Self-host a password manager with Vaultwarden

You can self-host a password manager on blitz.cloud by installing Vaultwarden from the App Store. It takes one click: blitz.cloud sets the port, the address and an admin token for you, gives it 1 GB of space for its data, and puts it online with HTTPS. Vaultwarden speaks the Bitwarden protocol, so the official Bitwarden apps and browser extensions work with it. There is one thing you have to do yourself, and it is important: keep your own backup, because blitz.cloud doesn't back up app files yet.

Install it

1. In the dashboard, open the App Store and pick Vaultwarden, or click Host something new and choose "A ready-made app".
2. What this app needs says it keeps your files between restarts, using part of your plan's space. It needs no database: Vaultwarden keeps everything in a SQLite file in its /data folder.
3. Give it an address, for example vault, and click Put it online.

Your vault is then at https://vault.yourname.blitz.cloud. The App Store entry already sets DOMAIN to that address and moves Vaultwarden from port 80 to 8080, since apps on blitz.cloud don't run as root.

Create your account, then close the door

Open the address and create your account. Pick a long master password; nobody, including us, can reset it.

Vaultwarden lets anyone who finds the page register, and your address is public. Once you and your family have accounts, turn that off:

1. Open the app in the dashboard and go to the Environment tab.
2. Add SIGNUPS_ALLOWED with the value false.
3. Restart the app. Settings reach the app when it restarts.

To add someone later, use the admin page at https://vault.yourname.blitz.cloud/admin. The token for it, ADMIN_TOKEN, was generated when you installed the app. It is on the Environment tab, masked until you click Show.

Connect the Bitwarden apps

In any Bitwarden client, before logging in, choose the self-hosted option and enter your address as the server URL:

https://vault.yourname.blitz.cloud

This works in the browser extensions, the desktop apps and the iOS and Android apps.

Backups: do this part

Today blitz.cloud copies databases off-site every night, but not the files apps keep in their folders. Vaultwarden's data is a file in /data, so it is not in any backup. If the disk it lives on were lost, your vault would be gone. Files are not backed up yet says the same thing in the docs.

The Bitwarden clients keep a copy of the vault on each logged-in device, which helps, but it is not a backup. Export one:

1. Open the web vault at your address.
2. Go to Tools, then Export vault.
3. Choose the encrypted JSON format with a password you'll remember, and store the file somewhere that isn't blitz.cloud.

Do it after you add anything important, or set a monthly reminder. If that sounds like too much for a password manager, you're right to hesitate, and a hosted Bitwarden account may suit you better until file backups ship here.

Limits worth knowing

Email doesn't work out of the box. blitz.cloud blocks the usual outgoing mail ports 25, 465 and 587 for every app, so Vaultwarden can't send invitation or verification mails through a mail server on those ports. If your mail provider accepts SMTP on port 2525, set Vaultwarden's SMTP_* settings on the Environment tab to use it.

Vaultwarden uses little memory. It runs in the small size, 128 MB reserved and up to 512 MB, which is plenty for a family.

Updates are manual for now. The App Store installs a fixed Vaultwarden version. Automatic updates are planned and not live yet.