Cheap and Secure Bitwarden Self-Hosting Setup Plan

This guide provides a step-by-step plan to set up Bitwarden on your own server as cheaply as possible while keeping privacy and security as top priorities.

1. Choose a Cheap, Secure Server

   • Use a low-cost VPS provider with a good privacy reputation (e.g., Contabo, Hetzner, or a trusted VPS under $5/month), or reuse old hardware at home for physical control.
   • Minimum specs: 1 CPU core, 2GB RAM, 20GB SSD storage.
   • Choose Ubuntu Server 20.04 or 22.04 LTS for stability and support.

2. Set Up Your Server and Secure It

   • Update the OS fully by running:

     sudo apt update && sudo apt upgrade -y

   • Create a dedicated user for Bitwarden to isolate it:

     sudo adduser bitwarden
     sudo passwd bitwarden

   • Install Docker and Docker Compose:

     sudo apt install docker.io docker-compose curl -y
     sudo systemctl enable docker --now

   • Add the user bitwarden to the docker group:

     sudo groupadd docker
     sudo usermod -aG docker bitwarden

   • Create a directory for Bitwarden and set strict permissions:

     sudo mkdir /opt/bitwarden
     sudo chown -R bitwarden:bitwarden /opt/bitwarden
     sudo chmod 700 /opt/bitwarden

3. Get a Domain Name

   • Purchase an affordable domain from a privacy-conscious registrar (~$1–$10/year).
   • Create a DNS A record pointing your chosen domain or subdomain (e.g., bitwarden.example.com) to your server's IP address.

4. Run Bitwarden Self-Host Installation Script

   • Log in as the bitwarden user:

     sudo su - bitwarden
     cd /opt/bitwarden

   • Download the Bitwarden install script and make it executable:

     curl -s -o bitwarden.sh https://raw.githubusercontent.com/bitwarden/server/master/scripts/bitwarden.sh
     chmod +x bitwarden.sh

   • Run the installation script:

     ./bitwarden.sh install

     When prompted:
     • Enter your domain name.
     • Choose Let's Encrypt for free SSL certificates.
     • Provide an email for certificate renewal notifications.
     • Enter your Installation ID and Key (register for free at Bitwarden’s self-hosting portal).

5. Configure SMTP for Notifications

   • Set up email notifications for account verification and password resets.
   • Use a privacy-conscious SMTP provider or configure your own minimal SMTP server.
   • Edit the SMTP settings in /opt/bitwarden/bwdata/env/global.override.env.

6. Restrict Network Access

   • Allow only ports 80 (HTTP) and 443 (HTTPS) on your firewall.
   • Restrict SSH access using key authentication and limit allowed IP addresses.
   • Use firewall tools like UFW or iptables to enforce these rules on the server.

7. Enable Two-Factor Authentication (2FA)

   • Enable 2FA for your Bitwarden web vault accounts.
   • Use key-based SSH authentication and, where possible, 2FA for server logins.

8. Perform Regular Updates and Backups

   • Keep your OS and Bitwarden docker images updated:

     sudo apt update && sudo apt upgrade -y
     ./bitwarden.sh update

   • Back up your vault data regularly by securely copying the /opt/bitwarden/bwdata directory off the server.
   • Test backup restoration periodically.

9. Optional but Recommended: VPN Access

   • For stronger security, configure a VPN (WireGuard or OpenVPN) to access Bitwarden instead of exposing it publicly.
   • This requires extra setup but adds a significant security layer.

This plan combines minimal hardware cost, free open-source software, free SSL certificates, strong security practices, and privacy-conscious choices to help you maintain a cheap but secure Bitwarden self-hosted instance.

If you want help with any specific commands, configuration files, or scripts, feel free to ask!