Hosting Vaultwarden: on your own VPS or one-click, hosted in Germany (EU)

What Vaultwarden is

Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. Official Bitwarden clients (browser, desktop, mobile) talk to it the same way they talk to bitwarden.com: your vault stays on your instance. It is open source on GitHub; this guide is about self-hosting or ordering a third-party one-click container in Germany, not about the official Bitwarden cloud product.

If you or your users are in the EU, one point matters immediately: a password vault holds credentials and often notes that relate to identifiable people and organisations. Hosting location, access control, backups and who can register on the public URL are part of that risk, not optional extras.

Option 1: self-host Vaultwarden on a VPS

Everything below is grounded in the project wiki and image as read on 6 November 2026 (dani-garcia/vaultwarden (GitHub), Vaultwarden Wiki, Wiki: Configuration overview, Wiki: Using Docker Compose, Wiki: Enabling HTTPS). Releases move; check the wiki again before you install.

What you actually need

• Docker (or Compose) plus a reverse proxy with real TLS. Bitwarden clients expect HTTPS. The usual path is the official image behind Caddy or nginx: see Wiki: Using Docker Compose and Wiki: Enabling HTTPS.
• Set DOMAIN to the public HTTPS URL. Wrong or HTTP-only DOMAIN breaks clients and websocket notifications in ways that look like random sync failures.
• 1 GiB of RAM is genuinely enough for personal or small-team use with SQLite. Vaultwarden is one of the few self-hosted apps where a tiny VPS is not wishful thinking: disk for attachments matters more than CPU.
• Close signups after you are in. Prefer SIGNUPS_ALLOWED=false (and invitation-only if you need more users) so a public URL is not an open registration form for strangers.
• Hash the admin token. Generate an admin token, hash it as the wiki describes, put the hash in the environment, and keep the raw token offline. A plaintext token in Compose is a standing invite to the admin panel.

The mistakes that hurt later

Our longer hands-on walkthrough (Compose, Caddy HTTPS, the NAT IPv4 port trap, hashing the admin token, and why “mostly working” is not good enough for a vault) is in Self-host Vaultwarden on a VPS. The short version: install is easy; the pain later is HTTP-only access, open signups, an unhashed admin token, or backups that never restore-tested the SQLite file and attachments volume together.

Realistic effort

If you already run Docker, a reverse proxy and TLS, bringing Vaultwarden up is the easy part. Ongoing work decides it: image updates and version pinning, off-server backups of the database and attachments, certificate renewal, and someone responsible when the vault is down. If you enjoy that, self-hosting is the cheapest option. If you would rather not own it, that is what one-click hosting is for.

Option 2: one-click Vaultwarden in Germany

Full disclosure: this is what we sell. If you want Vaultwarden without running a server, we host an isolated instance for you. As listed in the shop on 6 November 2026:

Shop description, verbatim: “Your own Bitwarden-compatible password manager on an isolated instance. Runs as a persistent container. Hosted in Germany (EU); memory and CPU are capped by the container runtime.” Region chip: Germany Available. Price shown: € 4.00 / mo. Access details arrive by e-mail after provisioning. Monthly billing in EUR, USD or GBP; pay by card or SEPA bank transfer. All prices are final totals under the German small-business rule (§19 UStG); no VAT is shown.

This app runs in the EU region (Germany) of the overnight.host network. Our VPS, game server, voice and web plans run in the US (Dallas, TX and Charlotte, NC), with more regions planned.

One-click apps sit under a hostname on apps.overnight.host with a real wildcard certificate (as described on the automation / apps overview). You get the app and a URL, not a root shell.

Self-host vs. one-click at a glance

Short GDPR checklist

• DPA (Art. 28 GDPR) with whoever hosts the instance: your VPS provider or us (ask by e-mail before ordering if you need a written AVV).
• Vault contents are sensitive. Treat who may register, who is admin, and how restores work as part of access control, not as an afterthought.
• Device clients sync copies. Phones and browsers hold vault data under Bitwarden client rules; lost devices and shared family plans are still your side of the control.
• Record of processing (Art. 30) if the vault serves a business or organisation, including where backups live.

This is informational, not legal advice.

What one-click Vaultwarden does not include

• No root shell. You get the app and its URL, not the server underneath, so custom compose, co-located SMTP relays or arbitrary host packages are not possible. For that, self-host on a VPS.
• Not the official Bitwarden cloud or Bitwarden enterprise product. This is a third-party one-click container of the open-source Vaultwarden app in Germany.
• We do not migrate existing vaults or design your organisation/collection layout. You get the platform; vault contents and client setup are yours.
• No published SLA or AVV on the order page. Support is by e-mail, run by one person, with no guaranteed response time.

Order Vaultwarden Password Manager → · Self-host Vaultwarden on a VPS · Hosting Nextcloud · Hosting Open WebUI

Written by the person who runs overnight.host: a small, honest hosting company on dedicated bare metal. Live status at up.overnight.host.