sees, admin registration is disabled, and Bitwarden's own brute-force throttle is on. Wrapping it in a second login would break the clients to protect data that is already encrypted at rest with a key I never upload.
The tradeoff, stated plainly
I traded roughly $40 a year and Bitwarden's geo-redundant infrastructure for full control of where my most sensitive data lives, at the cost of owning the backup risk myself. That trade is only worth it if the backup discipline is real. A self-hosted vault with no off-site copy is not cheaper than Bitwarden, it is just riskier and free, which is a bad deal dressed up as a good one.
Paired with daily PBS snapshots and an encrypted off-site copy, I am comfortable calling it parity. The vault is mine, the clients are the same ones I already trusted, and the only thing I added was the obligation to take backups seriously.
A note on the addresses
The internal hostname in this post, vault.hm.example.com, is a documentation placeholder on a reserved example domain, not the real name on my network. Any IP addresses elsewhere in this series use the ranges set aside for documentation. The architecture is real. The specific names and addresses are stand-ins on purpose, so nothing here maps to a live target.
