Vaultwarden

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size for personal and small-team vaults.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web-vault. Also allow 443/tcp once you terminate TLS (see Enabling HTTPS). The Bitwarden web-vault requires a secure context to create accounts and unlock vaults.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Vaultwarden by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:vaultwarden-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name vaultwarden \
  --image sac1647283583153:vaultwarden-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name vaultwarden --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name vaultwarden --port 443 --priority 1011

Step 3 - Connect to your VM

Connect to the VM over SSH as the administrator user you created:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Vaultwarden and nginx are active. systemd manages both and starts them automatically on boot:

systemctl is-active vaultwarden nginx

The Vaultwarden server binds to the loopback interface on port 8000. nginx listens on port 80 and reverse-proxies to it, and it upgrades the WebSocket notifications endpoint:

sudo ss -tlnp | grep -E ':80 |:8000 '

The liveness endpoint is open and returns HTTP 200 when the server is healthy:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/alive

Step 5 - Retrieve your admin token

On the first boot of every VM, a one-shot service (vaultwarden-firstboot.service) generates a fresh admin token that is unique to that VM. It stores only the token's argon2id hash in the server configuration and writes the plaintext token to a root-only file.

The SQLite database ships empty, so no users, vaults or shared credentials are baked into the image. Read the credentials file:

sudo cat /root/vaultwarden-credentials.txt

The file contains the web-vault URL, the admin panel URL and the admin token:

vaultwarden.url=http://<vm-public-ip>/ vaultwarden.admin.url=http://<vm-public-ip>/admin vaultwarden.admin.token=<your-per-instance-token>

Step 6 - Sign in to the web-vault

Browse to https://<vm-public-ip>/ after you enable HTTPS. The Bitwarden-compatible web-vault sign-in page opens.

Open registration is enabled on the fresh image so the first administrator can create an account. Click Create account, enter an email address and a name, and choose a strong master password.

Your master password is the key to your vault. Vaultwarden never stores it and cannot recover it, so keep it safe. Once your account exists, install the Bitwarden client of your choice and sync your vault across every device.

Lock down registration once your accounts exist. Open signups are convenient for the first launch but should be disabled afterwards. See Managing signups, or toggle it from the admin panel.

Step 7 - Open the admin diagnostics panel

Vaultwarden ships an admin diagnostics panel at /admin, protected by the per-VM admin token. Browse to http://<vm-public-ip>/admin and paste the token from /root/vaultwarden-credentials.txt.

The panel gives you the diagnostics, user management and settings pages. From here you can confirm the installed server and web-vault versions, invite users, manage organisations and toggle open registration at runtime.

Step 8 - Connect Bitwarden clients

Vaultwarden speaks the Bitwarden API, so the official Bitwarden apps work against it directly:

• Install the Bitwarden desktop, mobile, CLI or browser-extension client.
• Before you log in, open the client's Settings (the gear or region selector on the login screen). Set the Server URL (self-hosted environment) to your VM, for example https://vault.example.com.
• Log in with the email and master password you created in the web-vault. Your vault now syncs through your own server.

Managing signups

The signup policy lives in the server environment file. To disable open registration after your accounts are created:

sudo sed -i 's/^SIGNUPS_ALLOWED=.*/SIGNUPS_ALLOWED=false/' /etc/vaultwarden/vaultwarden.env
sudo systemctl restart vaultwarden

To re-enable open registration, set the value back to true and restart the service, as shown below. You can also invite specific users from the admin panel without opening registration to everyone.

sudo sed -i 's/^SIGNUPS_ALLOWED=.*/SIGNUPS_ALLOWED=true/' /etc/vaultwarden/vaultwarden.env
sudo systemctl restart vaultwarden

Enabling HTTPS

The image serves the web-vault over plain HTTP on port 80 so you can reach it immediately. However, the Bitwarden web-vault requires a secure context (HTTPS) to create accounts and unlock vaults. Always run a password manager over TLS in production. nginx ships ready to terminate TLS on port 443.

The simplest route is a free Let's Encrypt certificate from Certbot, once you have a DNS name pointing at the VM's public IP. Install Certbot and obtain a certificate for your domain, replacing the example hostname with your real one:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot installs the certificate, rewrites the nginx server block to listen on 443 with TLS, and sets up automatic renewal. When it completes, browse to https://your-domain.example.com/ and create your account.

Data and backups

The SQLite database, attachments and sends live under /var/lib/vaultwarden. This is a dedicated, independently resizable Azure data disk, separate from the operating-system disk:

df -h /var/lib/vaultwarden

Snapshot that disk in Azure to back up your vault on a schedule. The admin panel also offers an on-demand Backup Database action.

Keep the OS patched with sudo apt update && sudo apt upgrade. Restart the server cleanly with sudo systemctl restart vaultwarden.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with deployment, upgrades, TLS termination, backups and Bitwarden client onboarding.

Vaultwarden and Bitwarden are trademarks of their respective owners. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Vaultwarden on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant. On Ubuntu 24.04, the SSH login user is ubuntu:

ssh ubuntu@<instance-public-ip>

nginx serves the web-vault on port 80. Browse to http://<instance-public-ip>/ to reach it.

For production, enable HTTPS (see Enabling HTTPS below). The Bitwarden web-vault requires a secure context to create accounts and unlock vaults.

First-boot credentials

On the first boot of every instance, a one-shot service (vaultwarden-firstboot.service) generates a fresh admin token that is unique to that instance. It stores only the token's argon2id hash in the server configuration and writes the plaintext token to a root-only file.

The SQLite database ships empty, so no users, vaults or shared credentials are baked into the image. Retrieve the admin token and URLs:

sudo cat /root/vaultwarden-credentials.txt

The file contains the web-vault URL, the admin panel URL and the admin token:

vaultwarden.url=http://<instance-public-ip>/ vaultwarden.admin.url=http://<instance-public-ip>/admin vaultwarden.admin.token=<your-per-instance-token>

Verifying the service

systemd manages Vaultwarden and nginx and starts them automatically on boot. Confirm that both are active:

systemctl is-active vaultwarden nginx

The Vaultwarden server binds to the loopback interface on port 8000. nginx listens on port 80 and reverse-proxies to it, and it upgrades the WebSocket notifications endpoint:

sudo ss -tlnp | grep -E ':80 |:8000 '

The liveness endpoint is open and returns HTTP 200 when the server is healthy:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/alive

Signing in to the web-vault

Browse to https://<instance-public-ip>/ after you enable HTTPS. The Bitwarden-compatible web-vault sign-in page opens.

Open registration is enabled on the fresh image so the first administrator can create an account. Click Create account, enter an email address and a name, and choose a strong master password.

Your master password is the key to your vault. Vaultwarden never stores it and cannot recover it, so keep it safe. Once your account exists, install the Bitwarden client of your choice and sync your vault across every device.

Lock down registration once your accounts exist. Open signups are convenient for the first launch but should be disabled afterwards. Set SIGNUPS_ALLOWED=false in /etc/vaultwarden/vaultwarden.env and restart the service (see Managing signups), or toggle it from the admin panel.

The admin diagnostics panel

Vaultwarden ships an admin diagnostics panel at /admin, protected by the per-instance admin token. Browse to http://<instance-public-ip>/admin and paste the token from /root/vaultwarden-credentials.txt. The panel gives you the diagnostics, user management and settings pages.

From here you can confirm the installed server and web-vault versions, invite users, manage organisations, review the reverse-proxy configuration and toggle open registration at runtime.

Connecting Bitwarden clients

Vaultwarden speaks the Bitwarden API, so the official Bitwarden apps work against it directly:

• Install the Bitwarden desktop, mobile, CLI or browser-extension client.
• Before you log in, open the client's Settings (the gear or region selector on the login screen). Set the Server URL (self-hosted environment) to your instance, for example https://vault.example.com.
• Log in with the email and master password you created in the web-vault. Your vault now syncs through your own server.

Managing signups

The signup policy lives in the server environment file. To disable open registration after your accounts are created:

sudo sed -i 's/^SIGNUPS_ALLOWED=.*/SIGNUPS_ALLOWED=false/' /etc/vaultwarden/vaultwarden.env
sudo systemctl restart vaultwarden

To re-enable open registration, set the value back to true and restart the service. You can also invite specific users from the admin panel without opening registration to everyone.

Enabling HTTPS

The image serves the web-vault over plain HTTP on port 80 so you can reach it immediately. However, the Bitwarden web-vault requires a secure context (HTTPS) to create accounts and unlock vaults. Always run a password manager over TLS in production. The image opens port 443 in its security group and ships nginx ready to terminate TLS.

The simplest route is a free Let's Encrypt certificate from Certbot, once you have a DNS name pointing at the instance's public IP. Install Certbot and obtain a certificate for your domain, replacing the example hostname with your real one:

sudo snap install --classic certbot
sudo certbot --nginx -d your-domain.example.com

Certbot installs the certificate, rewrites the nginx server block to listen on 443 with TLS, and sets up automatic renewal. When it completes, browse to https://your-domain.example.com/ and create your account.

Data and backups

The SQLite database and all attachments live under /var/lib/vaultwarden. This is a dedicated, independently resizable EBS volume, separate from the operating-system disk:

df -h /var/lib/vaultwarden

Back up the whole /var/lib/vaultwarden directory on a schedule, or take an EBS snapshot of the volume. The admin panel also offers an on-demand Backup Database action.

Support

SecureAnyCloud provides 24/7 technical support for this image, covering deployment, upgrades, TLS termination, backups and client onboarding. Contact us at sales@secureanycloud.com.

Vaultwarden and Bitwarden are trademarks of their respective owners. Use of the names does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Vaultwarden with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com