Self-host a password manager with Vaultwarden

You can self-host a password manager on blitz.cloud by installing Vaultwarden from the App Store. It takes one click: blitz.cloud sets the port, the address and an admin token for you, gives it 1 GB of space for its data, and puts it online with HTTPS. Vaultwarden speaks the Bitwarden protocol, so the official Bitwarden apps and browser extensions work with it. On the free plan there is one thing you have to do yourself, and it is important: keep your own backup, because only Pro copies app files.

Install it

1. In the dashboard, open the App Store and pick Vaultwarden, or click Host something new and choose "A ready-made app".
2. What this app needs says it keeps your files between restarts, using part of your plan's space. It needs no database: Vaultwarden keeps everything in a SQLite file in its /data folder.
3. Give it an address, for example vault, and click Put it online.

Your vault is then at https://vault.yourname.blitz.cloud. The App Store entry already sets DOMAIN to that address and moves Vaultwarden from port 80 to 8080, since apps on blitz.cloud don't run as root.

Create your account, then close the door

Open the address and create your account. Pick a long master password; nobody, including us, can reset it.

Vaultwarden lets anyone who finds the page register, and your address is public. Once you and your family have accounts, turn that off:

1. Open the app in the dashboard and go to the Environment tab.
2. Add SIGNUPS_ALLOWED with the value false.
3. Restart the app. Settings reach the app when it restarts.

There is a stricter option. Make Vaultwarden a private app: connect Tailscale or WireGuard on blitz.cloud, and the vault keeps its address and HTTPS but only opens on your own devices in that network. The Bitwarden apps work the same way on those devices. Private apps never go to sleep. See private apps.

To add someone later, use the admin page at https://vault.yourname.blitz.cloud/admin. The token for it, ADMIN_TOKEN, was generated when you installed the app. It is on the Environment tab, masked until you click Show.

Connect the Bitwarden apps

In any Bitwarden client, before logging in, choose the self-hosted option and enter your address as the server URL:

https://vault.yourname.blitz.cloud

This works in the browser extensions, the desktop apps and the iOS and Android apps.

Backups: do this part

On Pro, blitz.cloud copies /data off-site every night and keeps 30 nights, so your vault can be put back from the app's Settings tab. On the free plan only databases are copied, not the files apps keep in their folders. Vaultwarden's data is a file in /data, so there it is not in any backup. If the disk it lives on were lost, your vault would be gone. Backups in the docs says the same thing.

Either way, an export of your own doesn't hurt. The Bitwarden clients keep a copy of the vault on each logged-in device, which helps, but it is not a backup. Export one:

1. Open the web vault at your address.
2. Go to Tools, then Export vault.
3. Choose the encrypted JSON format with a password you'll remember, and store the file somewhere that isn't blitz.cloud.

Do it after you add anything important, or set a monthly reminder. If that sounds like too much for a password manager, you're right to hesitate, and Pro or a hosted Bitwarden account may suit you better.

Limits worth knowing

Email doesn't work out of the box. blitz.cloud blocks the usual outgoing mail ports 25, 465 and 587 for every app, so Vaultwarden can't send invitation or verification mails through a mail server on those ports. If your mail provider accepts SMTP on port 2525, set Vaultwarden's SMTP_* settings on the Environment tab to use it.

Vaultwarden uses little memory. It runs in the small size, 128 MB reserved and up to 512 MB, which is plenty for a family.

Updates come overnight. With automatic updates on, blitz.cloud checks every night around 4:00 UTC whether a newer Vaultwarden is out for the version the App Store installed, and puts it online. If the new version doesn't start within ten minutes, the one before comes back, and the app's Activity tab says so.