---
title: "How to Self-Host Bitwarden Password Manager on Ubuntu 24.04"
description: "Install the official self-hosted Bitwarden server on Ubuntu 24.04 with Docker and Let's Encrypt, configure SMTP, disable open sign-ups and back up the vault."
category: "Web Applications Hosting"
language: en
source: https://cubepath.com/docs/web-applications-hosting/bitwarden-self-hosted-password-manager
updated: 2026-09-25
---

# How to Self-Host Bitwarden Password Manager on Ubuntu 24.04

Bitwarden is an open-source password manager with end-to-end encrypted vaults and clients for browsers, desktop and mobile. In this tutorial you will install the official self-hosted Bitwarden server on Ubuntu 24.04 using the `bitwarden.sh` installer, which runs the whole stack (web vault, API, identity service, SQL Server and Nginx) in Docker and obtains a Let's Encrypt certificate. You will then configure email, create your account, close public registration and back up the data.

> Note: If you want something lighter for a few users, [Vaultwarden](https://github.com/dani-garcia/vaultwarden) is a community server compatible with the Bitwarden clients that runs in a single small container. This guide covers the official server.

## Prerequisites

To follow this guide you need:

- A server running Ubuntu 24.04 LTS (x86_64) with at least 2 GB of RAM (4 GB recommended) and 12 GB of free disk, for example a CubePath VPS. The bundled Microsoft SQL Server container is the reason for the memory requirement.
- A non-root user with `sudo` privileges.
- A domain name, referred to as `your_domain` (for example `vault.example.com`), with a DNS A record pointing to `your_server_ip`.
- Ports 80 and 443 free on the server. Bitwarden runs its own Nginx container, so don't install another web server on these ports.
- An SMTP account to send email. Bitwarden uses email for account verification, invitations and passwordless login to the admin portal.

## Step 1 - Installing Docker Engine and Docker Compose

The installer requires Docker Engine and the Compose plugin. Install them from Docker's official repository, starting with the repository key:

```bash
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
```

Add the repository and install the packages:

```bash
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

Verify the installation:

```bash
sudo docker compose version
```

```output
Docker Compose version v2.x.x
```

## Step 2 - Opening the firewall

Allow SSH, HTTP (needed for the Let's Encrypt challenge) and HTTPS:

```bash
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
```

## Step 3 - Creating a dedicated bitwarden user

Bitwarden recommends running the installation under its own account rather than root. Create the user and add it to the `docker` group so it can manage the containers:

```bash
sudo adduser bitwarden
sudo usermod -aG docker bitwarden
```

Create the installation directory and restrict it to that user:

```bash
sudo mkdir /opt/bitwarden
sudo chmod 700 /opt/bitwarden
sudo chown bitwarden:bitwarden /opt/bitwarden
```

Switch to the new user; the login shell picks up the `docker` group membership:

```bash
sudo -iu bitwarden
cd /opt/bitwarden
docker ps
```

`docker ps` should print an empty table header instead of a permission error.

## Step 4 - Getting an installation ID and key

Every self-hosted server needs an installation ID and key, which are free. Open [bitwarden.com/host](https://bitwarden.com/host), enter an email address, choose your data region (US or EU), and copy the **Installation ID** and **Installation Key** it shows. The installer asks for both values.

## Step 5 - Running the installer

As the `bitwarden` user, download the installer script from Bitwarden:

```bash
curl -Lso bitwarden.sh "https://func.bitwarden.com/api/dl/?app=self-host&platform=linux"
chmod 700 bitwarden.sh
```

It is a shell script, so read it before running it:

```bash
less bitwarden.sh
```

Start the installation:

```bash
./bitwarden.sh install
```

Answer the prompts:

- **Domain name**: `your_domain`.
- **Use Let's Encrypt**: `y`, then the email address for expiry notices. The installer requests the certificate through port 80 and renews it when you run the update command.
- **Database name**: a name for the database, for example `vault`.
- **Installation ID** and **Installation Key**: the values from Step 4.
- **Region**: `US` or `EU`, the one you picked on the website.

The installer pulls the images and writes all configuration and data under `/opt/bitwarden/bwdata`.

## Step 6 - Configuring SMTP and the admin account

Bitwarden reads environment overrides from `bwdata/env/global.override.env`. Open it:

```bash
nano /opt/bitwarden/bwdata/env/global.override.env
```

Set the SMTP values from your mail provider, and list the email addresses that may sign in to the System Administrator Portal:

```ini
globalSettings__mail__replyToEmail=no-reply@example.com
globalSettings__mail__smtp__host=smtp.example.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__username=your_smtp_user
globalSettings__mail__smtp__password=your_smtp_password
adminSettings__admins=you@example.com
```

Use `ssl=false` with port 587 (STARTTLS is negotiated automatically) or `ssl=true` with port 465. Leave the other lines in the file as the installer wrote them.

Start Bitwarden:

```bash
./bitwarden.sh start
```

The first start takes a few minutes while SQL Server initialises and the database is created. Check the containers:

```bash
docker ps --format 'table {{.Names}}\t{{.Status}}'
```

You should see containers such as `bitwarden-nginx`, `bitwarden-web`, `bitwarden-api`, `bitwarden-identity`, `bitwarden-admin` and `bitwarden-mssql`, all `Up` and eventually `(healthy)`.

## Step 7 - Creating your account

Open `https://your_domain` in a browser. The certificate should be valid and issued by Let's Encrypt. Click **Create account**, enter your email and a strong master password, and log in.

The master password encrypts your vault on the client side. Nobody, including the server administrator, can recover it, so store it somewhere safe and enable two-step login under **Settings > Security > Two-step login** once you are in.

Check the admin portal at `https://your_domain/admin`. Enter an address from `adminSettings__admins` and Bitwarden emails you a one-time login link. This also confirms that SMTP works.

## Step 8 - Disabling public sign-ups

After you and your team have accounts, stop strangers from registering on your server. Add this line to `global.override.env`:

```ini
globalSettings__disableUserRegistration=true
```

Restart to apply it:

```bash
./bitwarden.sh restart
```

New users can still join through an invitation to an organization. Free organizations are limited to two members; larger teams, groups and SSO require a paid license file, which you upload in the admin portal.

## Step 9 - Backing up the vault data

Everything Bitwarden needs to restore the server lives in `/opt/bitwarden/bwdata`: configuration, certificates, attachments and the database. The `bitwarden-mssql` container also writes a nightly database backup to `bwdata/mssql/backups`.

Copy the whole `bwdata` directory to another location regularly. For example, exit the `bitwarden` shell and create a compressed archive as root:

```bash
exit
sudo tar -czf /var/backups/bitwarden-$(date +%F).tar.gz -C /opt/bitwarden bwdata
```

To schedule it, create a cron file that archives every night and keeps two weeks:

```bash
echo '30 3 * * * root tar -czf /var/backups/bitwarden-$(date +\%F).tar.gz -C /opt/bitwarden bwdata && find /var/backups -name "bitwarden-*.tar.gz" -mtime +14 -delete' | sudo tee /etc/cron.d/bitwarden-backup
```

The archive contains the vault encryption keys and database, so copy it to an encrypted, off-server location.

## Updating Bitwarden

Update the script itself first, then the containers. The update also renews the Let's Encrypt certificate when needed:

```bash
sudo -iu bitwarden
cd /opt/bitwarden
./bitwarden.sh updateself
./bitwarden.sh update
```

Run it at least monthly: Bitwarden releases security fixes frequently, and certificates expire after 90 days if you never run `update`.

## Troubleshooting

- **The Let's Encrypt step fails during install**: DNS for `your_domain` does not point to the server yet, or port 80 is blocked or used by another web server. Fix it and run `./bitwarden.sh install` again.
- **Containers restart repeatedly**: usually SQL Server running out of memory. Check `docker logs bitwarden-mssql` and make sure the server has at least 2 GB of RAM plus swap.
- **No verification or admin login emails arrive**: check the SMTP values and `docker logs bitwarden-api` for mail errors, and confirm your provider allows outbound SMTP on the port you chose.
- **Changes in `global.override.env` have no effect**: run `./bitwarden.sh restart`. For changes in `bwdata/config.yml`, run `./bitwarden.sh rebuild` and then `./bitwarden.sh start`.

## Conclusion

The official Bitwarden server is now running on Ubuntu 24.04 with a valid certificate, working email, closed registration and a nightly backup of `bwdata`. Next, install the browser extension and mobile apps and point them to `https://your_domain` in the region/server selector at login, turn on two-step login for every user, and schedule `./bitwarden.sh update` so the server stays patched.